release-1.31.1
Changed 2
- Limit Content-Type and Location response header length in HTTP/2
- Harden escape flags control in rewrite module
Fixed 3
- Avoid adding or comparing to null pointer in mp4 module
- Fix mail error path handling
- Fix buffer overflow with overlapping captures in rewrite module
Security 1
- Fix buffer overflow vulnerability in the ngx_http_rewrite_module (CVE-2026-9256)
nginx-1.31.1 mainline version has been released, with a fix for buffer overflow vulnerability in the ngx_http_rewrite_module (CVE-2026-9256).
See official CHANGES on nginx.org.
Below is a release summary generated by GitHub.
What's Changed
- Fix the set-creation-date.yaml workflow by @ac000 in https://github.com/nginx/nginx/pull/1353
- Mp4: avoid adding or comparing to null pointer by @arut in https://github.com/nginx/nginx/pull/1360
- HTTP/2: limit Content-Type and Location response header length by @arut in https://github.com/nginx/nginx/pull/1359
- Mail error path fixes by @arut in https://github.com/nginx/nginx/pull/1358
- Rewrite: harden escape flags control by @arut in https://github.com/nginx/nginx/pull/1381
- Rewrite: fix buffer overflow with overlapping captures by @arut in https://github.com/nginx/nginx/pull/1395
- nginx-1.31.1-RELEASE by @pluknet in https://github.com/nginx/nginx/pull/1396
Full Changelog: https://github.com/nginx/nginx/compare/release-1.31.0...release-1.31.1