release-1.31.3
📦 nginxView on GitHub →
✨ 10 features🐛 7 fixes🔧 5 symbols
Summary
Nginx mainline version 1.31.3 has been released, addressing several security vulnerabilities including buffer overflow, memory disclosure, and use-after-free issues. This release also includes various improvements and fixes for HTTP/2, SSL, and other modules.
✨ New Features
- Configure: set cache line size for loongarch64.
- Add missing bounds check in ngx_{http,stream}_compile_complex_value().
- Charset: disabled charset_map with utf-8 in the first column.
- Upstream: Upgrade header processing.
- Fix setting the IPV6_DONTFRAG socket option.
- Xslt: disable loading of external entities by default.
- Configure: include crypt.h for crypt() feature tests.
- HTTP/2: Reject requests with pseudo-headers after headers.
- Stream and HTTP: rcvbuf and sndbuf directives for upstream sockets.
- Tunnel body improvements.
🐛 Bug Fixes
- Fixes buffer overflow vulnerability when using map with regex (CVE-2026-42533).
- Fixes memory disclosure vulnerability when using ngx_http_slice_module (CVE-2026-60005).
- Fixes use-after-free vulnerability when using ngx_http_ssi_module (CVE-2026-56434).
- HTTP/2: fix overlapping memcpy in CONTINUATION frames.
- Revert "HTTP/2: fixed overlapping memcpy in CONTINUATION frames".
- SSL: fixed memory leak in ngx_ssl_get_ech_outer_server_name().
- Fixing HTTP/2 issues.