The release of the main branch nginx 1.29.1 has been published, continuing the development of new features. The stable branch 1.28.x is only receiving changes related to fixing serious bugs and vulnerabilities. In the future, a stable branch 1.30 will be formed based on the main branch 1.29.x. The project code is written in C and is distributed under the BSD license.
In the new release:
- A vulnerability (CVE-2025-53859) in the ngx_mail_smtp_module has been addressed, which could result in reading data from memory outside the buffer when processing specially crafted login and password values using the 'none' authentication method. This vulnerability could lead to a leak of the memory content of the nginx worker process in an HTTP request to an external authentication. server Patch.
- Certificate compression for TLSv1.3 is disabled by default.
- The 'ssl_certificate_compression' directive has been added to control compression. for TLS certificates.
- Support for 0-RTT mode has been added to the QUIC protocol implementation, available on systems with OpenSSL 3.5.1 and newer releases.
- A bug that caused the buffering of HTTP response 103 when using HTTP/2 and the 'early_hints' directive has been fixed.
- A bug in the 'none' parameter handler in the 'smtp_auth' directive has been resolved.
- In the HTTP/3 implementation, the issue with processing the port number in the 'Host' header has been addressed.
- An issue that occurred when using the same values in the 'Host' and ':authority' headers while using HTTP/2 has been fixed.
- Build for NetBSD 10.0 has been set up.
Separately, the company F5 introduced a preview release of the ngx_http_acme module, which provides capabilities for automating the request, acquisition, and renewal of certificates using the ACMEv2 (Automatic Certificate Management Environment) protocol utilized by the Let’s Encrypt certificate authority. With http_acme, administrators do not need to worry about certificate renewals; based on the parameters in the configuration, the module will automatically retrieve the necessary certificates from Let’s Encrypt or another service that supports the ACME protocol. The module's code is written in Rust using the NGINX-Rust SDK. acme_issuer letsencrypt { uri https://acme-v02.api.letsencrypt.org/directory; state_path /var/cache/nginx/acme-letsencrypt; accept_terms_of_service; } server { listen 80; # ACME HTTP-01 challenge location / { return 404; } } server { listen 443 ssl; server_name .example.com; acme_certificate letsencrypt; ssl_certificate $acme_certificate; ssl_certificate_key $acme_certificate_key; ssl_certificate_cache max=2; }
Source: opennet.ru
