release-1.30.1
Security 6
- Fixed HTTP/2 request injection vulnerability in the ngx_http_proxy_module
- Fixed buffer overflow vulnerability in the ngx_http_rewrite_module
- Fixed buffer overread vulnerabilities in the ngx_http_scgi_module and ngx_http_uwsgi_module
- Fixed buffer overread vulnerability in the ngx_http_charset_module
- Fixed address spoofing vulnerability in HTTP/3
- Fixed use-after-free vulnerability in OCSP requests to resolver
nginx-1.30.1 stable version has been released with fixes for HTTP/2 request injection vulnerability in the ngx_http_proxy_module (CVE-2026-42926), buffer overflow vulnerability in the ngx_http_rewrite_module (CVE-2026-42945), buffer overread vulnerabilities in the ngx_http_scgi_module and ngx_http_uwsgi_module (CVE-2026-42946), buffer overread vulnerability in the ngx_http_charset_module (CVE-2026-42934), address spoofing vulnerability in HTTP/3 (CVE-2026-40460), and use-after-free vulnerability in OCSP requests to resolver (CVE-2026-40701).
See official CHANGES-1.30 on nginx.org.
Below is a release summary generated by GitHub.
What's Changed
- nginx-1.30.1-RELEASE by @pluknet in https://github.com/nginx/nginx/pull/1351
Full Changelog: https://github.com/nginx/nginx/compare/release-1.30.0...release-1.30.1