{"id":166097,"date":"2026-03-25T11:12:50","date_gmt":"2026-03-25T09:12:50","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/obnovleniya-nginx-1-29-7-i-1-28-3-s-ustraneniem-6-uyazvimostej"},"modified":"2026-03-25T11:12:50","modified_gmt":"2026-03-25T09:12:50","slug":"obnovleniya-nginx-1-29-7-i-1-28-3-s-ustraneniem-6-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/obnovleniya-nginx-1-29-7-i-1-28-3-s-ustraneniem-6-uyazvimostej","title":{"rendered":"Nginx updates 1.29.7 and 1.28.3 with the resolution of 6 vulnerabilities","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
The release of the main branch nginx 1.29.7 has been formed, continuing the development of new features, alongside the release of the parallel stable branch nginx 1.28.3, which only receives changes related to fixing serious bugs and vulnerabilities. The updates have resolved 6 vulnerabilities, three of which lead to buffer overflows. Four vulnerabilities have been assigned a high severity level (8.8 or 8.5 out of 10). <\/p>\n
\n
CVE-2026-27654 \u2014 buffer overflow in the ngx_http_dav_module when processing WebDAV COPY and MOVE requests using the 'alias' directive in 'location' blocks. The vulnerability allows altering file paths to access outside the base directory. The issue was identified using the AI model Claude.\n
CVE-2026-27784, CVE-2026-32647 \u2014 buffer overflows in the ngx_http_mp4_module when processing specially crafted mp4 files. Exploiting the vulnerability may not be limited to causing process crashes.\n
CVE-2026-27651 \u2014 null pointer dereference when improperly using CRAM-MD5 or APOP authentication methods.\n
CVE-2026-28753 \u2014 the potential for manipulating PTR records in DNS to inject attacker's data into auth_http requests and the XCLIENT command in SMTP connections to the backend.\n
CVE-2026-28755 \u2014 bypassing the OCSP certificate verification result in the stream module. <\/ul>\n
Among the non-security related changes in nginx 1.29.7 <\/p>\n
\n
Support for the Multipath TCP (MPTCP) protocol has been added, allowing packets to be delivered simultaneously over multiple routes through different network interfaces. A new parameter 'multipath' has been added to the 'listen' directive.\n
The 'local' parameter has been added to the 'keepalive' directive used in the 'upstream' block. When this parameter is specified, instead of sharing a single connection to a common upstream server mentioned in different location and server blocks, a separate connection to the upstream is maintained for each block.\n
By default, the 'keepalive' directive has been activated in the 'upstream' block.\n
When used in proxy mode, HTTP\/1.1 protocol version with keep-alive mode is set by default (the ngx_http_proxy_module now has keep-alive support enabled by default and sets '1.1' in the 'proxy_http_version' directive, stopping the default sending of the 'Connection' header). To revert to the old behavior, which allows connections to backends supporting only HTTP\/1.0, the following settings should be specified: proxy_http_version 1.0; proxy_set_header Connection 'Close'; <\/ul>\n