After a year of development, the Nginx project has announced the release of a new stable branch 1.30.0. During the preparation for the stable version, six vulnerabilities were fixed, four of which relate to the media file handling module and authentication protocols. A key change is the support for HTTP/3 and QUIC, which is now considered ready for production environments.
Fixed vulnerabilities:
- CVE-2026-27654: Buffer overflow when processing COPY or MOVE requests in a location with the alias directive could allow an attacker to escape the site's root directory.
- CVE-2026-27784: A specially crafted MP4 file may cause a worker process to crash on 32-bit platforms.
- CVE-2026-27651: Segmentation fault in the worker process when using CRAM-MD5 or APOP authentication methods with re-authentication retries enabled.
- CVE-2026-28753: Utilizing PTR DNS records for data injection in auth_http requests and the XCLIENT command in backend SMTP connections.
- CVE-2026-28755: Successful completion SSL-handshake despite the client certificate being rejected during OCSP verification in the stream module.
Other significant innovations:
- HTTP Early Hints (103): The server can send preliminary headers without waiting for the backend to fully generate the response, which speeds up page loading.
- Encrypted ClientHello (ECH): A TLS privacy feature that hides the name of the requested site from network observers.
- Sticky Sessions: The sticky directive in the upstream block ensures 'binding' client sessions to a specific server of the backend.
- Multipath TCP (MPTCP): Support for the multipath parameter in the listen directive to enhance resilience and throughput at the transport level.
- Keep-Alive: The default value of proxy_http_version has been changed to 1.1, and the Connection header is no longer sent by theproxy server, which improves connection reuse.
- OpenSSL 4.0: Compatibility with the upcoming major version of the cryptographic library has been ensured.
- geo module: The include directive within the geo block now supports wildcard characters.
Source: linux.org.ru
