The release of the main branch nginx 1.29.8 has been published, continuing the development of new features. Only changes related to fixing serious bugs and vulnerabilities are made to the parallel stable branch 1.28.x. In the future, a stable branch 1.30 will be formed based on the main branch 1.29.x. The project code is written in C and is distributed under the BSD license.
In the new release:
- A max_headers directive has been added to limit the maximum number of HTTP headers in a request. If the limit is exceeded, a 400 (Bad Request) error is returned. This feature has been migrated from FreeNginx.
- Compatibility with the OpenSSL 4.0 library, currently in alpha testing, has been ensured.
- Using masks in the 'include' directive specified within the 'geo' block has been allowed.
- A bug in the processing of HTTP responses with code 103 (Early Hints) returned by the proxied backend has been fixed.
- The variables $request_port and $is_request_port were not being set correctly in subrequests, and this has been resolved.
Additionally, the release of the FreeNginx 1.29.8 project has been noted, which develops the Nginx fork. The fork is led by Maxim Dunin, one of the key developers of Nginx. FreeNginx is positioned as a non-commercial project ensuring the development of the Nginx codebase without corporate interference. The FreeNginx code continues to be supplied under the BSD license. The new version ensures compatibility with OpenSSL 4.0. A buffer overflow vulnerability (CVE-2026-27654) in the ngx_http_dav_module when processing WebDAV COPY and MOVE requests has been fixed when using the 'alias' directive in 'location' blocks. The possibility of manipulating PTR records in DNS to insert attacker data (CVE-2026-28753) in auth_http requests and the XCLIENT command in SMTP connections to the backend has been eliminated.
Source: opennet.ru
