www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Build the iconv and json_status modules from their own source ports.
Sponsored by: Netzkommune GmbH
www/nginx-devel: Security update to 1.31.7
The same five security fixes as 1.30.6: CVE-2026-15176, CVE-2026-93479,
CVE-2026-95101, CVE-2026-97629 and CVE-2026-97205.
1.31.7 also lets the bundled geoip modules read MaxMind DB databases, which
the new HTTP_GEOIP and STREAM_GEOIP options enable; both are off by default
and pull net/libmaxminddb.
https://nginx.org/en/CHANGES
Security: CVE-2026-15176
Security: CVE-2026-93479
Security: CVE-2026-95101
Security: CVE-2026-97629
Security: CVE-2026-97205
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Build the accept_language, aws_auth, fips_check, modsecurity3 and sts
modules from their own source ports instead of fetching them with
GH_TUPLE.
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Build the gridfs, postgres, redis2 and sflow modules from their own
source ports instead of fetching them with GH_TUPLE.
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Build the let, slowfs_cache, websockify and zstd modules from their own
source ports instead of fetching them with GH_TUPLE.
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Use the new www/nginx-module-ajp source port instead of fetching
nginx_ajp_module from GitHub.
Sponsored by: Netzkommune GmbH
www/nginx*: Security update to 1.30.5 and 1.31.6
Changes with nginx 1.30.5 15 Sep 2026
*) Security: a heap memory buffer overflow might occur in a worker
process under certain configurations when using HTTP/3 with OpenSSL
3.5.0 and earlier (CVE-2026-90439).
Thanks to Banny Liao.
*) Change: now the QUIC transport parameters extension received in an
SSL connection is always ignored.
Changes with nginx 1.31.6 15 Sep 2026
*) Security: a heap memory buffer overflow might occur in a worker
process under certain configurations when using HTTP/3 with OpenSSL
3.5.0 and earlier (CVE-2026-90439).
Thanks to Banny Liao.
*) Change: now the QUIC transport parameters extension received in an
SSL connection is always ignored.
*) Bugfix: binary upgrade refused to work if the control API socket was
specified and the new nginx executable was built with the
ngx_http_perl_module.
*) Bugfix: an error while evaluating a predicate in a predicate location
was ignored and the predicate was treated as false.
*) Bugfix: an error during a nested location lookup might be ignored if
locations given by regular expressions or predicates were configured
at the current level.
*) Bugfix: a segmentation fault might occur while reading configuration
if the "geo" directive with the "ranges" parameter was used and the
corresponding binary base file was corrupted.
Security: CVE-2026-90439
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Use the new www/nginx-module-vod source port instead of fetching
nginx-vod-module from GitHub.
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Use the new www/nginx-module-form-input source port instead of fetching
form-input-nginx-module from GitHub. The module version is now
maintained in one place for these ports.
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Use the new www/nginx-module-cache-purge source port instead of
fetching ngx_cache_purge from GitHub. The module version is now
maintained in one place for these ports.
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Use the new www/nginx-module-array-var source port instead of fetching
array-var-nginx-module from GitHub. The module version is now
maintained in one place for these ports.
Sponsored by: Netzkommune GmbH
www/nginx-devel: Update to 1.31.5
Changes with nginx 1.31.5 02 Sep
2026
*) Feature: control API.
*) Feature: predicate locations.
*) Feature: the ngx_http_json_module.
*) Feature: the "client_body_early_read" directive.
*) Bugfix: use-after-free might occur in a worker process if
proxying
with buffering was used and an error occurred while sending the
response to an HTTP/2 client.
*) Bugfix: a worker process might not exit or "accept4() failed (9:
Bad
file descriptor)" alerts might appear in logs if the worker
process
ran out of file descriptors before graceful shutdown.
*) Bugfix: requests to FastCGI and uwsgi backends were malformed if
a
parameter name was too long.
*) Bugfixes in HTTP/3, ngx_http_slice_module, and
ngx_http_memcached_module.
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Use the new www/nginx-module-njs source port instead of fetching njs
from GitHub. The module version is now maintained in one place for
these ports.
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Add www/nginx-module-ndk, a source-only port for the Nginx
Development Kit, and use it in the nginx ports instead of fetching
ngx_devel_kit from GitHub. The module version is now maintained in
one place for these ports.
Sponsored by: Netzkommune GmbH
www/nginx-devel: Update to 1.31.4
*) Feature: the "proxy_protocol" directive in the stream and mail
modules now supports the PROXY protocol version 2.
*) Change: now HTTP/2 and gRPC requests to backends are always sent with
the ":authority" pseudo-header, and HTTP/1.1 requests - with the
"Host" header.
*) Bugfix: a segmentation fault might occur in a worker process if the
"select" method was used.
*) Bugfix: incomplete gRPC responses with a non-zero "Content-Length"
header line are now treated as malformed.
*) Bugfix: in binary compatibility with third-party modules using script
codes; the bug had appeared in 1.31.3.
*) Bugfix: in the ngx_http_perl_module.
*) Bugfixes in HTTP/2, HTTP/3, ngx_http_image_filter_module, and
ngx_http_grpc_module.
