NGINX Release Notes

nginx-1.31.6 mainline version has been released, with fixes for buffer overflow vulnerability when using ngx_http_v3_module (CVE-2026-90439).

See official CHANGES on nginx.org.

Below is a release summary generated by GitHub.

What's Changed

• man page updates by @pluknet in https://github.com/nginx/nginx/pull/1727
• Handle predicate location variable error by @arut in https://github.com/nginx/nginx/pull/1750
• Handle nested location lookup error by @arut in https://github.com/nginx/nginx/pull/1751
• Control API: fixed socket inheritance on binary upgrade by @pluknet in https://github.com/nginx/nginx/pull/1760
• Geo: check binary base CRC32 before relocation by @pluknet in https://github.com/nginx/nginx/pull/1739
• QUIC compatibility layer fix by @pluknet in https://github.com/nginx/nginx/pull/1769
• nginx-1.31.6-RELEASE by @pluknet in https://github.com/nginx/nginx/pull/1770

Full Changelog: https://github.com/nginx/nginx/compare/release-1.31.5...release-1.31.6

nginx-1.30.5 stable version has been released, with fixes for buffer overflow vulnerability when using ngx_http_v3_module (CVE-2026-90439).

See official CHANGES-1.30 on nginx.org.

Below is a release summary generated by GitHub.

What's Changed

• nginx-1.30.5-RELEASE by @pluknet in https://github.com/nginx/nginx/pull/1772

Full Changelog: https://github.com/nginx/nginx/compare/release-1.30.4...release-1.30.5

nginx-1.31.5 mainline version has been released, featuring control API, predicate locations, client_body_early_read directive and the ngx_http_json_module.

See official CHANGES on nginx.org.

Below is a release summary generated by GitHub.

What's Changed

• FastCGI, uWSGI: support for multibyte parameter name lengths by @VadimZhestikov in https://github.com/nginx/nginx/pull/1648
• Added client_body_early_read directive by @arut in https://github.com/nginx/nginx/pull/1641
• Added the json parser module. by @roman-f5 in https://github.com/nginx/nginx/pull/1642
• Core: make channel file descriptor receive errors non-fatal by @arut in https://github.com/nginx/nginx/pull/1662
• Memcached: respect the end marker in the maximum supported length by @VadimZhestikov in https://github.com/nginx/nginx/pull/1637
• QUIC: rejected CRYPTO frames received in 1-RTT packets by @VadimZhestikov in https://github.com/nginx/nginx/pull/1638 …

nginx-1.31.4 mainline version has been released.

See official CHANGES on nginx.org.

Below is a release summary generated by GitHub.

What's Changed

• Xslt: xmlCreatePushParserCtxt() error handling by @VadimZhestikov in https://github.com/nginx/nginx/pull/1565
• Image filter: bounded size parser reads by received data by @VadimZhestikov in https://github.com/nginx/nginx/pull/1574
• Updated security policy report methods by @pluknet in https://github.com/nginx/nginx/pull/1586
• Autoindex: use temporary pool for directory entries by @Srujan-rai in https://github.com/nginx/nginx/pull/1311
• Perl: fixed $r->print() zero copy with mutable scalars by @devnexen in https://github.com/nginx/nginx/pull/1581
• Events: validate descriptor before FD_SET() by @sbhowmikf5 in https://github.com/nginx/nginx/pull/1598
• Format specifier fixes in error logging by @nishat-06 in https://github.com/nginx/nginx/pull/1592
• GH: restrict the mark_stale job to nginx/nginx by @aminvakil in https://github.com/nginx/nginx/pull/1605
• QUIC: apply stream flow control to RESET_STREAM final_size by @arut in https://github.com/nginx/nginx/pull/1612
• Script: improved compatibility of complex value codes by @bavshin-f5 in https://github.com/nginx/nginx/pull/1601
• gRPC: narrowed special handling of "trailer only" responses by @vinaykumar-1591 in https://github.com/nginx/nginx/pull/1591 …

nginx-1.31.3 mainline version has been released, with fixes for buffer overflow vulnerability when using map with regex (CVE-2026-42533), memory disclosure vulnerability when using ngx_http_slice_module (CVE-2026-60005), and use-after-free vulnerability when using ngx_http_ssi_module (CVE-2026-56434).

See official CHANGES on nginx.org.

Below is a release summary generated by GitHub.

What's Changed

• Configure: set cache line size for loongarch64 by @shankerwangmiao in https://github.com/nginx/nginx/pull/1489
• HTTP/2: fix overlapping memcpy in CONTINUATION frames by @wufengwind in https://github.com/nginx/nginx/pull/1486
• Add missing bounds check in ngx_{http,stream}_compile_complex_value() by @wufengwind in https://github.com/nginx/nginx/pull/1484
• Revert "HTTP/2: fixed overlapping memcpy in CONTINUATION frames" by @ac000 in https://github.com/nginx/nginx/pull/1517
• GH: explicitly set permissions in workflows by @ac000 in https://github.com/nginx/nginx/pull/1451
• Charset: disabled charset_map with utf-8 in the first column by @pluknet in https://github.com/nginx/nginx/pull/1523
• Upstream: Upgrade header processing by @vinaykumar-1591 in https://github.com/nginx/nginx/pull/1476 …

nginx-1.30.4 stable version has been released, with fixes for buffer overflow vulnerability when using map with regex (CVE-2026-42533), memory disclosure vulnerability when using ngx_http_slice_module (CVE-2026-60005), and use-after-free vulnerability when using ngx_http_ssi_module (CVE-2026-56434).

See official CHANGES-1.30 on nginx.org.

Below is a release summary generated by GitHub.

What's Changed

• Nginx 1.30.4 by @arut in https://github.com/nginx/nginx/pull/1563

Full Changelog: https://github.com/nginx/nginx/compare/release-1.30.3...release-1.30.4