The release of the main branch nginx 1.31.5 has been published, continuing the development of new features. In the simultaneously supported stable branch 1.30.x, only changes related to fixing serious bugs and vulnerabilities are made. In the future, a stable branch 1.32 will be formed based on the main branch 1.31.x. The project code is written in C and distributed under the BSD license.
In the new release:
- A Rest API for external management has been added, allowing remote configuration reload, retrieving settings data, and viewing the status of worker processes. To enable API support, a build option "--with-control-api" and a command-line argument "-l" are provided. It is recommended to bind the API to a Unix socket (nginx -l unix:/path/to/sock). The Curl utility can be used to access the API.
- The ability to use a variable starting with the "$" symbol as a value for the Location directive has been added. The value of the variable, computed at runtime, determines the conditions for entering the Location block. Such Locations can be used inside other Location blocks or contain nested Locations themselves. map $arg_foo $pred { bar 1; qux 1; } location $pred { root html; }
- The ngx_http_json_module has been implemented, providing capabilities for parsing JSON data, extracting individual fields from JSON, and using these fields as variables in nginx configuration.
- The directive "client_body_early_read" has been added, which causes the request body to be read immediately after receiving the headers.
At the same time, the release of njs 1.0.1 is available, a module for integrating the JavaScript interpreter into the nginx http server. Njs allows the use of JavaScript scripts in configuration files to extend nginx capabilities. Scripts can be used to define enhanced request handling logic, configuration generation, dynamic response generation, request/response modification, or quickly create stubs for troubleshooting web applications. The project code is written in C and distributed under the BSD license.
In the njs 1.0.1 release, three vulnerabilities have been fixed: buffer overflow in the xml.exclusiveC14n function (CVE-2026-78689), access restriction bypass via js_access (CVE-2026-18329), and worker process crash through manipulations with ngx.fetch (CVE-2026-78222).
Source: opennet.ru