Changes: https://nginx.org/en/CHANGES
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Point the MODSECURITY3 option at the owasp-modsecurity account, which now
hosts ModSecurity-nginx; the SpiderLabs path only works through GitHub's
redirect. Pin all three ports to the same commit 9eb44fd; they carried
v1.0.3, fd28e6a and v1.0.3.
Also restore two mangled lines in the freenginx MODSECURITY3 branch, which
had lost their first character, leaving the port without --with-ld-opt and
without the pcre2 dependency when the option was on.
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Start moving the bundled 3rd-party modules into dedicated
nginx-module-* ports, so that module versions are maintained in a
single place instead of the GH_TUPLE lists of the nginx ports.
As a first step, convert www/nginx-module-lua into a hybrid port
that installs the lua-nginx-module sources next to the prebuilt
DSO and use them in the three nginx ports via an unversioned
BUILD_DEPENDS instead of fetching from GitHub.
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Update bundled third-party modules; where upstream now offers a tag,
switch from a commit hash to the version tag:
- array_var: v0.05 -> v0.06
- cache_purge: hash -> 3.0.2
- ngx_devel_kit: v0.3.3 -> v0.3.4
- drizzle: hash -> v0.1.14
- aws_auth: -> f3d9862 (stays on a hash; the 2.1.1 tag lacks the
OpenSSL 3.0 build fix)
Adjust the drizzle config patch to the module's new extraction
directory name.
For freenginx, add a patch to ngx_aws_auth: freenginx dropped
ngx_http_request_t.start_sec, so obtain the request time from
ngx_time() there instead.
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Move the bundled fdintino nginx-upload-module to release 2.3.0 and work
around its PCRE2 incompatibility.
Since the removal of the PCRE1 option nginx is built against PCRE2 only.
The module's regex filter for upload_pass_form_field still tests the
ngx_regex_exec() return code for "rc == 0", which is only true under
PCRE1; PCRE2 returns the number of captures (>= 0) on a match, so
matching
form fields were silently dropped and upload_pass_form_field was
unusable
on any dynamic (DSO) build. Relax the test to "rc >= 0" (workaround
from
upstream pull request 152).
freenginx: additionally adapt the module to the removal of r->start_sec
in freenginx >= 1.29 (nginx_version >= 1029000), which is otherwise a
build failure.
PR: 271781
Sponsored by: Netzkommune GmbH
www/nginx-devel: Update to 1.31.3
Changes:
*) Security: heap buffer overflow when using the map directive with
regex matching (CVE-2026-42533)
*) Security: uninitialized memory access when using unnamed regex
captures with the "slice" directive or background cache update
(CVE-2026-60005)
*) Security: use-after-free when processing a specially crafted
proxied backend response with the ngx_http_ssi_filter_module
(CVE-2026-56434)
*) Change: the size of headers and trailers in HTTP/2 responses in
the ngx_http_proxy_v2_module and ngx_http_grpc_module is now
limited with "proxy_buffer_size" and "grpc_buffer_size"
*) Feature: the "xml_external_entities" directive in the
ngx_http_xslt_filter_module; loading of external entities is now
disabled by default
Release Notes: https://nginx.org/en/CHANGES
Security: 56feeac6-8263-11f1-92ba-bc24110523fe
Security: CVE-2026-42533
Security: CVE-2026-56434
Security: CVE-2026-60005
PR: 296830
Sponsored by: Netzkommune GmbH
www/nginx-devel: Update to 1.31.2
Changes with nginx 1.31.2 17 Jun
2026
*) Security: use-after-free might occur when using HTTP/3 and
processing
a specially crafted QUIC session, allowing an attacker to cause
worker process memory corruption or segmentation fault in a
worker
process (CVE-2026-42530).
Thanks to Trung Nguyen of CyStack.
*) Security: a heap memory buffer overflow might occur in a worker
process when using a configuration with "ignore_invalid_headers
off;"
and "large_client_header_buffers" with large configured values
when
proxying a specially crafted request to HTTP/2 or gRPC backend,
allowing an attacker to cause worker process memory corruption or
segmentation fault in a worker process (CVE-2026-42055).
Thanks to Mufeed VH of Winfunc Research.
*) Security: a heap memory buffer overread might occur in a worker
process while handling a specially sent response with decoding
from
UTF-8 via the "charset_map" directive, allowing an attacker to
cause
a limited disclosure of worker proccess memory or segmentation
fault
in a worker process (CVE-2026-48142).
Thanks to Han Yan of Xiaomi and p4p3r of CYBERONE.
*) Change: now the $request_id variable uses SipHash-2-4.
*) Feature: the $ssl_sigalgs variable.
*) Bugfix: a variable defined by the "split_clients" directive might
be
empty if all percentages were specified explicitly and summed up
to
100%.
*) Bugfix: constant time "secure_link" hash comparison.
Thanks to kodareef5.
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-pary modules managemeht
Update mod_zip to 1.3.0 and switch Github author to evanmiller as this
seems to be author that the other, less current, versions are forked
from.
PR: 295934
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: use lua-stream-nginx-module port
Replace the embedded LUASTREAM GH_TUPLE handling with a
BUILD_DEPENDS on www/lua-stream-nginx-module and use the
module sources from the dedicated port during the build.
