The new release of the main branch nginx 1.27.5 has been presented, which continues to evolve new features. The parallel stable branch 1.26.x only receives changes related to fixing serious bugs and vulnerabilities. The stable branch 1.28 will further be formed based on the main branch 1.27.x. The project code is written in C and distributed under the BSD license.
Changes in nginx 1.27.5 include:
- Support for the CUBIC congestion control algorithm (RFC 9438) has been added for connections using the QUIC protocol. CUBIC works by gradually increasing the congestion window size until packet loss occurs, at which point the window size reverts to the value before the loss. In conducted tests, using CUBIC reduced the transfer time of a 500MB file by 24% at 40ms latency and BDP 750K (Bandwidth Delay Product), and by 73% at 100ms latency and BDP 9M.
- The maximum size of SSL sessions cacheable in shared memory has been increased to 8192.
- Established a build with the Musl C library.
- Work has been done to optimize performance and fix bugs in the HTTP/3 implementation.
- Fixed bugs in the implementation of the directives "grpc_ssl_password_file", "proxy_ssl_password_file", and "uwsgi_ssl_password_file", which occurred during loading SSL certificates and encryption keys from variables.
- Issues with setting the variables $ssl_curve and $ssl_curves when using plug-in implementations of elliptic curves in OpenSSL have been resolved.
Additionally, the stable releases of FreeNginx 1.27.5 and 1.27.6, which is a developing fork of Nginx, have been published. The fork is led by Maxim Dunin, one of the key developers of Nginx. FreeNginx is positioned as a noncommercial project that ensures the development of Nginx's codebase without corporate interference.
Changes in FreeNginx 1.27.5 and 1.27.6 include:
- Resolved issues when using OpenSSL 3.5 (the names of the X25519MLKEM768 group were not displayed in the $ssl_curve and $ssl_curves variables).
- Fixed a crash in the worker process in configurations with the proxy_ssl_password_file directive, which occurred when specifying variables in the proxy_ssl_certificate and proxy_ssl_certificate_key directives.
- Support for the multipath parameter has been added to the listen directive.
- Reusing SSL sessions between servers using different certificates in the ssl_trusted_certificate directive is prohibited when client SSL certificate verification is enabled.
- Resolved an issue with session reuse in a different context virtual server when using TLSv1.3 with OpenSSL 1.1.1e+.
- Fixed an issue with zlib-ng.
Additionally, the release of njs 0.8.10 took place, a module for integrating JavaScript language interpreters into the nginx http server. Various JavaScript engines can be connected. The suggested base engine is QuickJS, which supports the ECMAScript 2023 specification. Njs allows the use of JavaScript scripts in the configuration to extend the capabilities of nginx. The scripts can be used to define advanced request processing logic, create configurations, dynamically generate responses, modify requests/responses, or quickly create stubs for troubleshooting web applications.
Changes in njs 0.8.10:
- Support for the WebCrypto API, TextEncoder, and TextDecoder has been added to the QuickJS JavaScript engine.
- New modules querystring, crypto, and xml have been added to QuickJS.
- Support for the QuickJS-NG library has been added.
- The nginx module now implements reading the contents of r.requestText and r.requestBuffer from a temporary file.
Source: opennet.ru
