{"id":182651,"date":"2026-07-16T04:53:25","date_gmt":"2026-07-16T02:53:25","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/obnovlenie-nginx-1-31-3-s-ustraneniem-rce-uyazvimosti"},"modified":"2026-07-16T04:53:25","modified_gmt":"2026-07-16T02:53:25","slug":"obnovlenie-nginx-1-31-3-s-ustraneniem-rce-uyazvimosti","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/news\/obnovlenie-nginx-1-31-3-s-ustraneniem-rce-uyazvimosti","title":{"rendered":"Mise \u00e0 jour nginx 1.31.3 corrigeant une vuln\u00e9rabilit\u00e9 RCE.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>La version principale de nginx 1.31.3 a \u00e9t\u00e9 publi\u00e9e, dans le cadre de laquelle le d\u00e9veloppement de nouvelles fonctionnalit\u00e9s se poursuit, ainsi que la publication de la version stable parall\u00e8le de nginx 1.30.4, qui ne re\u00e7oit que des modifications li\u00e9es \u00e0 la correction de bogues majeurs et de vuln\u00e9rabilit\u00e9s. Trois vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans les mises \u00e0 jour :    <\/p>\n<ul>\n<li class=\"l\"> CVE-2026-42533 \u2014 d\u00e9bordement de tampon se manifestant lors de l'utilisation, dans la directive \u00ab map \u00bb, de v\u00e9rifications via des expressions r\u00e9guli\u00e8res avec des substitutions utilisant des variables non nomm\u00e9es (par exemple, $1 et $2) ou des variables nomm\u00e9es, \u00e0 condition que ces variables soient mentionn\u00e9es avant la variable de r\u00e9sultat de map ou qu'une variable non mise en cache soit utilis\u00e9e. Cette vuln\u00e9rabilit\u00e9 pourrait potentiellement conduire \u00e0 une ex\u00e9cution de code \u00e0 distance sur <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/fr\/server\/dts-dronten\/\" title=\"le serveur\" data-wpil-keyword-link=\"linked\">le serveur<\/a> en envoyant une requ\u00eate HTTP sp\u00e9cialement format\u00e9e. Ce probl\u00e8me a \u00e9t\u00e9 attribu\u00e9 un niveau de criticit\u00e9 \u00e9lev\u00e9 (9.2 sur 10).\n<li class=\"l\"> CVE-2026-60005 \u2014 fuite de m\u00e9moire non initialis\u00e9e dans le processus de travail lors de l'utilisation du module ngx_http_slice_module et de l'indication dans la directive slice d'expressions r\u00e9guli\u00e8res avec substitutions utilisant des variables non nomm\u00e9es. Cette vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 class\u00e9e avec un niveau de gravit\u00e9 de 8,8 sur 10.\n<li class=\"l\"> CVE-2026-56434 \u2014 acc\u00e8s \u00e0 la m\u00e9moire apr\u00e8s sa lib\u00e9ration dans le module ngx_http_ssi_module, se produisant lors du traitement d'une r\u00e9ponse sp\u00e9cialement format\u00e9e retourn\u00e9e par un backend proxy. Cette vuln\u00e9rabilit\u00e9 pourrait conduire \u00e0 une modification du contenu de la m\u00e9moire du processus de travail. Cette probl\u00e9matique a \u00e9t\u00e9 class\u00e9e avec un niveau de gravit\u00e9 de 8,3 sur 10.        <\/ul>\n<p>Modifications sans lien avec des vuln\u00e9rabilit\u00e9s :  <\/p>\n<ul>\n<li class=\"l\">  Dans le module ngx_http_xslt_filter_module, le chargement des variables dans le document XML, dont les valeurs sont charg\u00e9es \u00e0 partir de sources externes, est d\u00e9sactiv\u00e9. La directive \u00ab xml_external_entities \u00bb a \u00e9t\u00e9 ajout\u00e9e pour contr\u00f4ler le chargement des composants externes sp\u00e9cifi\u00e9s dans le bloc DTD du document XML trait\u00e9.\n<li class=\"l\"> Des directives \u00ab proxy_socket_sndbuf \u00bb, \u00ab proxy_socket_rcvbuf \u00bb, \u00ab fastcgi_socket_sndbuf \u00bb, \u00ab fastcgi_socket_rcvbuf \u00bb, \u00ab grpc_socket_sndbuf \u00bb, \u00ab grpc_socket_rcvbuf \u00bb, \u00ab scgi_socket_sndbuf \u00bb, \u00ab scgi_socket_rcvbuf \u00bb, \u00ab uwsgi_socket_sndbuf \u00bb, \u00ab uwsgi_socket_rcvbuf \u00bb, \u00ab tunnel_socket_sndbuf \u00bb et \u00ab tunnel_socket_rcvbuf \u00bb ont \u00e9t\u00e9 ajout\u00e9es pour d\u00e9finir la taille des tampons d'envoi (SO_SNDBUF) et de r\u00e9ception (SO_RCVBUF).\n<li class=\"l\"> Pour l'architecture LoongArch64, la d\u00e9finition de la taille de bloc (cache line) utilis\u00e9e pour le transfert de donn\u00e9es entre le cache du CPU et la m\u00e9moire a \u00e9t\u00e9 mise en \u0153uvre.\n<li class=\"l\"> Les modules ngx_http_proxy_v2_module et ngx_http_grpc_module impl\u00e9mentent une restriction de la taille des en-t\u00eates et des bandes-annonces dans les r\u00e9ponses HTTP\/2 \u00e0 l'aide des directives proxy_buffer_size et grpc_buffer_size.      <\/ul>\n<p>Source : <a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=65910\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0421\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0432\u0435\u0442\u043a\u0438 nginx 1.31.3, \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u0442\u0441\u044f \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u0435 \u043d\u043e\u0432\u044b\u0445 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0435\u0439, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u0440\u0430\u043b\u043b\u0435\u043b\u044c\u043d\u043e \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u043e\u0439 \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u043e\u0439 \u0432\u0435\u0442\u043a\u0438 nginx 1.30.4, \u0432 \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u0432\u043d\u043e\u0441\u044f\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0435 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0441\u0435\u0440\u044c\u0451\u0437\u043d\u044b\u0445 \u043e\u0448\u0438\u0431\u043e\u043a \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439. \u0412 