Add freenginx compatibility patches for lua-stream-nginx-module.
Also update lua-stream-nginx-module to version 0.0.17.
PR: 294426
Sponsored by: Netzkommune GmbH
www/nginx-devel: Update to 1.31.0
Changes with nginx 1.31.0 13 May
2026
*) Security: when using the "proxy_set_body" directive, an attacker
might inject data in the proxied request to an HTTP/2 backend
(CVE-2026-42926).
Thanks to Mufeed VH of Winfunc Research.
*) Security: a heap memory buffer overflow might occur in a worker
process while handling a specially crafted request by
ngx_http_rewrite_module, potentially resulting in arbitrary code
execution (CVE-2026-42945).
Thanks to Leo Lin.
*) Security: a heap memory buffer overread might occur in a worker
process while handling a specially crafted response by
ngx_http_scgi_module or ngx_http_uwsgi_module, allowing an
attacker
to cause a disclosure of worker process memory or segmentation
fault
in a worker process (CVE-2026-42946).
Thanks to Leo Lin.
*) Security: a heap memory buffer overread might occur in a worker
process while handling a specially sent response with decoding
from
UTF-8 via the "charset_map" directive, allowing an attacker to
cause
a limited disclosure of worker proccess memory or segmentation
fault
in a worker process (CVE-2026-42934).
Thanks to David Carlier.
*) Security: when using HTTP/3, processing of connection migration
might
cause new QUIC streams to receive a new client address before
validation, allowing an attacker to cause address spoofing
(CVE-2026-40460).
Thanks to Rodrigo Laneth.
*) Security: use-after-free might occur during DNS server response
processing if the "ssl_ocsp" directive was used, allowing an
attacker
to cause worker process memory corruption or segmentation fault
in a
worker process (CVE-2026-40701).
Thanks to Leo Lin.
*) Change: now nginx rejects HTTP/2 and HTTP/3 requests with the
"Connection", "Proxy-Connection", "Keep-Alive",
"Transfer-Encoding",
"Upgrade" header lines, and "TE" with any value other than
"trailers".
*) Change: the ngx_http_dav_module now rejects a COPY or MOVE
requests
when the source and destination resources are the same or have a
parent-child collection relationship.
*) Change: the logging level of the "invalid alert" and "record
layer
failure" SSL errors, and of the "SSL alert number N" for any
alert
numbers has been lowered from "crit" to "info".
*) Change: now the "sticky" module can be disabled with the
--without-http_upstream_sticky_module configure option; the
--without-http_upstream_sticky configure option is deprecated.
*) Feature: the ngx_http_tunnel_module; support for authenticating
to
proxies in the "auth_basic", "satisfy", and "auth_delay"
directives.
*) Feature: the "least_time" directive inside the "upstream" block.
*) Feature: the "proxy_ssl_alpn" directive in the stream module.
*) Bugfix: connections with HTTP/2 backends might not be cached when
using the "proxy_set_body" or "proxy_pass_request_body"
directives.
*) Bugfix: proxied HTTP/0.9, SCGI, or uWSGI responses might be
transferred incorrectly if the first line was not fully read.
Sponsored by: Netzkommune GmbH
www/nginx-devel: Update to 1.29.8
Changes with nginx 1.29.8 07 Apr
2026
*) Feature: the "max_headers" directive.
Thanks to Maxim Dounin.
*) Feature: OpenSSL 4.0 compatibility.
*) Feature: now the "include" directive inside the "geo" block
supports
wildcards.
*) Bugfix: in processing of HTTP 103 (Early Hints) responses from a
proxied backend.
*) Bugfix: the $request_port and $is_request_port variables were not
available in subrequests.
Sponsored by: Netzkommune GmbH
www/nginx-devel: Update to 1.29.7
Changes with nginx 1.29.7 24 Mar
2026
*) Security: a buffer overflow might occur while handling a COPY or
MOVE
request in a location with "alias", allowing an attacker to
modify
the source or destination path outside of the document root
(CVE-2026-27654).
Thanks to Calif.io in collaboration with Claude and Anthropic
Research.
*) Security: processing of a specially crafted mp4 file by the
ngx_http_mp4_module on 32-bit platforms might cause a worker
process
crash, or might have potential other impact (CVE-2026-27784).
Thanks to Prabhav Srinath (sprabhav7).
*) Security: processing of a specially crafted mp4 file by the
ngx_http_mp4_module might cause a worker process crash, or might
have
potential other impact (CVE-2026-32647).
Thanks to Xint Code and Pavel Kohout (Aisle Research).
*) Security: a segmentation fault might occur in a worker process if
the
CRAM-MD5 or APOP authentication methods were used and
authentication
retry was enabled (CVE-2026-27651).
Thanks to Arkadi Vainbrand.
*) Security: an attacker might use PTR DNS records to inject data in
auth_http requests, as well as in the XCLIENT command in the
backend
SMTP connection (CVE-2026-28753).
Thanks to Asim Viladi Oglu Manizada, Colin Warren, Xiao Liu
(Yunnan
University), Yuan Tan (UC Riverside), and Bird Liu (Lanzhou
University).
