NGINX is a high performance edge web server with the lowest memory footprint
and the key features to build modern and efficient web infrastructure.
NGINX functionality includes HTTP server, HTTP and mail reverse proxy, caching,
load balancing, compression, request throttling, connection multiplexing and
reuse, SSL offload and HTTP media streaming.
See also: https://nginx.org/
www/{nginx,nginx-devel,freenginx}: Drop the pcre1 dependency
Nothing calls a pcre1 symbol; modsecurity3 itself is built with pcre2.
The slave ports kept listing PCRE_ONE, an option that no longer exists.
Sponsored by: Netzkommune GmbH
www/nginx*: Security update to 1.30.5 and 1.31.6
Changes with nginx 1.30.5 15 Sep 2026
*) Security: a heap memory buffer overflow might occur in a worker
process under certain configurations when using HTTP/3 with OpenSSL
3.5.0 and earlier (CVE-2026-90439).
Thanks to Banny Liao.
*) Change: now the QUIC transport parameters extension received in an
SSL connection is always ignored.
Changes with nginx 1.31.6 15 Sep 2026
*) Security: a heap memory buffer overflow might occur in a worker
(Only the first 15 lines of the commit message are shown above )
www/nginx-full: Add maintainer note per new ports policy
The maintainer load and port lifecycle policy only excludes a port from the
outdated ratio when the reason is documented in the port itself:
https://wiki.freebsd.org/Ports/MaintainerLoadAndPortLifecyclePolicy
This is a slave port of www/nginx and follows the nginx stable branch, while
mainline is packaged as www/nginx-devel. repology merges the nginx ports into a
single project and measures the flavored slave ports against mainline: at the
time of writing it reports 1.30.4 here as outdated against 1.31.4, while the
unflavored www/nginx carrying the very same 1.30.4 is not reported at all.
No functional change, comment only.
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
- Add new NJS_QJS option to build the NJS module with the QuickJS
engine (lang/quickjs), which upstream recommends since njs 1.0.0
- Warn users with NJS enabled that the built-in njs engine is EOL
- Keep builds deterministic with NJS_QJS disabled (NJS_QUICKJS=NO)
- nginx-devel: remove leftover NJS_QJS bits pointing to deleted
patches; stop the QuickJS include path from clobbering the base
cc-opt flags
- nginx-full: enable NJS_QJS by default
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Move the bundled fdintino nginx-upload-module to release 2.3.0 and work
around its PCRE2 incompatibility.
Since the removal of the PCRE1 option nginx is built against PCRE2 only.
The module's regex filter for upload_pass_form_field still tests the
ngx_regex_exec() return code for "rc == 0", which is only true under
PCRE1; PCRE2 returns the number of captures (>= 0) on a match, so
matching
form fields were silently dropped and upload_pass_form_field was
unusable
on any dynamic (DSO) build. Relax the test to "rc >= 0" (workaround
from
upstream pull request 152).
freenginx: additionally adapt the module to the removal of r->start_sec
in freenginx >= 1.29 (nginx_version >= 1029000), which is otherwise a
build failure.
PR: 271781
Sponsored by: Netzkommune GmbH
www/nginx: Update to 1.30.4
Changes:
*) Security: heap buffer overflow when using the map directive with
regex matching (CVE-2026-42533)
*) Security: uninitialized memory access when using unnamed regex
captures with the "slice" directive or background cache update
(CVE-2026-60005)
*) Security: use-after-free when processing a specially crafted
proxied backend response with the ngx_http_ssi_filter_module
(CVE-2026-56434)
Release Notes: https://nginx.org/en/CHANGES-1.30
Security: 56feeac6-8263-11f1-92ba-bc24110523fe
Security: CVE-2026-42533
Security: CVE-2026-56434
Security: CVE-2026-60005
PR: 296830
Sponsored by: Netzkommune GmbH
www/nginx: Update to 1.30.3
Changes with nginx 1.30.3 17 Jun
2026
*) Security: a heap memory buffer overflow might occur in a worker
process when using a configuration with "ignore_invalid_headers
off;"
and "large_client_header_buffers" with large configured values
when
proxying a specially crafted request to HTTP/2 or gRPC backend,
allowing an attacker to cause worker process memory corruption or
segmentation fault in a worker process (CVE-2026-42055).
Thanks to Mufeed VH of Winfunc Research.
(Only the first 15 lines of the commit message are shown above )
www/{nginx,nginx-devel,freenginx}: 3rd-pary modules managemeht
Update mod_zip to 1.3.0 and switch Github author to evanmiller as this
seems to be author that the other, less current, versions are forked
from.
PR: 295934
Sponsored by: Netzkommune GmbH
www/nginx-full: disable google-perftools on aarch64 to fix build
devel/google-perftools has been broken on aarch64 for a long time
PR: 294841
Approved-by: maintainer timeout (joneum@)
www/nginx: Update to 1.28.3
Changes with nginx 1.28.3 24 Mar
2026
*) Security: a buffer overflow might occur while handling a COPY or
MOVE
request in a location with "alias", allowing an attacker to
modify
the source or destination path outside of the document root
(CVE-2026-27654).
Thanks to Calif.io in collaboration with Claude and Anthropic
Research.
*) Security: processing of a specially crafted mp4 file by the
(Only the first 15 lines of the commit message are shown above )
www/nginx: Update to 1.28.2
Changes with nginx 1.28.2 04 Feb
2026
*) Security: an attacker might inject plain text data in the
response
from an SSL backend (CVE-2026-1642).
*) Bugfix: use-after-free might occur after switching to the next
gRPC
or HTTP/2 backend.
*) Bugfix: fixed warning when compiling with MSVC 2022 x86.