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043e 3 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438: CVE-2026-42533 &#8212; \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0431\u0443\u0444\u0435\u0440\u0430, \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u044e\u0449\u0435\u0435\u0441\u044f \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0432 \u0434\u0438\u0440\u0435\u043a\u0442\u0438\u0432\u0435 &#171;map&#187; \u043f\u0440\u043e\u0432\u0435\u0440\u043e\u043a \u0447\u0435\u0440\u0435\u0437 \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u044b\u0435 \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u044f \u0441 \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430\u043c\u0438 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":10,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-182651","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0421\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0432\u0435\u0442\u043a\u0438 nginx 1.31.3, \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u0442\u0441\u044f \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u0435 \u043d\u043e\u0432\u044b\u0445 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0435\u0439, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u0440\u0430\u043b\u043b\u0435\u043b\u044c\u043d\u043e \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u043e\u0439 \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u043e\u0439 \u0432\u0435\u0442\u043a\u0438 nginx 1.30.4, \u0432 \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u0432\u043d\u043e\u0441\u044f\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Alexander Kovalev\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/fr\/blog\/news\/obnovlenie-nginx-1-31-3-s-ustraneniem-rce-uyazvimosti\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"fr_FR\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 nginx 1.31.3 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c RCE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0421\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0432\u0435\u0442\u043a\u0438 nginx 1.31.3, \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u0442\u0441\u044f \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u0435 \u043d\u043e\u0432\u044b\u0445 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0435\u0439, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u0440\u0430\u043b\u043b\u0435\u043b\u044c\u043d\u043e \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u043e\u0439 \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u043e\u0439 \u0432\u0435\u0442\u043a\u0438 nginx 1.30.4, \u0432 \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u0432\u043d\u043e\u0441\u044f\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/fr\/blog\/news\/obnovlenie-nginx-1-31-3-s-ustraneniem-rce-uyazvimosti\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-07-16T02:53:25+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-07-16T02:53:25+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Mise \u00e0 jour de nginx 1.31.3 corrigant une vuln\u00e9rabilit\u00e9 RCE | ProHoster","description":"La version principale de nginx 1.31.3 a \u00e9t\u00e9 publi\u00e9e, poursuivant le d\u00e9veloppement de nouvelles fonctionnalit\u00e9s, ainsi que la sortie de la branche stable prise en charge en parall\u00e8le, nginx 1.30.4, qui ne re\u00e7oit que des modifications.","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/obnovlenie-nginx-1-31-3-s-ustraneniem-rce-uyazvimosti","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 nginx 1.31.3 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c RCE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 | ProHoster","og:description":"\u0421\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0432\u0435\u0442\u043a\u0438 nginx 1.31.3, \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u0442\u0441\u044f \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u0435 \u043d\u043e\u0432\u044b\u0445 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0435\u0439, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u0440\u0430\u043b\u043b\u0435\u043b\u044c\u043d\u043e \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u043e\u0439 \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u043e\u0439 \u0432\u0435\u0442\u043a\u0438 nginx 1.30.4, \u0432 \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u0432\u043d\u043e\u0441\u044f\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f.","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/obnovlenie-nginx-1-31-3-s-ustraneniem-rce-uyazvimosti","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-07-16T02:53:25+00:00","article:modified_time":"2026-07-16T02:53:25+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"182651","title":null,"description":null,"keywords":null,"keyphrases":{"focus":[],"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-08-05 12:22:03","updated":"2026-08-05 12:22:03","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/182651","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=182651"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/182651\/revisions"}],"predecessor-version":[{"id":182679,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/182651\/revisions\/182679"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=182651"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=182651"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=182651"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}