*) Security: SSL handshake might succeed despite OCSP rejecting a
client
certificate in the stream module (CVE-2026-28755).
Thanks to Mufeed VH of Winfunc Research.
*) Feature: the "multipath" parameter of the "listen" directive.
*) Feature: the "local" parameter of the "keepalive" directive in
the
"upstream" block.
*) Change: now the "keepalive" directive in the "upstream" block is
enabled by default.
*) Change: now ngx_http_proxy_module supports keepalive by default;
the
default value for "proxy_http_version" is "1.1"; the "Connection"
proxy header is not sent by default anymore.
*) Bugfix: an invalid HTTP/2 request might be sent after switching
to
the next upstream if buffered body was used in the
ngx_http_grpc_module.
Changes with nginx 1.29.6 10 Mar
2026
*) Feature: session affinity support; the "sticky" directive in the
"upstream" block of the "http" module; the "server" directive
supports the "route" and "drain" parameters.
*) Change: now nginx limits the size and rate of QUIC stateless
reset
packets.
*) Bugfix: receiving a QUIC packet by a wrong worker process could
cause
the connection to terminate.
*) Bugfix: "[crit] cache file ... contains invalid header" messages
might appear in logs when sending a cached HTTP/2 response.
*) Bugfix: proxying to scgi backends might not work when using
chunked
transfer encoding and the "scgi_request_buffering" directive.
Thanks to Mufeed VH.
*) Bugfix: in the ngx_http_mp4_module.
Thanks to Andrew Lacambra.
*) Bugfix: nginx treated a comma as separator in the "Cookie"
request
header line when evaluating "$cookie_..." variables.
*) Bugfix: in IMAP command literal argument parsing.
Sponsored by: Netzkommune GmbH
www/*nginx: Switch nginx-vod-module to maintained fork
The original Kaltura nginx-vod-module repository is no longer actively
maintained and has been incompatible with FFmpeg 8 due to removed
legacy API calls.
Switch to the actively maintained fork:
https://github.com/diogoazevedos/nginx-vod-module
This restores compatibility with newer FFmpeg versions.
Reported by: Jim Terhune via ML
Sponsored by: Netzkommune GmbH
www/nginx-devel: Update to 1.29.5
Changes with nginx 1.29.5 04 Feb
2026
*) Security: an attacker might inject plain text data in the
response
from an SSL backend (CVE-2026-1642).
*) Bugfix: use-after-free might occur after switching to the next
gRPC
or HTTP/2 backend.
*) Bugfix: an invalid HTTP/2 request might be sent after switching
to
the next upstream.
*) Bugfix: a response with multiple ranges might be larger than the
source response.
*) Bugfix: fixed setting HTTP_HOST when proxying to FastCGI, SCGI,
and
uwsgi backends.
*) Bugfix: fixed warning when compiling with MSVC 2022 x86.
*) Change: the logging level of the "ech_required" SSL error has
been
lowered from "crit" to "info".
PR: 292954
Sponsored by: Netzkommune GmbH
*/*: update NGINX JavaScript to 0.9.5
Changes with njs 0.9.5
Release Date: 13 January 2026
nginx modules:
Feature: added native module support for qjs engine for http and
stream.
Bugfix: fixed js_body_filter with multiple chunks for qjs engine.
Bugfix: fixed buffer_type inheritance in if blocks for
js_body_filter. Previously, when js_body_filter was used inside an if
block, the data parameter received Buffer type instead of the expected
String type.
Bugfix: fixed js_body_filter when data is not in memory. Previously,
when upstream data was delivered from nginx cache, js_body_filter was
not able to process it correctly.
Bugfix: improved r.subrequest() error handling. Fixed a problem of a
lost write event when the njs handler making r.subrequest() is called
from a lua handler as a subrequest.
Core:
Bugfix: fixed XMLAttr object. Pointer to xmlAttr could become
invalid when the parent XMLNode was modified.
Bugfix: fixed XMLNode update.
Bugfix: fixed ArrayBuffer with detached buffers.
Bugfix: added missing detached array checks.
Bugfix: fixed fs.mkdir() and friends.
Bugfix: fixed path restoration in fs.mkdir() and friends on error.
Bugfix: fixed missed allocation check in promise code.
Sponsored by: Netzkommune GmbH
www/lua-resty-core: update to 0.1.32
- Update lua-resty-core from 0.1.31 to 0.1.32
- Bump PORTREVISION for freenginx, nginx, and nginx-devel
PR: 290817
Approvd by: zi (autoapproved)
Sponsored by: Netzkommune GmbH
www/nginx-devel: Update to 1.29.4
Changelog:
*) Feature: the ngx_http_proxy_module supports HTTP/2.
*) Feature: Encrypted ClientHello TLS extension support when using
OpenSSL ECH feature branch; the "ssl_ech_file" directive.
Thanks to Stephen Farrell.
*) Change: validation of host and port in the request line, "Host"
header field, and ":authority" pseudo-header field has been
changed
to follow RFC 3986.
*) Change: now a single LF used as a line terminator in a chunked
request or response body is considered an error.
