Changes with nginx 1.31.3 15 Jul 2026
*) Security: heap buffer overflow might occur in a worker process when
using the map directive with regex matching if the map variable was
included in a string expression after a capture affected by this map;
a similar issue might happen when using a non-cacheable variable in a
string expression (CVE-2026-42533).
Thanks to Mufeed VH of Winfunc Research and Maxim Dounin.
*) Security: uninitialized memory access might occur when using unnamed
regex captures with the "slice" directive or background cache update,
which could result in worker process memory disclosure or worker
process termination (CVE-2026-60005).
*) Security: use-after-free might occur when processing a specially
crafted proxied backend response with the ngx_http_ssi_filter_module
(CVE-2026-56434).
Thanks to P4P3R-HAK.
*) Change: the size of headers and trailers in HTTP/2 responses in the
ngx_http_proxy_v2_module and ngx_http_grpc_module is now limited with
"proxy_buffer_size" and "grpc_buffer_size" directives.
*) Change: loading of external entities is now disabled in the
ngx_http_xslt_filter_module.
Thanks to Maxim Dounin.
*) Feature: the "xml_external_entities" directive in the
ngx_http_xslt_filter_module.
Thanks to Maxim Dounin.
*) Feature: the "proxy_socket_sndbuf", "proxy_socket_rcvbuf",
"fastcgi_socket_sndbuf", "fastcgi_socket_rcvbuf",
"grpc_socket_sndbuf", "grpc_socket_rcvbuf", "scgi_socket_sndbuf",
"scgi_socket_rcvbuf", "uwsgi_socket_sndbuf", "uwsgi_socket_rcvbuf",
"tunnel_socket_sndbuf", and "tunnel_socket_rcvbuf" directives.
*) Feature: cache line size detection for loongarch64.
Thanks to Miao Wang.
*) Bugfix: now nginx rejects HTTP/2 requests with out-of-order
pseudo-headers.
*) Bugfix: in flow control in the ngx_http_v2_module.
*) Bugfix: "[error] upstream sent frame for unknown stream" and "[crit]
cache file ... contains invalid header" messages might appear in logs
when sending a cached HTTP/2 response in the ngx_http_proxy_v2_module
if the "proxy_cache_revalidate" directive was used.
*) Bugfix: nginx might send the "Upgrade" header line in HTTP/2 and
HTTP/3 responses.
*) Bugfix: in the ngx_http_perl_module.
Thanks to Maxim Dounin.
*) Bugfix: IPv6 fragmentation might not be disabled when using QUIC on
some operating systems.
*) Bugfix: in the ngx_http_auth_basic_module on Solaris.
*) Bugfixes and improvements in the ngx_http_tunnel_module.
*) Security: heap buffer overflow might occur in a worker process when
using the map directive with regex matching if the map variable was
included in a string expression after a capture affected by this map;
a similar issue might happen when using a non-cacheable variable in a
string expression (CVE-2026-42533).
Thanks to Mufeed VH of Winfunc Research and Maxim Dounin.
*) Security: uninitialized memory access might occur when using unnamed
regex captures with the "slice" directive or background cache update,
which could result in worker process memory disclosure or worker
process termination (CVE-2026-60005).
*) Security: use-after-free might occur when processing a specially
crafted proxied backend response with the ngx_http_ssi_filter_module
(CVE-2026-56434).
Thanks to P4P3R-HAK.
*) Change: the size of headers and trailers in HTTP/2 responses in the
ngx_http_proxy_v2_module and ngx_http_grpc_module is now limited with
"proxy_buffer_size" and "grpc_buffer_size" directives.
*) Change: loading of external entities is now disabled in the
ngx_http_xslt_filter_module.
Thanks to Maxim Dounin.
*) Feature: the "xml_external_entities" directive in the
ngx_http_xslt_filter_module.
Thanks to Maxim Dounin.
*) Feature: the "proxy_socket_sndbuf", "proxy_socket_rcvbuf",
"fastcgi_socket_sndbuf", "fastcgi_socket_rcvbuf",
"grpc_socket_sndbuf", "grpc_socket_rcvbuf", "scgi_socket_sndbuf",
"scgi_socket_rcvbuf", "uwsgi_socket_sndbuf", "uwsgi_socket_rcvbuf",
"tunnel_socket_sndbuf", and "tunnel_socket_rcvbuf" directives.
*) Feature: cache line size detection for loongarch64.
Thanks to Miao Wang.
*) Bugfix: now nginx rejects HTTP/2 requests with out-of-order
pseudo-headers.
*) Bugfix: in flow control in the ngx_http_v2_module.
*) Bugfix: "[error] upstream sent frame for unknown stream" and "[crit]
cache file ... contains invalid header" messages might appear in logs
when sending a cached HTTP/2 response in the ngx_http_proxy_v2_module
if the "proxy_cache_revalidate" directive was used.
*) Bugfix: nginx might send the "Upgrade" header line in HTTP/2 and
HTTP/3 responses.
*) Bugfix: in the ngx_http_perl_module.
Thanks to Maxim Dounin.
*) Bugfix: IPv6 fragmentation might not be disabled when using QUIC on
some operating systems.
*) Bugfix: in the ngx_http_auth_basic_module on Solaris.
*) Bugfixes and improvements in the ngx_http_tunnel_module.