nginx-1.30.1 stable and nginx-1.31.0 mainline versions have been released, with fixes for HTTP/2 request injection vulnerability in the ngx_http_proxy_module (CVE-2026-42926), buffer overflow vulnerability in the ngx_http_rewrite_module (CVE-2026-42945), buffer overread vulnerabilities in the ngx_http_scgi_module and ngx_http_uwsgi_module (CVE-2026-42946), buffer overread vulnerability in the ngx_http_charset_module (CVE-2026-42934), address spoofing vulnerability in HTTP/3 (CVE-2026-40460), and use-after-free vulnerability in OCSP requests to resolver (CVE-2026-40701). Additionally, nginx-1.31.0 mainline version features support for HTTP forward proxy.
Created attachment 270714 [details] Proposed patch I've inspected the diff between nginx-1.30.0.tar.gz and nginx-1.30.1.tar.gz (SHA256 shown above) and these looks Okay to me, however it won't hurt to have another pair of eyes to review the changes again.
(In reply to Xin LI from comment #1) The patch looks good to me. I used it to build the updated package in my poudriere environment and have already updated Nginx on all of my servers. For additional context and technical details about the issue: https://depthfirst.com/research/nginx-rift-achieving-nginx-rce-via-an-18-year-old-vulnerability https://github.com/DepthFirstDisclosures/Nginx-Rift
A commit in branch main references this bug: URL: https://cgit.FreeBSD.org/ports/commit/?id=78c6cd4184273b95f52f614fa42121048ba55df9 commit 78c6cd4184273b95f52f614fa42121048ba55df9 Author: Ryan Steinmetz <zi@FreeBSD.org> AuthorDate: 2026-05-14 14:23:09 +0000 Commit: Ryan Steinmetz <zi@FreeBSD.org> CommitDate: 2026-05-14 14:23:09 +0000 security/vuxml: Document www/nginx DoS/RCE PR: 295270 Security: 3414ac89-4f9f-11f1-a1c0-0050569f0b83 security/vuxml/vuln/2026.xml | 52 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 52 insertions(+)
A commit in branch main references this bug: URL: https://cgit.FreeBSD.org/ports/commit/?id=901ca63a3839d33d65e53a0417736e48af89e0d7 commit 901ca63a3839d33d65e53a0417736e48af89e0d7 Author: Ryan Steinmetz <zi@FreeBSD.org> AuthorDate: 2026-05-14 14:24:33 +0000 Commit: Ryan Steinmetz <zi@FreeBSD.org> CommitDate: 2026-05-14 14:24:33 +0000 www/nginx: Update to 1.30.1 PR: 295270 Approved by: security/blanket Security: 3414ac89-4f9f-11f1-a1c0-0050569f0b83 www/nginx/distinfo | 6 +++--- www/nginx/version.mk | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-)
Maybe this should be pushed on 2026Q2 as well?
The quarterly branch is a bigger jump (1.28.x -> 1.30.1). Going to give joneum@ a chance to weigh in on how he wants to handle that.
I'm currently working on the NGINX update for 2026Q2. Since other ports, such as www/nginx-acme, depend on the NGINX version, I'm testing it right now and will release it directly in the 2026Q2 branch. Thanks to everyone who has already worked on updating NGINX and nginx-acme in the standard ports tree and published the changes.
A commit in branch 2026Q2 references this bug: URL: https://cgit.FreeBSD.org/ports/commit/?id=127bfd793b1067b6214af0594d11674da244efe4 commit 127bfd793b1067b6214af0594d11674da244efe4 Author: Jochen Neumeister <joneum@FreeBSD.org> AuthorDate: 2026-05-17 09:50:34 +0000 Commit: Jochen Neumeister <joneum@FreeBSD.org> CommitDate: 2026-05-17 09:53:59 +0000 www/nginx: Update to 1.30.1 PR: 295270 Sponsored by: Netzkommune GmbH security/modsecurity3-nginx/Makefile | 4 +- security/modsecurity3-nginx/distinfo | 6 +- www/nginx-acme/Makefile | 2 +- www/nginx-acme/distinfo | 6 +- www/nginx/Makefile.extmod | 2 +- www/nginx/distinfo | 10 +- ...-patch-src-http-ngx_http_upstream_round_robin.c | 115 ++++++++++++++------- www/nginx/version.mk | 2 +- 8 files changed, 92 insertions(+), 55 deletions(-)