*) Bugfix: when using HTTP/3 with OpenSSL 3.5.1 or newer a
segmentation
fault might occur in a worker process; the bug had appeared in
1.29.1.
Thanks to Jan Svojanovsky.
*) Bugfix: a segmentation fault might occur in a worker process if
the
"try_files" directive and "proxy_pass" with a URI were used.
Sponsored by: Netzkommune GmbH
*/*: update NGINX JavaScript to 0.9.4
Changes with njs 0.9.4
Release Date: 28 October 2025
nginx modules:
Feature: added HTTP forward proxy support for ngx.fetch() API.
Core:
Bugfix: fixed r.subrequest() to a location with JS handler for
QuickJS. The bug became visible after bellard/quickjs@42eb2795.
Sponsored by: Netzkommune GmbH
*/*: update NGINX JavaScript to 0.9.3
Changes with njs 0.9.3
Release Date: 07 October 2025
nginx modules:
- Bugfix: fixed heap-use-after-free while module loading.
- Bugfix: fixed heap-use-after-free in js_set handler used in log
phase. The issue was introduced in 04f6dfb (0.9.2).
Changes with njs 0.9.2
Release Date: 23 September 2025
nginx modules:
- Feature: added HTTP keepalive support for ngx.fetch() API.
- Improvement: added configure time check when the js_import directive
is not specified for http or stream.
- Bugfix: fixed merging of js_path directives for http and stream.
- Bugfix: fixed building when the ngx_http_ssl_module and
ngx_stream_ssl_module modules are unavailable.
Core:
- Change: increased the default stack size to 160k for njs VM.
- Feature: added njs.on('exit') API for the qjs engine.
- Improvement: optimized memory consumption while streaming in qjs.
- Bugfix: fixed building qjs engine with clang 19.
- Bugfix: fixed building with GCC 15 and O3 optimization level.
Sponsored by: Netzkommune GmbH
www/nginx-devel: Update to 1.29.2
Changes with nginx 1.29.2 07 Oct
2025
*) Feature: now nginx can be built with AWS-LC.
Thanks Samuel Chiang.
*) Bugfix: now the "ssl_protocols" directive works in a virtual
server
different from the default server when using OpenSSL 1.1.1 or
newer.
*) Bugfix: SSL handshake always failed when using TLSv1.3 with
OpenSSL
and client certificates and resuming a session with a different
SNI
value; the bug had appeared in 1.27.4.
*) Bugfix: the "ignoring stale global SSL error" alerts might appear
in
logs when using QUIC and the "ssl_reject_handshake" directive;
the
bug had appeared in 1.29.0.
Thanks to Vladimir Homutov.
*) Bugfix: in delta-seconds processing in the "Cache-Control"
backend
response header line.
*) Bugfix: an XCLIENT command didn't use the xtext encoding.
Thanks to Igor Morgenstern of Aisle Research.
*) Bugfix: in SSL certificate caching during reconfiguration.
Sponsored by: Netzkommune GmbH
www/nginx-devel: security update from 1.29.0 to 1.29.1
*) Security: processing of a specially crafted login/password when using
the "none" authentication method in the ngx_mail_smtp_module might
cause worker process memory disclosure to the authentication server
(CVE-2025-53859).
<ChangeLog>
*) Change: now TLSv1.3 certificate compression is disabled by default.
*) Feature: the "ssl_certificate_compression" directive.
*) Feature: support for 0-RTT in QUIC when using OpenSSL 3.5.1 or newer.
*) Bugfix: the 103 response might be buffered when using HTTP/2 and the
"early_hints" directive.
*) Bugfix: in handling "Host" and ":authority" header lines with equal
values when using HTTP/2; the bug had appeared in 1.17.9.
*) Bugfix: in handling "Host" header lines with a port when using
HTTP/3.
*) Bugfix: nginx could not be built on NetBSD 10.0.
*) Bugfix: in the "none" parameter of the "smtp_auth" directive.
</ChangeLog>
*/*: update NGINX JavaScript: 0.9.0 -> 0.9.1 (+)
Bump PORTREVISION for www/unit.
<ChangeLog>
nginx modules:
*) Feature: added Fetch API for QuickJS engine.
*) Feature: added state file for a shared dictionary.
*) Bugfix: fixed handling of Content-Length header when
a body is provided for Fetch API.
*) Bugfix: fixed qjs engine after bellard/quickjs@458c34d2.
*) Bugfix: fixed NULL pointer dereference when processing
If-* headers.
Core:
*) Feature: added ECDH support for WebCrypto.
*) Improvement: reduced memory consumption by the object hash.
The new hash uses 42% less memory per element.
*) Improvement: reduced memory consumption for concatenation of
numbers and strings.
*) Improvement: reduced memory consumption of
String.prototype.concat() with scalar values.
*) Bugfix: fixed segfault in njs_property_query().
The issue was introduced in b28e50b1 (0.9.0).
*) Bugfix: fixed Function constructor template injection.
*) Bugfix: fixed GCC compilation with O3 optimization level.
*) Bugfix: fixed constant is too large for 'long' warning
on MIPS -mabi=n32.
*) Bugfix: fixed compilation with GCC 4.1.
