nginx

nginx-1.31.3 mainline version has been released, with fixes for buffer overflow vulnerability when using map with regex (CVE-2026-42533), memory disclosure vulnerability when using ngx_http_slice_module (CVE-2026-60005), and use-after-free vulnerability when using ngx_http_ssi_module (CVE-2026-56434).

See official CHANGES on nginx.org.

Below is a release summary generated by GitHub.

What's Changed

• Configure: set cache line size for loongarch64 by @shankerwangmiao in https://github.com/nginx/nginx/pull/1489
• HTTP/2: fix overlapping memcpy in CONTINUATION frames by @wufengwind in https://github.com/nginx/nginx/pull/1486
• Add missing bounds check in ngx_{http,stream}_compile_complex_value() by @wufengwind in https://github.com/nginx/nginx/pull/1484
• Revert "HTTP/2: fixed overlapping memcpy in CONTINUATION frames" by @ac000 in https://github.com/nginx/nginx/pull/1517
• GH: explicitly set permissions in workflows by @ac000 in https://github.com/nginx/nginx/pull/1451
• Charset: disabled charset_map with utf-8 in the first column by @pluknet in https://github.com/nginx/nginx/pull/1523
• Upstream: Upgrade header processing by @vinaykumar-1591 in https://github.com/nginx/nginx/pull/1476
• Fix setting the IPV6_DONTFRAG socket option by @arut in https://github.com/nginx/nginx/pull/1544
• Xslt: disable loading of external entities by default by @VadimZhestikov in https://github.com/nginx/nginx/pull/1549
• SSL: fixed memory leak in ngx_ssl_get_ech_outer_server_name(). by @devnexen in https://github.com/nginx/nginx/pull/1471
• Fixing HTTP/2 issues by @hongzhidao in https://github.com/nginx/nginx/pull/1441
• Perl fixes by @pluknet in https://github.com/nginx/nginx/pull/1556
• Configure: include crypt.h for crypt() feature tests by @bavshin-f5 in https://github.com/nginx/nginx/pull/1552
• HTTP/2: Reject requests with pseudo-headers after headers by @nitin9977 in https://github.com/nginx/nginx/pull/1541
• Stream and HTTP: rcvbuf and sndbuf directives for upstream sockets by @patrikwl in https://github.com/nginx/nginx/pull/1298
• Tunnel body improvements by @arut in https://github.com/nginx/nginx/pull/1560
• Nginx 1.31.3 security fixes by @arut in https://github.com/nginx/nginx/pull/1561
• nginx-1.31.3-RELEASE by @pluknet in https://github.com/nginx/nginx/pull/1562

New Contributors

• @shankerwangmiao made their first contribution in https://github.com/nginx/nginx/pull/1489
• @wufengwind made their first contribution in https://github.com/nginx/nginx/pull/1486
• @vinaykumar-1591 made their first contribution in https://github.com/nginx/nginx/pull/1476
• @patrikwl made their first contribution in https://github.com/nginx/nginx/pull/1298

Full Changelog: https://github.com/nginx/nginx/compare/release-1.31.2...release-1.31.3