{"id":183890,"date":"2026-10-15T04:53:55","date_gmt":"2026-10-15T02:53:55","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/obnovlenie-nginx-1-31-7-i-njs-1-0-2-s-ustraneniem-uyazvimostej"},"modified":"2026-10-15T04:53:59","modified_gmt":"2026-10-15T02:53:59","slug":"nginx-1-31-7-and-njs-1-0-2-update-with-security-fixes","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/nginx-1-31-7-and-njs-1-0-2-update-with-security-fixes","title":{"rendered":"Nginx 1.31.7 ja njs 1.0.2 uuendamine haavatavuste k\u00f5rvaldamisega","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Amet dele uitel p\u00f5hiversiooni nginx 1.31.7, mille raames arendatakse uusi v\u00f5imalusi, samuti vabastatakse paralleelselt toetatud stabiilne versioon nginx 1.30.6, kuhu kantakse vaid muudatused, mis on seotud t\u00f5siste vigade ja haavatavuste likvideerimisega. Uuendustes on k\u00f5rvaldatud 5 haavatavust:<\/p>\n<ul>\n<li class=\"l\"> CVE-2026-15176 \u2014 puhver \u00fcleloomine, mis ilmneb direktiivi \"alias\" kasutamisel konfiguratsioonides, mis muudavad p\u00e4ringu URI-d l\u00e4bi direktiivi<br \/>\n  \u201erewrite\u201c koos edasise suunamisega failile.<br \/>\n       CVE-2026-93479 \u2014 puhver \u00fcleloomine, mis tekib stringiavaldiste t\u00e4itmisel muutujatega ja mis ilmneb juurkausta teele arvutamisel ning p\u00e4ringute logimisel http ja stream moodulites.<\/p>\n<li class=\"l\"> CVE-2026-95101 \u2014 piirangu \u201eclient_max_body_size\u201c k\u00f5rvaldamine ja kolmandate osapoolte andmete sisestamine edastatavasse p\u00e4ringusse sobimatute kaadrite edastamise kaudu HTTP\/3, mille osa sisu v\u00f5is t\u00f6\u00f6delda p\u00e4ringu kehana.\n<li class=\"l\"> CVE-2026-97629 \u2014 TLS-seansside vale edastamine, kuna \u00fcks seansiv\u00f5ti j\u00e4i initsialiseerimata rotatsiooni ajal.\n<li class=\"l\"> CVE-2026-97205 \u2014 m\u00e4lu juurde p\u00e4\u00e4semine p\u00e4rast selle vabastamist (use-after-free), mis ilmneb SSI-lehtedel \u201einclude virtual\u201c k\u00e4skude kasutamisel koos as\u00fcnkroonse sisendi\/v\u00e4ljundi (AIO) rakendamisega.\n<li class=\"l\"> CVE-2026-97205 \u2014 m\u00e4lu juurde p\u00e4\u00e4semine p\u00e4rast selle vabastamist (use-after-free), mille t\u00f5ttu ilmneb \u201einclude virtual\u201c k\u00e4skude kasutamisel SSI-lehtedel as\u00fcnkroonse sisendi\/v\u00e4ljundi (AIO) rakendamise kombinatsioon.\n<\/ul>\n<p>Nginx 1.31.7 mitte-haavatavusega seotud muudatused: <\/p>\n<ul>\n<li class=\"l\"> Modulitesse ngx_http_geoip_module ja ngx_stream_geoip_module on lisatud toetus MaxMind (MMDB) formaadis andmebaasidele.\n<li class=\"l\"> On rakendatud v\u00f5imalus IP-aadressi kontrollimiseks <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/et\/ssl-sertifikat\/\"   title=\"SSL-sertifikaadid\" data-wpil-keyword-link=\"linked\">SSL-sertifikaadid<\/a>, mida kasutatakse tagaplaanil.\n<li class=\"l\"> On rakendatud k\u00e4ivitatava faili \u00fcmberkonfigureerimise ja uuendamise v\u00f5imalused, kasutades quic_bpf direktiivi seadetesse.\n<li class=\"l\"> Moodsas ngx_http_v2_module moodulis on rakendatud prioriteetide m\u00e4\u00e4ramise skeem, vastavalt RFC 9218.\n<\/ul>\n<p>Samuti on saadaval versioon njs 1.0.2, moodul, mis integreerib JavaScripti t\u00f5lgendaja nginx HTTP-serverisse. Njs v\u00f5imaldab kasutada JavaScripti skripte konfiguratsioonifailides, et laiendada nginx-i v\u00f5imalusi. Skripte saab kasutada t\u00e4iustatud p\u00e4ringute t\u00f6\u00f6tlemise loogika m\u00e4\u00e4ratlemiseks, konfiguratsiooni vormimiseks, d\u00fcnaamiliseks vastuste genereerimiseks, p\u00e4ringu\/vastuse modifitseerimiseks v\u00f5i probleeme lahendavate sisu loomiseks veebirakendustes. Projekti kood on kirjutatud C-s ja levitatakse BSD litsentsi alusel.<\/p>\n<p>Njs versioonis 1.0.2 on k\u00f5rvaldatud haavatavused: m\u00e4lu otsa saamine vale XML-andmete anal\u00fc\u00fcsimisel (CVE-2026-101025) ja allkirjastatud XML-dokumendi kontrollimise rikutud manipuleerimise kaudu XML-atribuutidega (CVE-2026-101019). Lisatud on meetodid XMLNode.getAttributeNS() ja XMLNode.getChildNS(). M\u00e4lu tarbimist on v\u00e4hendatud njs mootori kompileerimisel.<br \/>\n<br \/>Allikas: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=66473\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0421\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0432\u0435\u0442\u043a\u0438 nginx 1.31.7, \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u0442\u0441\u044f \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u0435 \u043d\u043e\u0432\u044b\u0445 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0435\u0439, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u0440\u0430\u043b\u043b\u0435\u043b\u044c\u043d\u043e \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u043e\u0439 \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u043e\u0439 \u0432\u0435\u0442\u043a\u0438 nginx 1.30.6, \u0432 \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u0432\u043d\u043e\u0441\u044f\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0435 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0441\u0435\u0440\u044c\u0451\u0437\u043d\u044b\u0445 \u043e\u0448\u0438\u0431\u043e\u043a \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439. \u0412 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043e 5 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: CVE-2026-15176 &#8212; \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0431\u0443\u0444\u0435\u0440\u0430, \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u044e\u0449\u0435\u0435\u0441\u044f \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0434\u0438\u0440\u0435\u043a\u0442\u0438\u0432\u044b &#171;alias&#187; \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044f\u0445, \u043c\u0435\u043d\u044f\u044e\u0449\u0438\u0445 URI \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u0447\u0435\u0440\u0435\u0437 \u0434\u0438\u0440\u0435\u043a\u0442\u0438\u0432\u0443 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":10,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-183890","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0421\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0432\u0435\u0442\u043a\u0438 nginx 1.31.7, \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u0442\u0441\u044f \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u0435 \u043d\u043e\u0432\u044b\u0445 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0435\u0439, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u0440\u0430\u043b\u043b\u0435\u043b\u044c\u043d\u043e \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u043e\u0439 \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u043e\u0439 \u0432\u0435\u0442\u043a\u0438 nginx 1.30.6, \u0432 \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u0432\u043d\u043e\u0441\u044f\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Alexander Kovalev\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/news\/nginx-1-31-7-and-njs-1-0-2-update-with-security-fixes\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 nginx 1.31.7 \u0438 njs 1.0.2 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0421\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0432\u0435\u0442\u043a\u0438 nginx 1.31.7, \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u0442\u0441\u044f \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u0435 \u043d\u043e\u0432\u044b\u0445 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0435\u0439, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u0440\u0430\u043b\u043b\u0435\u043b\u044c\u043d\u043e \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u043e\u0439 \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u043e\u0439 \u0432\u0435\u0442\u043a\u0438 nginx 1.30.6, \u0432 \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u0432\u043d\u043e\u0441\u044f\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/news\/nginx-1-31-7-and-njs-1-0-2-update-with-security-fixes\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-10-15T02:53:55+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-10-15T02:53:59+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Uuendus nginx 1.31.7 ja njs 1.0.2 haavatavuste k\u00f5rvaldamisega | ProHoster","description":"On v\u00e4lja antud nginx p\u00f5hiharude versioon 1.31.7, mille raames j\u00e4tkub uute v\u00f5imaluste arendamine, samuti v\u00e4lja antud paralleelselt toetatud stabiilne haru nginx versioon 1.30.6, kuhu tehakse ainult muudatusi.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/nginx-1-31-7-and-njs-1-0-2-update-with-security-fixes","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 nginx 1.31.7 \u0438 njs 1.0.2 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster","og:description":"\u0421\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0432\u0435\u0442\u043a\u0438 nginx 1.31.7, \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u0442\u0441\u044f \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u0435 \u043d\u043e\u0432\u044b\u0445 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0435\u0439, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u0440\u0430\u043b\u043b\u0435\u043b\u044c\u043d\u043e \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u043e\u0439 \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u043e\u0439 \u0432\u0435\u0442\u043a\u0438 nginx 1.30.6, \u0432 \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u0432\u043d\u043e\u0441\u044f\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/nginx-1-31-7-and-njs-1-0-2-update-with-security-fixes","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-10-15T02:53:55+00:00","article:modified_time":"2026-10-15T02:53:59+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/183890","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=183890"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/183890\/revisions"}],"predecessor-version":[{"id":183891,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/183890\/revisions\/183891"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=183890"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=183890"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=183890"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}