*) Bugfix: fixed %TypedArray%.from() with the buffer is detached
by the mapper.
*) Bugfix: fixed %TypedArray%.prototype.slice() with overlapping
buffers.
*) Bugfix: fixed handling of detached buffers for typed arrays.
*) Bugfix: fixed frame saving for async functions with
closures.
*) Bugfix: fixed RegExp compilation of patterns with
escaped '[' characters.
</ChangeLog>
www/nginx-devel: update from 1.28.0 to 1.29.0
<ChangeLog>
*) Feature: support for response code 103 from proxy and gRPC backends;
the "early_hints" directive.
*) Feature: loading of secret keys from hardware tokens with OpenSSL
provider.
*) Feature: support for the "so_keepalive" parameter of the "listen"
directive on macOS.
*) Change: the logging level of SSL errors in a QUIC handshake has been
changed from "error" to "crit" for critical errors, and to "info" for
the rest; the logging level of unsupported QUIC transport parameters
has been lowered from "info" to "debug".
*) Change: the native nginx/Windows binary release is now built using
Windows SDK 10.
*) Bugfix: nginx could not be built by gcc 15 if ngx_http_v2_module or
ngx_http_v3_module modules were used.
*) Bugfix: nginx might not be built by gcc 14 or newer with -O3 -flto
optimization if ngx_http_v3_module was used.
*) Bugfixes and improvements in HTTP/3.
</ChangeLog>
www/nginx-devel: security update from 1.27.5 to 1.28.0
<ChangeLog>
*) 1.28.x stable branch.
*) Bugfix: nginx could not be built by gcc 15 if ngx_http_v2_module or
ngx_http_v3_module modules were used.
*) Bugfix: nginx might not be built by gcc 14 or newer with -O3 -flto
optimization if ngx_http_v3_module was used.
</ChangeLog>
www/nginx-devel: update 1.27.4 -> 1.27.5
<ChangeLog>
*) Feature: CUBIC congestion control in QUIC connections.
*) Change: the maximum size limit for SSL sessions cached in shared
memory has been raised to 8192.
*) Bugfix: in the "grpc_ssl_password_file", "proxy_ssl_password_file",
and "uwsgi_ssl_password_file" directives when loading SSL
certificates and encrypted keys from variables; the bug had appeared
in 1.23.1.
*) Bugfix: in the $ssl_curve and $ssl_curves variables when using
pluggable curves in OpenSSL.
*) Bugfix: nginx could not be built with musl libc.
Thanks to Piotr Sikora.
*) Performance improvements and bugfixes in HTTP/3.
</ChangeLog>
*/*: update NGINX JavaScript: 0.8.9 -> 0.8.10 (+)
<ChangeLog>
nginx modules:
*) Feature: reading r.requestText or r.requestBuffer from
a temp file.
Previously, an exception was thrown when accessing r.requestText
or r.requestBuffer if a client request body size exceeded
client_body_buffer_size.
*) Improvement: improved reporting of unhandled promise rejections.
*) Bugfix: fixed name corruption in variable and header processing.
*) Bugfix: fixed SharedDict.incr() with empty init argument
for QuickJS engine.
*) Bugfix: accepting response headers with underscore characters
in Fetch API.
Core:
*) Change: fixed serializeToString().
Previously, serializeToString() was exclusiveC14n() which returned
string instead of Buffer. According to the published documentation it
should be c14n().
*) Feature: added WebCrypto API for QuickJS engine.
*) Feature: added TextEncoder/TextDecoder for QuickJS engine.
*) Feature: added querystring module for QuickJS engine.
*) Feature: added crypto module for QuickJS engine.
*) Feature: added xml module for QuickJS engine.
*) Feature: added support for QuickJS-NG library.
*) Bugfix: fixed buffer.concat() with a single argument in quickjs.
*) Bugfix: added missed syntax error for await in template literal.
*) Bugfix: fixed non-NULL terminated strings formatting in
exceptions for QuickJS engine.
*) Bugfix: fixed compatibility with recent change in QuickJS
and QuickJS-NG.
</ChangeLog>
www/nginx-devel: security update from 1.27.3 to 1.27.4
<ChangeLog>
*) Security: insufficient check in virtual servers handling with TLSv1.3
SNI allowed to reuse SSL sessions in a different virtual server, to
bypass client SSL certificates verification (CVE-2025-23419).
*) Feature: the "ssl_object_cache_inheritable", "ssl_certificate_cache",
"proxy_ssl_certificate_cache", "grpc_ssl_certificate_cache", and
"uwsgi_ssl_certificate_cache" directives.
*) Feature: the "keepalive_min_timeout" directive.
*) Workaround: "gzip filter failed to use preallocated memory" alerts
appeared in logs when using zlib-ng.
*) Bugfix: nginx could not build libatomic library using the library
sources if the --with-libatomic=DIR option was used.
*) Bugfix: QUIC connection might not be established when using 0-RTT;
the bug had appeared in 1.27.1.
*) Bugfix: nginx now ignores QUIC version negotiation packets from
clients.
*) Bugfix: nginx could not be built on Solaris 10 and earlier with the
ngx_http_v3_module.
