Changes with nginx 1.31.8 21 Oct 2026
*) Change in internal API: now the JSON parser reports strings with
escape sequences as separate events, and the
ngx_json_unescape_string() function decodes a string into a separate
buffer.
*) Change: now the path specified in the "working_directory" directive
is relative to nginx prefix directory, but not to the current
directory.
*) Bugfix: worker processes exited on start or during reconfiguration if
an invalid directory was specified in the "working_directory"
directive.
*) Bugfix: worker processes might be terminated abnormally on a SIGBUS
signal when using HTTP/3 on platforms with strict alignment
requirements.
Thanks to Daewoo Choi.
*) Bugfix: "recv() failed (5: Input/output error)" alerts might appear
in logs when closing SSL connections if kernel TLS was used with
OpenSSL 3.2.0 or newer.
*) Bugfix: nginx could not be built on Solaris if the --with-control-api
option was used.
Changes with nginx 1.31.7 14 Oct 2026
*) Security: a buffer overflow might occur in a worker process when
using the "alias" directive if the request URI was changed by the
"rewrite" directive and was then mapped to a file path
(CVE-2026-15176).
*) Security: a buffer overflow might occur in a worker process while
evaluating string expressions with variables, which affected the
document root calculation and request logging in the http and stream
modules (CVE-2026-93479).
Thanks to Matt Suiche of Tolmo Inc.
*) Security: when using HTTP/3 a part of an unknown frame might be
treated as the request body, which might result in bypassing the
"client_max_body_size" limit or injecting data in the proxied request
(CVE-2026-95101).
Thanks to Hansol Lee of GOTROOT.
*) Security: when using TLS session ticket key rotation, one of the keys
was left uninitialized, which might allow to forge a session
(CVE-2026-97629).
Thanks to PhiNode Labs.
*) Security: when using asynchronous file I/O (AIO), use-after-free
might occur in certain configurations if the SSI page has "include
virtual" commands (CVE-2026-97205).
Thanks to cyberlancer.
*) Feature: the ngx_http_geoip_module and ngx_stream_geoip_module now
support databases in the MaxMind DB (MMDB) format.
*) Feature: now backend SSL certificates can be verified by IP address.
Thanks to Maxim Dounin.
*) Feature: now QUIC supports reconfiguration and binary upgrade when
using the "quic_bpf" directive.
*) Change: the ngx_http_v2_module now uses the RFC 9218 prioritization
scheme, and RFC 7540 priority signals are ignored.
*) Bugfix: a segmentation fault might occur in a worker process or
"request count is zero" alerts might appear in logs if the
"X-Accel-Redirect" header line was cached and the cached response was
then served to a client.
Thanks to Jiří Setnička and Maxim Dounin.
*) Bugfix: a segmentation fault might occur in a worker process if the
ngx_http_dav_module was used to handle COPY and MOVE methods in a
location with the "alias" directive.
Thanks to Maxim Dounin.
*) Bugfix: QUIC connections might be closed with the "quic flood
detected" message in logs if the "http3_stream_buffer_size" directive
was set to a small value; the bug had appeared in 1.27.5.
*) Bugfix: closing an SSL connection without close_notify was treated as
a clean shutdown, including the case when the connection was reset;
now "SSL_read() failed" errors appear in logs in this case.
Thanks to Maxim Dounin.
*) Bugfix: "[crit] SSL_write() failed" messages might appear in logs
when an error occurred while reading from an SSL connection.
*) Change in internal API: now the JSON parser reports strings with
escape sequences as separate events, and the
ngx_json_unescape_string() function decodes a string into a separate
buffer.
*) Change: now the path specified in the "working_directory" directive
is relative to nginx prefix directory, but not to the current
directory.
*) Bugfix: worker processes exited on start or during reconfiguration if
an invalid directory was specified in the "working_directory"
directive.
*) Bugfix: worker processes might be terminated abnormally on a SIGBUS
signal when using HTTP/3 on platforms with strict alignment
requirements.
Thanks to Daewoo Choi.
*) Bugfix: "recv() failed (5: Input/output error)" alerts might appear
in logs when closing SSL connections if kernel TLS was used with
OpenSSL 3.2.0 or newer.
*) Bugfix: nginx could not be built on Solaris if the --with-control-api
option was used.
Changes with nginx 1.31.7 14 Oct 2026
*) Security: a buffer overflow might occur in a worker process when
using the "alias" directive if the request URI was changed by the
"rewrite" directive and was then mapped to a file path
(CVE-2026-15176).
*) Security: a buffer overflow might occur in a worker process while
evaluating string expressions with variables, which affected the
document root calculation and request logging in the http and stream
modules (CVE-2026-93479).
Thanks to Matt Suiche of Tolmo Inc.
*) Security: when using HTTP/3 a part of an unknown frame might be
treated as the request body, which might result in bypassing the
"client_max_body_size" limit or injecting data in the proxied request
(CVE-2026-95101).
Thanks to Hansol Lee of GOTROOT.
*) Security: when using TLS session ticket key rotation, one of the keys
was left uninitialized, which might allow to forge a session
(CVE-2026-97629).
Thanks to PhiNode Labs.
*) Security: when using asynchronous file I/O (AIO), use-after-free
might occur in certain configurations if the SSI page has "include
virtual" commands (CVE-2026-97205).
Thanks to cyberlancer.
*) Feature: the ngx_http_geoip_module and ngx_stream_geoip_module now
support databases in the MaxMind DB (MMDB) format.
*) Feature: now backend SSL certificates can be verified by IP address.
Thanks to Maxim Dounin.
*) Feature: now QUIC supports reconfiguration and binary upgrade when
using the "quic_bpf" directive.
*) Change: the ngx_http_v2_module now uses the RFC 9218 prioritization
scheme, and RFC 7540 priority signals are ignored.
*) Bugfix: a segmentation fault might occur in a worker process or
"request count is zero" alerts might appear in logs if the
"X-Accel-Redirect" header line was cached and the cached response was
then served to a client.
Thanks to Jiří Setnička and Maxim Dounin.
*) Bugfix: a segmentation fault might occur in a worker process if the
ngx_http_dav_module was used to handle COPY and MOVE methods in a
location with the "alias" directive.
Thanks to Maxim Dounin.
*) Bugfix: QUIC connections might be closed with the "quic flood
detected" message in logs if the "http3_stream_buffer_size" directive
was set to a small value; the bug had appeared in 1.27.5.
*) Bugfix: closing an SSL connection without close_notify was treated as
a clean shutdown, including the case when the connection was reset;
now "SSL_read() failed" errors appear in logs in this case.
Thanks to Maxim Dounin.
*) Bugfix: "[crit] SSL_write() failed" messages might appear in logs
when an error occurred while reading from an SSL connection.