Version 1.29.8 of the main branch of nginx has been released, continuing the development of new features. Only changes related to fixing serious bugs and vulnerabilities are made to the concurrently supported stable branch 1.28.x. Further, a stable branch 1.30 will be formed based on the main branch 1.29.x. The project code is written in C and is distributed under the BSD license.
I den nya utgÄvan:
- Direktivet max_headers har lagts till, vilket begrÀnsar antalet maximala HTTP-headerar i en förfrÄgan. Om grÀnsen överskrids returneras fel 400 (Bad Request). Möjligheten har överförts frÄn FreeNginx.
- Compatibility with the OpenSSL 4.0 library, which is in the alpha testing phase, has been ensured.
- It is now permitted to use masks in the 'include' directive specified within the 'geo' block.
- A bug in processing HTTP responses with status code 103 (Early Hints), returned by the proxied backend, has been fixed.
- The variables $request_port and $is_request_port are now correctly set in subrequests.
Additionally, the release of FreeNginx 1.29.8 has been published, which develops a fork of Nginx. The fork is developed by Maxim Dunin, one of the key developers of Nginx. FreeNginx is positioned as a non-commercial project ensuring the development of the Nginx codebase without corporate interference. The code for FreeNginx continues to be distributed under the BSD license. The new version ensures compatibility with OpenSSL 4.0. A buffer overflow (CVE-2026-27654) in the ngx_http_dav_module module has been fixed, which occurred when handling WebDAV COPY and MOVE requests using the 'alias' directive in 'location' blocks. The possibility of manipulating PTR records in DNS to inject attacker's data (CVE-2026-28753) in auth_http requests and the XCLIENT command in SMTP connections to the backend has been eliminated.
KĂ€lla: opennet.ru