*) Bugfixes in HTTP/3.
</ChangeLog>
*/*: update NGINX JavaScript: 0.8.8 -> 0.8.9 (+)
<ChangeLog>
nginx modules:
*) Bugfix: removed extra VM creation per server.
Previously, when js_import was declared in http or stream blocks,
an extra copy of the VM instance was created for each server
block. This was not needed and consumed a lot of memory for
configurations with many server blocks.
This issue was introduced in 9b674412 (0.8.6) and was partially
fixed for location blocks only in 685b64f0 (0.8.7).
Core:
*) Feature: added fs module for QuickJS engine.
</ChangeLog>
www/nginx-devel: update from 1.27.2 to 1.27.3
<ChangeLog>
*) Feature: the "server" directive in the "upstream" block supports the
"resolve" parameter.
*) Feature: the "resolver" and "resolver_timeout" directives in the
"upstream" block.
*) Feature: SmarterMail specific mode support for IMAP LOGIN with
untagged CAPABILITY response in the mail proxy module.
*) Change: now TLSv1 and TLSv1.1 protocols are disabled by default.
*) Change: an IPv6 address in square brackets and no port can be
specified in the "proxy_bind", "fastcgi_bind", "grpc_bind",
"memcached_bind", "scgi_bind", and "uwsgi_bind" directives, and as
client address in ngx_http_realip_module.
*) Bugfix: in the ngx_http_mp4_module.
Thanks to Nils Bars.
*) Bugfix: the "so_keepalive" parameter of the "listen" directive might
be handled incorrectly on DragonFly BSD.
*) Bugfix: in the "proxy_store" directive.
</ChangeLog>
*/*: update NGINX JavaScript: 0.8.5 -> 0.8.7 (+)
<ChangeLog>
Changes with njs 0.8.7 22 Oct 2024
nginx modules:
*) Bugfix: eliminated unnecessary VM creation.
Previously, njs consumed memory proportionally to the number of
nginx locations. The issue was introduced in 9b674412 (0.8.6).
*) Improvement: added strict syntax validation for js_body_filter.
*) Improvement: improved error messages for module loading
failures.
Core:
*) Feature: implemented fs.readlink() and friends.
*) Improvement: implemented lazy stack symbolization.
*) Bugfix: fixed heap-buffer-overflow in Buffer.prototype.indexOf().
The issue was introduced in 5d15a8d6 (0.8.6).
*) Bugfix: fixed Buffer.prototype.lastIndexOf() when `from` is
provided.
Changes with njs 0.8.6 02 Oct 2024
nginx modules:
*) Feature: introduced QuickJS engine.
*) Feature: added optional nocache flag for js_set directive.
Thanks to Thomas P.
*) Feature: exposed capture group variables in HTTP module.
Thanks to Thomas P.
Core:
*) Feature: added Buffer module for QuickJS engine.
*) Bugfix: fixed handling of empty labelled statement in a function.
*) Bugfix: fixed Function constructor handling when called without
arguments.
*) Bugfix: fixed Buffer.prototype.writeInt8() and friends.
*) Bugfix: fixed Buffer.prototype.writeFloat() and friends.
*) Bugfix: fixed Buffer.prototype.lastIndexOf().
*) Bugfix: fixed Buffer.prototype.write().
*) Bugfix: fixed maybe-uninitialized warnings in error creation.
*) Bugfix: fixed 'ctx.codepoint' initialization in UTF-8 decoding.
*) Bugfix: fixed 'length' initialization in Array.prototype.pop().
*) Bugfix: fixed handling of encode arg in fs.readdir() and
fs.realpath().
</ChangeLog>
www/nginx-devel: update from 1.27.1 to 1.27.2
<ChangeLog>
*) Feature: SSL certificates, secret keys, and CRLs are now cached on
start or during reconfiguration.
*) Feature: client certificate validation with OCSP in the stream
module.
*) Feature: OCSP stapling support in the stream module.
*) Feature: the "proxy_pass_trailers" directive in the
ngx_http_proxy_module.
*) Feature: the "ssl_client_certificate" directive now supports
certificates with auxiliary information.
*) Change: now the "ssl_client_certificate" directive is not required
for client SSL certificates verification.
</ChangeLog>
www/nginx-devel: security update 1.27.0 -> 1.27.1
<ChangeLog>
*) Security: processing of a specially crafted mp4 file by the
ngx_http_mp4_module might cause a worker process crash
(CVE-2024-7347).
Thanks to Nils Bars.
*) Change: now the stream module handler is not mandatory.
*) Bugfix: new HTTP/2 connections might ignore graceful shutdown of old
worker processes.
Thanks to Kasei Wang.
*) Bugfixes in HTTP/3.
</ChangeLog>
*/*: update NGINX JavaScript: 0.8.4 -> 0.8.5 (+)
<ChangeLog>
*) Change: r.variables.var, r.requestText, r.responseText,
s.variables.var, and the "data" argument of the s.on() callback
with "upload" or "download" event types will now convert bytes
invalid in UTF-8 encoding into the replacement character. When
working with binary data, use r.rawVariables.var, r.requestBuffer,
r.responseBuffer, s.rawVariables.var, and the "upstream" or
"downstream" event type for s.on() instead.
