A new release of the main branch nginx 1.31.7 has been formed, continuing the development of new features, alongside the release of the parallel supported stable branch nginx 1.30.6, which only receives changes related to fixing serious bugs and vulnerabilities. The updates have addressed 5 vulnerabilities:
- CVE-2026-15176 — buffer overflow occurring during the use of
the "alias" directive in configurations that change the request URI via the
"rewrite" directive with subsequent redirection to a file. - CVE-2026-93479 — buffer overflow occurring during the execution of string expressions with variables and manifesting itself when calculating the path to the root directory and logging requests in http and stream modules.
- CVE-2026-95101 — bypassing the "client_max_body_size" limit and injecting external data into the proxied request by sending malformed frames in HTTP/3, part of which could be processed as the request body.
- CVE-2026-97629 — TLS session forgery due to leaving one of the session keys uninitialized during rotation.
- CVE-2026-97205 — use-after-free vulnerability occurring when using the "include virtual" command on SSI pages in conjunction with asynchronous I/O (AIO).
Non-vulnerability related changes in nginx 1.31.7:
- Support for MaxMind (MMDB) format databases has been added to the ngx_http_geoip_module and ngx_stream_geoip_module.
- The ability to check by IP address has been implemented, SSL certificatesused in the backend.
- Reconfiguration and executable file update capabilities have been implemented when using the quic_bpf directive in the settings.
- In the ngx_http_v2_module, a prioritization scheme compliant with RFC 9218 has been implemented.
At the same time, the njs 1.0.2 release is available, a module for integrating the JavaScript language interpreter into the nginx http server. Njs allows the use of JavaScript scripts in configuration files to extend the capabilities of nginx. Scripts can be used to define advanced request handling logic, configure settings, dynamically generate responses, modify requests/responses, or quickly create stubs to solve problems in web applications. The project code is written in C and is distributed under the BSD license.
The njs 1.0.2 release addresses vulnerabilities: exhaustion of available memory when parsing incorrect XML data (CVE-2026-101025) and violation of signed XML document verification through manipulation of XML attributes (CVE-2026-101019). Added methods XMLNode.getAttributeNS() and XMLNode.getChildNS(). Memory consumption has been reduced during compilation in the njs engine.
Source: opennet.ru
