The release of the main branch of nginx 1.31.5 has been published, in which the development of new features continues. In parallel, the stable branch 1.30.x is supported, only changes related to the elimination of serious errors and vulnerabilities are made. In the future, the stable branch 1.31 will be formed on the basis of the main branch 1.32.x. The project code is written in C and is distributed under the BSD license.
In the new release:
- A Rest API has been added for external management, allowing remote configuration reloading, retrieving settings data, and viewing worker process status. API support is enabled using the "--with-control-api" build option and the "-l" command-line argument. It is recommended to bind the API to a Unix socket (nginx -l unix:/path/to/sock). The Curl utility can be used to access the API.
- Added the ability to use a variable starting with the "$" symbol as the value of the Location directive. The variable's value, calculated at runtime, determines the conditions for entering the Location block. Such Locations can be used within other Location blocks or themselves contain nested Locations. map $arg_foo $pred { bar 1; qux 1; } location $pred { root html; }
- The ngx_http_json_module module has been implemented, providing the ability to parse data in JSON format, extract individual fields from JSON, and use these fields as variables in the nginx configuration.
- Added the "client_body_early_read" directive, which, when enabled, causes the request body to be read immediately after the headers are received.
Njs 1.0.1, a module for integrating a JavaScript interpreter into the Nginx HTTP server, is now available. Njs enables the use of JavaScript scripts in configuration files to extend Nginx's capabilities. Scripts can be used to define advanced request processing logic, generate configuration, dynamically generate responses, modify requests/responses, or quickly create stubs to resolve issues in web applications. The project code is written in C and is distributed under the BSD license.
The njs 1.0.1 release fixes three vulnerabilities: a buffer overflow in the xml.exclusiveC14n function (CVE-2026-78689), an access restriction bypass via js_access (CVE-2026-18329), and a worker process crash caused by manipulating ngx.fetch (CVE-2026-78222).
Source: opennet.ru