*) Feature: added timeout argument for shared dictionary methods
add(), set() and incr().
*) Bugfix: fixed checking for duplicate js_set variables.
*) Bugfix: fixed request Host header when the port is non-standard.
*) Bugfix: fixed handling of a zero-length request body in ngx.fetch()
and r.subrequest().
*) Bugfix: fixed heap-buffer-overflow in Headers.get().
*) Bugfix: fixed r.subrequest() error handling.
Core:
*) Feature: added zlib module for QuickJS engine.
*) Bugfix: fixed zlib.inflate().
*) Bugfix: fixed String.prototype.replaceAll() with zero-length
argument.
*) Bugfix: fixed retval handling after an exception in
Array.prototype.toSpliced(), Array.prototype.toReversed(),
Array.prototype.toSorted().
*) Bugfix: fixed RegExp.prototype[@@replace]() with replacements
containing "$'", "$\`" and strings with Unicode characters.
*) Bugfix: fixed a one-byte overread in decodeURI() and
decodeURIComponent().
*) Bugfix: fixed tracking of argument scope.
*) Bugfix: fixed integer overflow in Date.parse().
</ChangeLog>
www/nginx-devel: security update from 1.26.0 to 1.27.0
Update third-party passenger module to 6.0.22.
<ChangeLog>
*) Security: when using HTTP/3, processing of a specially crafted QUIC
session might cause a worker process crash, worker process memory
disclosure on systems with MTU larger than 4096 bytes, or might have
potential other impact (CVE-2024-32760, CVE-2024-31079,
CVE-2024-35200, CVE-2024-34161).
Thanks to Nils Bars of CISPA.
*) Feature: variables support in the "proxy_limit_rate",
"fastcgi_limit_rate", "scgi_limit_rate", and "uwsgi_limit_rate"
directives.
*) Bugfix: reduced memory consumption for long-lived requests if "gzip",
"gunzip", "ssi", "sub_filter", or "grpc_pass" directives are used.
*) Bugfix: nginx could not be built by gcc 14 if the --with-atomic
option was used.
Thanks to Edgar Bonet.
*) Bugfixes in HTTP/3.
<ChangeLog>
*/*: update NGINX JavaScript: 0.8.3 -> 0.8.4 (+)
<ChangeLog>
nginx modules:
*) Feature: allowing to set Server header for outgoing headers.
*) Improvement: validating URI and args arguments in r.subrequest().
*) Improvement: checking for duplicate js_set variables.
*) Bugfix: fixed clear() method of a shared dictionary without
timeout introduced in 0.8.3.
*) Bugfix: fixed r.send() with Buffer argument.
Core:
*) Feature: added QuickJS engine support in CLI.
*) Bugfix: fixed atob() with non-padded base64 strings.
</ChangeLog>
www/nginx-devel: update 1.25.4 -> 1.25.5 (+)
Fix building third-party naxsi module.
<Changelog>
*) Feature: virtual servers in the stream module.
*) Feature: the ngx_stream_pass_module.
*) Feature: the "deferred", "accept_filter", and "setfib" parameters of
the "listen" directive in the stream module.
*) Feature: cache line size detection for some architectures.
Thanks to Piotr Sikora.
*) Feature: support for Homebrew on Apple Silicon.
Thanks to Piotr Sikora.
*) Bugfix: Windows cross-compilation bugfixes and improvements.
Thanks to Piotr Sikora.
*) Bugfix: unexpected connection closure while using 0-RTT in QUIC.
Thanks to Vladimir Khomutov.
</Changelog>
*/*: update NGINX JavaScript: 0.8.2 -> 0.8.3 (+)
<ChangeLog>
nginx modules:
*) Bugfix: fixed Headers.set().
*) Bugfix: fixed js_set with Buffer values.
*) Bugfix: fixed clear() method of a shared dictionary when
a timeout is not specified.
*) Bugfix: fixed stub_status statistics when js_periodic is
enabled.
Core:
*) Bugfix: fixed building with libxml2 2.12 and later.
*) Bugfix: fixed Date constructor for overflows and with
NaN values.
*) Bugfix: fixed underflow in querystring.parse().
*) Bugfix: fixed potential buffer overread in
String.prototype.match().
*) Bugfix: fixed parsing of for-in loops.
*) Bugfix: fixed parsing of hexadecimal, octal, and binary
literals with no digits.
</ChangeLog>
www/nginx-devel: remove third-party opentracing module (+)
Similar functionality is available with OTEL module, also
devel/libopentracing port is EOLed today.
Bump PORTREVISION.
www/nginx-devel: third-party modules management (+)
Change GH location for the third-party video-thumbextractor module.
The size of the new distro is much bigger just because it contains
many tests.
PR: 277155
www/nginx-devel: third-party modules management (+)
o) remove third-party cookie_flag module, the functionality supported
natively by the proxy_cookie_flags directive;
o) update third-party ndk module to 0.3.3;
o) update third-party lua module to 0.10.26.rc2.
Updated version of the lua module can be built with pcre2.
Bump PORTREVISION.
