NGINX is a high performance edge web server with the lowest memory footprint
and the key features to build modern and efficient web infrastructure.
NGINX functionality includes HTTP server, HTTP and mail reverse proxy, caching,
load balancing, compression, request throttling, connection multiplexing and
reuse, SSL offload and HTTP media streaming.
See also: https://nginx.org/
www/nginx*: Security update to 1.30.5 and 1.31.6
Changes with nginx 1.30.5 15 Sep 2026
*) Security: a heap memory buffer overflow might occur in a worker
process under certain configurations when using HTTP/3 with OpenSSL
3.5.0 and earlier (CVE-2026-90439).
Thanks to Banny Liao.
*) Change: now the QUIC transport parameters extension received in an
SSL connection is always ignored.
Changes with nginx 1.31.6 15 Sep 2026
*) Security: a heap memory buffer overflow might occur in a worker
(Only the first 15 lines of the commit message are shown above )
www/nginx-lite: Add maintainer note per new ports policy
The maintainer load and port lifecycle policy only excludes a port from the
outdated ratio when the reason is documented in the port itself:
https://wiki.freebsd.org/Ports/MaintainerLoadAndPortLifecyclePolicy
This is a slave port of www/nginx and follows the nginx stable branch, while
mainline is packaged as www/nginx-devel. repology merges the nginx ports into a
single project and measures the flavored slave ports against mainline: at the
time of writing it reports 1.30.4 here as outdated against 1.31.4, while the
unflavored www/nginx carrying the very same 1.30.4 is not reported at all.
No functional change, comment only.
Sponsored by: Netzkommune GmbH
www/nginx: Update to 1.22.1
Changelog:
*) Security: processing of a specially crafted mp4 file by the
ngx_http_mp4_module might cause a worker process crash, worker
process memory disclosure, or might have potential other impact
(CVE-2022-41741, CVE-2022-41742).
Sponsored by: Netzkommune GmbH
www/nginx-*: Fix backwards warning
PORTREVISON was set directly with 1. Before that the line did not exist. This
leads to a "Ports with version numbers going backwards" warning.
PORTREVISION now set one higher than the master port NGINX.
Discussed with: tcberner
Sponsored by: Netzkommune GmbH
www: remove 'Created by' lines
A big Thank You to the original contributors of these ports:
*
* <hvo.pm@xs4all.nl>
* Aaron Dalton <aaron@FreeBSD.org>
* Aaron Dalton <aaron@daltons.ca>
* Aaron LI <aly@aaronly.me>
* Aaron Zauner <az_mail@gmx.at>
* Abel Chow <achow@transoft.net>
* Adam Weinberger <adamw@FreeBSD.org>
* Ade Lovett <ade@FreeBSD.org>
* Adrian Steinmann <ast@marabu.ch>
* Akinori MUSHA aka knu <knu@idaemons.org>
(Only the first 15 lines of the commit message are shown above )
www/nginx-full, www/nginx-lite, www/nginx-naxsi: new slave ports
These ports are slaves of www/nginx featuring different options
set for greater choice of Nginx features.
Reviewed by: mat
Approved by: mat
