The main branch nginx 1.31.7 has been released, within which the development of new features continues, as well as release parallel to the maintained stable branch of nginx 1.30.6, which only includes changes related to the elimination of serious bugs and vulnerabilities. The updates fix 5 vulnerabilities:
- CVE-2026-15176 – a buffer overflow that occurs when using the “alias” directive in configurations that change the request URI through the “rewrite” directive with further redirection to a file.
- CVE-2026-93479 – buffer overflow that occurs when executing string expressions with variables and manifests itself when calculating the path to the root directory and when logging requests in the http and stream
- modules CVE-2026-95101 – bypassing the “client_max_body_size” limitation and inserting third-party data into a proxied request via the transmission of incorrect frames in HTTP/3, some of the contents of which could be processed as the body of the request.
- CVE-2026-97629 – TLS session forgery due to leaving one of the session keys uninitialized during rotation.
- CVE-2026-97205 – a use-after-free memory access that occurs when using “include virtual” commands on SSI pages in combination with the use of asynchronous input/output (AIO).
Not related to vulnerabilities changes in nginx 1.31.7:
- Database support in MaxMind format has been added to the ngx_http_geoip_module and ngx_stream_geoip_module modules (MMDB).
- The ability to check SSL certificates used in the backend by IP address has been implemented.
- The ability to reconfigure and update the executable file when using the quic_bpf directive in the settings has been implemented.
- The ngx_http_v2_module module has a priority setting scheme that complies with RFC 9218.
At the same time, the release of njs 1.0.2, a module for integrating the JavaScript language interpreter into the nginx http server, is available. Njs allows you to use JavaScript scripts in configuration files to extend nginx’s capabilities. Scripts can be used to define advanced logic for processing requests, generating configurations, dynamically generating responses, modifying a request/response, or quickly creating stubs to solve problems in web applications. The project code is written in C and distributed under the BSD license.
In the release njs 1.0.2 vulnerabilities have been fixed: exhaustion of available memory when parsing incorrect XML data (CVE-2026-101025) and signed XML document verification violation via XML attribute manipulation (CVE-2026-101019). Added XMLNode.getAttributeNS() and XMLNode.getChildNS() methods. Reduced memory consumption when compiling in the njs engine.