(Only the first 15 lines of the commit message are shown above )
www/nginx: Update to 1.28.0
Changes with nginx 1.28.0:
*) 1.28.x stable branch.
*) Bugfix: nginx could not be built by gcc 15 if ngx_http_v2_module or
ngx_http_v3_module modules were used.
*) Bugfix: nginx might not be built by gcc 14 or newer with -O3 -flto
optimization if ngx_http_v3_module was used.
Update 3rd party module:
- Luastream to 0.0.16
- Passenger to 6.0.27
PR: 286312
Sponsored by: Netzkommune GmbH
www/nginx: Update to 1.26.2
Changes with nginx 1.26.2
*) Security: processing of a specially crafted mp4 file by the
ngx_http_mp4_module might cause a worker process crash
(CVE-2024-7347).
Thanks to Nils Bars.
Sponsored by: Netzkommune GmbH
www/nginx: Update to 1.26.0
Adoption of the changes of nginx-devel during the devel phase 1.25.x
Changelogs: https://nginx.org/en/CHANGES-1.26
Sponsored by: Netzkommund GmbH
www/nginx: remove third-party opentracing module (+)
Similar functionality is available with OTEL module, also
devel/libopentracing port is EOL.
Reported by: osa via private Mail
Sponsored by: Netzkomune GmbH
www/nginx-full: fix package build
nginx-full requires either to enable GSSAPI_MIT or GSSAPI_HEIMDAL but
none is enabled. As a result, fails to build bibary package on package
build cluster.
PR: 275262
Approved by: maintainer timeout
www/nginx: Update to 1.22.1
Changelog:
*) Security: processing of a specially crafted mp4 file by the
ngx_http_mp4_module might cause a worker process crash, worker
process memory disclosure, or might have potential other impact
(CVE-2022-41741, CVE-2022-41742).
Sponsored by: Netzkommune GmbH
www: remove 'Created by' lines
A big Thank You to the original contributors of these ports:
*
* <hvo.pm@xs4all.nl>
* Aaron Dalton <aaron@FreeBSD.org>
* Aaron Dalton <aaron@daltons.ca>
* Aaron LI <aly@aaronly.me>
* Aaron Zauner <az_mail@gmx.at>
* Abel Chow <achow@transoft.net>
* Adam Weinberger <adamw@FreeBSD.org>
* Ade Lovett <ade@FreeBSD.org>
* Adrian Steinmann <ast@marabu.ch>
* Akinori MUSHA aka knu <knu@idaemons.org>
(Only the first 15 lines of the commit message are shown above )
www/nginx*: remove KRB5
- The Kerberos MIT implementation is the only one is supported by the
third-party spnego module, so remove needless staff.
- Update the 3rd party module PUSH to 1.2.15
- Set PCRE1 als default Option
Sponsored by: Netzkommune GmbH
textproc/libxml2: bump all LIB_DEPENDS consumers
This is a separate commit to facilitate easier cherry-picking for
quarterly.
PR: 262853, 262940, 262877, 263126
Approved by: fluffy (mentor)
textproc/libxml2: bump all dependencies
This should make sure that all dependent ports will pick
up the new version commited with a13ec21cd733f67a9fc0dc00ab45268bdc236246
net/openldap24-client: bump all dependent port
In the earlier net/openldap24-server commit, only those which depend on
net/openldap24-sasl-client were bumped. Bumping all dependent port that
didn't get a bump to force a rebuild of these packages.
Suggested by: kib
Fix build of www/nginx-full with -fno-common
This fix should also apply to www/nginx built with option HTTP_PUSH, but
the compilation fails with:
error: no member named 'sockaddr' in 'struct redisContext'
This seems to be an unrelated issue and I have not tried to diagnose it,
yet.
The PORTREVISION is only bumped for www/nginx-full, which built for me with
this patch applied.
Bump PORTREVISION for ports depending on the canonical version of GCC
as defined in Mk/bsd.default-versions.mk which has moved from GCC 8.3
to GCC 9.1 under most circumstances now after revision 507371.
This includes ports
- with USE_GCC=yes or USE_GCC=any,
- with USES=fortran,
- using Mk/bsd.octave.mk which in turn features USES=fortran, and
- with USES=compiler specifying openmp, nestedfct, c11, c++0x, c++11-lang,
c++11-lib, c++14-lang, c++17-lang, or gcc-c++11-lib
plus, everything INDEX-11 shows with a dependency on lang/gcc9 now.
PR: 238330
Bump PORTREVISION for ports depending on the canonical version of GCC
defined via Mk/bsd.default-versions.mk which has moved from GCC 7.4 t
GCC 8.2 under most circumstances.
This includes ports
- with USE_GCC=yes or USE_GCC=any,
- with USES=fortran,
- using Mk/bsd.octave.mk which in turn features USES=fortran, and
- with USES=compiler specifying openmp, nestedfct, c11, c++0x, c++11-lang,
c++11-lib, c++14-lang, c++17-lang, or gcc-c++11-lib
plus, as a double check, everything INDEX-11 showed depending on lang/gcc7.
PR: 231590
www/nginx and www/nginx-full: remove obsolete modules and bump PORTREVISION
Some time ago www/nginx master port removed two external modules that
stayed in www/nginx-full slave port options causing pkg build failures.
Thich change removes the modules from www/nginx-full and bumps www/nginx
PORTREVISION to force revision bump for slave port.
Approved by: portmgr (adamw)
www/nginx-full, www/nginx-lite, www/nginx-naxsi: new slave ports
These ports are slaves of www/nginx featuring different options
set for greater choice of Nginx features.
Reviewed by: mat
Approved by: mat
