Published release of the main branch nginx 1.29.8, which continues the development of new features. In the parallel stable branch, 1.28.x only changes related to fixing serious bugs and vulnerabilities are made. In the future, a stable branch 1.30 will be formed based on the main branch 1.29.x. The project code is written in C and is distributed under the BSD license.
In new release:
- The directive has been added max_headers, which limits the maximum number of HTTP headers in a request. If the limit is exceeded, a 400 (Bad Request) error is returned. This feature has been carried over from FreeNginx.
- Compatibility with OpenSSL 4.0, which is currently in alpha testing.
- Masks are allowed in the include directive specified within the geo block.
- A bug in processing HTTP responses with code 103 (Early Hints), returned by the proxied backend, has been fixed.
- The variables $request_port and $is_request_port were not set in sub-requests.
Additionally, the release of the project FreeNginx 1.29.7, developing fork Nginx. The fork is developed by Maxim Dunin, one of the key developers of Nginx. FreeNginx is positioned as a non-commercial project that ensures the development of the Nginx codebase without corporate interference. The FreeNginx code continues to be provided under the BSD license. In new version compatibility with OpenSSL 4.0 has been ensured. A buffer overflow (CVE-2026-27654) has been fixed in the ngx_http_dav_module, occurring during the processing of WebDAV COPY and MOVE requests when using the alias directive in location blocks. The possibility of manipulation with PTR records in DNS to substitute attacker data (CVE-2026-28753) in auth_http requests and the XCLIENT command in SMTP connections to the backend has been eliminated.
Source: linux.org.ru
