F5 Release Notes

September 15, 2026
Based on NGINX Open Source 1.29.8

NGINX Plus PLS.37.0.6.2 LTS is a security release.

• Security fix in the ngx_http_v3_module module: when using HTTP/3 with OpenSSL versions 3.5.0 and earlier, a limited heap buffer overflow may occur during TLS handshake processing under certain configurations. The condition is non-deterministic and beyond an attacker’s control. This may cause a heap buffer overflow in the NGINX worker process, potentially resulting in restart and/or limited data corruption. (CVE-2026-90439).

Before upgrading from NGINX Plus R36, review the Upgrade Notes for breaking changes.

September 15, 2026
Based on NGINX Open Source 1.31.3

NGINX Plus PLS.37.1.1.2 CR is a security release.

• Security fix in the ngx_http_v3_module module: when using HTTP/3 with OpenSSL versions 3.5.0 and earlier, a limited heap buffer overflow may occur during TLS handshake processing under certain configurations. The condition is non-deterministic and beyond an attacker’s control. This may cause a heap buffer overflow in the NGINX worker process, potentially resulting in restart and/or limited data corruption. (CVE-2026-90439).

Before upgrading from NGINX Plus R36, review the Upgrade Notes for breaking changes.

September 2, 2026
Based on NGINX Open Source 1.31.3

NGINX Plus PLS.37.1.0.1 CR is a feature release.

• Deferred license autorenewal: the license_pending_token directive which allows adding a license via the API. API v10 now supports adding a license with the PUT method.

• Variable-based rate limiting allowing rate limits to be configured dynamically based on variables.

• SSL and TLS

  • The proxy_ssl_alpn directive for stream.

  • The $ssl_sigalgs variable that returns the signature algorithm for the server certificate for an established SSL connection.

  • Lowered the logging level of some SSL alert and record-layer errors from crit to info.

• HTTP/2, HTTP/3, QUIC, and gRPC

  • Improved HTTP/2 and HTTP/3 protocol validation, including stricter handling of connection-related headers, pseudo-headers, and invalid response metadata.

  • Fixed multiple HTTP/2 proxying issues related to flow control, backend connection caching, cached responses, and incorrect Upgrade headers. …

July 22, 2026
Based on NGINX Open Source 1.29.8

NGINX Plus PLS.37.0.4.1 LTS is a bugfix release:

• If the Host header field value set by proxy_set_header evaluates to an empty string, the value of $proxy_host is used instead. This prevents sending upstream requests without a Host (HTTP/1.1) or :authority (HTTP/2) header, and also allows health checks to pass in some configurations. The bug appeared in NGINX Plus PLS.37.0.0.1 LTS.

• Restored compatibility with some third-party dynamic modules available in our repository, for example, Set-Misc and Lua. The bug appeared in NGINX Plus PLS.37.0.3.1 LTS.

July 22, 2026

This is an improvement release for NGINX Plus R36.

• Restored compatibility with some third-party dynamic modules available in our repository, for example, Set-Misc and Lua. The bug appeared in NGINX Plus R36 P7.

• The keepalive directive now accepts the 0 value, making upgrade to NGINX Plus PLS.37 LTS smoother, where HTTP 1.1 and keepalive to upstreams are enabled by default. See this blog post for details.

July 15, 2026
Based on NGINX Open Source 1.29.8

NGINX Plus PLS.37.0.3.1 LTS is a security release.

• Security fix in the ngx_http_ssi_module module: when ssi and proxy_pass with disabled buffering (off) directives are configured, an unauthenticated attacker with man-in-the-middle (MITM) ability to control responses from an upstream server may be able to cause a heap buffer over-read in the NGINX worker process, leading to limited modification of memory or a restart (CVE-2026-56434).

• Security fix: when the map directive with regex matching is configured and the map variable is included in a string expression following the captures affected by this map. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR ([CV…

July 15, 2026

This is a security release for NGINX Plus R36.

• Security fix in the ngx_http_ssi_module module: when ssi and proxy_pass with disabled buffering (off) directives are configured, an unauthenticated attacker with man-in-the-middle (MITM) ability to control responses from an upstream server may be able to cause a heap buffer over-read in the NGINX worker process, leading to limited modification of memory or a restart (CVE-2026-56434).

• Security fix: when the map directive with regex matching is configured and the map variable is included in a string expression following the captures affected by this map. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR ([CVE-2026-42533](https://my.f5.com/manage/s/a…

June 17, 2026
Based on NGINX Open Source 1.29.8

NGINX Plus PLS.37.0.2.1 LTS is a security release.

• Security fix in the ngx_http_charset_module module: when content is served or proxied through a location block with both source_charset utf-8; and a charset directive (for example, charset koi8-r;) configured, remote, unauthenticated attackers can send requests (in conjunction with conditions beyond their control) to cause a heap buffer over-read in the NGINX worker process, leading to limited disclosure of memory or a restart (CVE-2026-48142).

