Published The release of the main branch nginx 1.31.6, in which the development of new features continues. The parallel supported stable branch 1.30.x contains only changes related to the elimination of serious bugs and vulnerabilities. In the future, based on the main branch 1.31.x, a stable branch 1.32 will be formed. The project code is written in C and distributed under the BSD license.
The new release has fixed the vulnerability (CVE-2026-90439) in the ngx_http_v3_module module, leading to a buffer overflow when manipulating parameters during the TLS connection negotiation phase. It is stated that the attacker has no control over the data written to the area outside the buffer, and the vulnerability is limited to denial of service or data corruption. The problem appears starting with the release of nginx 1.29.2 in configurations built with OpenSSL 3.5.0 and earlier releases.
Other changes include bug fixes and a move to ignore all QUIC transport protocol parameters received during the TLS connection setup process.