The release of the main branch nginx 1.31.2 has been formed, continuing the development of new features, as well as the release of the parallelly maintained stable branch nginx 1.30.3, which only includes changes related to fixing critical bugs and vulnerabilities. The updates addressed 3 vulnerabilities:
- CVE-2026-42530 — use-after-free in the implementation of the HTTP/3 protocol. The issue has been assigned a critical severity level (9.2 out of 10), potentially allowing remote code execution with the privileges of a worker process when handling a specially crafted session over the QUIC protocol.
- CVE-2026-42055 — buffer overflow in the ngx_http_proxy_v2_module and ngx_http_grpc_module, manifesting during the proxying of specially crafted requests over HTTP/2 or to a gRPC backend. The issue has been assigned a critical severity level (9.2 out of 10), allowing for remote code execution. The vulnerability appears in configurations with the setting
“ignore_invalid_headers off;” and a large value for “large_client_header_buffers.” - CVE-2026-48142 — reading from outside the allocated buffer when processing specially crafted requests that lead to text recoding in UTF-8 encoding using the ngx_http_charset_module. The vulnerability arises in configurations with the “charset_map” directive when other directives “source_charset utf-8” and “charset other_encoding” are present in the location block. The issue has been assigned a moderate severity level (6.3 out of 10), allowing possible leakage of the worker process's memory contents.
In addition to fixing vulnerabilities in version nginx 1.31.2, a new variable $ssl_sigalgs has been added, which contains the signature algorithms claimed by the client in the ClientHello message during the TLS connection negotiation. The algorithm used to form the identifier passed through the variable $request_id is SipHash-2-4.
Source: opennet.ru