• Security fix in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules: when NGINX Plus is configured to proxy HTTP/2 traffic by using proxy_http_version 2 or grpc_pass, ignore_invalid_headers set to off, and large_client_header_buffers size is larger than `…

June 17, 2026

This is a security release for NGINX Plus R36.

• Security fix in the ngx_http_charset_module module: when content is served or proxied through a location block with both source_charset utf-8; and a charset directive (for example, charset koi8-r;) configured, remote, unauthenticated attackers can send requests (in conjunction with conditions beyond their control) to cause a heap buffer over-read in the NGINX worker process, leading to limited disclosure of memory or a restart (CVE-2026-48142)).

• Security fix in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules: when NGINX Plus is configured to proxy HTTP/2 traffic by using proxy_http_version 2 or grpc_pass, ignore_invalid_headers set to off, and large_client_header_buffers size is larger than 2M, a remote unauthenticated attacker co…

May 22, 2026
Based on NGINX Open Source 1.29.8

NGINX Plus PLS.37.0.1.1 LTS is a security release.

• Security fix in the ngx_http_rewrite_module module: when the rewrite replacement string contained no variables but had overlapping captures, the length of the allocated buffer could be smaller than the escaped replacement string, which could result in a buffer overflow. (CVE-2026-9256).

May 13, 2026
Based on NGINX Open Source 1.29.8

NGINX Plus PLS.37.0.0.1 LTS is the first LTS release. For more details on the release tracks, release numbering, schedule, and upgrade strategy, see the Introduction section.

• New release model: Long-Term Support (LTS) Releases and Continuous Releases (CR).

• Agentic observability module: real-time MCP traffic monitoring.

• NGINX control REST API that provides an HTTP interface for controlling an NGINX Plus instance in addition to signal-based control.

• JSON-formatted error logs: the json parameter of the error_log directive.

• Customer error log variables: the error_log_tag directive.

• Enhanced upstream latency metrics with latency histograms: the response_time_hist data for each HTTP upstream. …

May 13, 2026

This is a security release for NGINX Plus R36.

• Security fix in the ngx_http_rewrite_module module: a heap memory buffer overflow might occur in a worker process while handling a specially crafted request by the module, potentially resulting in arbitrary code execution (CVE-2026-42945).

• Security fix in the ngx_http_scgi_module and ngx_http_uwsgi_module modules: a heap memory buffer overread might occur in a worker process while handling a specially crafted response by these modules, allowing an attacker to cause a disclosure of worker process memory or segmentation fault in a worker process (CVE-2026-42946).

• Security fix in the ngx_http_charset_module module: a heap memory buffer overread might occur in a worker process while handling a specially crafted response with decoding from UTF-8 via the charset_map directive, allowing an attacker to cause a limited disclosure of worker process memory or segmentation fault in a worker process (CVE-2026-42934). …

March 24, 2026

This is a security release for NGINX Plus R36.

• Security fix in the ngx_http_dav_module module: a buffer overflow might occur while handling a COPY or MOVE request in a location with alias, allowing an attacker to modify the source or destination path outside of the document root (CVE-2026-27654).

• Security fix in the ngx_http_mp4_module module: processing of a specially crafted mp4 file might cause a worker process crash, or might have potential other impact (CVE-2026-32647).

• Security fix in the ngx_mail_auth_http_module module: a segmentation fault might occur in a worker process if the CRAM-MD5 or APOP authentication methods were used and authentication retry was enabled (CVE-2026-27651).

• Security fix in the ngx_mail_smtp_module module: an attacker might use PTR DNS records to inject data in auth_http requests, as well as in the XCLIENT command in the backend SMTP connection (CVE-2026-28753). …

March 24, 2026

This is a security release for NGINX Plus R35.

• Security Fix in the ngx_http_dav_module module: a buffer overflow might occur while handling a COPY or MOVE request in a location with alias, allowing an attacker to modify the source or destination path outside of the document root (CVE-2026-27654).

• Security Fix in the ngx_http_mp4_module module: processing of a specially crafted mp4 file might cause a worker process crash, or might have potential other impact (CVE-2026-32647).

• Security Fix in the ngx_mail_auth_http_module module: a segmentation fault might occur in a worker process if the CRAM-MD5 or APOP authentication methods were used and authentication retry was enabled (CVE-2026-27651).

• Security Fix in the ngx_mail_smtp_module module: an attacker might use PTR DNS records to inject data in auth_http requests, as well as in the XCLIENT command in the backend SMTP connection (CVE-2026-28753). …

December 1, 2025
Based on NGINX Open Source 1.29.3

NGINX Plus R36 is a feature release:

• HTTP CONNECT forward proxy: the tunnel_module that handles CONNECT requests and establishes an end-to-end virtual connection.

• Native OIDC Support for PKCE, front-channel logout, and POST client authentication.

• ACME enhancements for certificate automation: support for ACME challenges and keys for external account authorization.

• The num_map module for http and stream that, similar to the map module, allows creating variables whose values depend on numeric values or numeric value ranges.

• The $upstream_last_addr variable that keeps the IP address of the last selected upstream server. …