LoginSign Up
← Back to all sparks
N

NGINX

INFRA · APIS
Velocity5.0

High-performance web server, reverse proxy and load balancer

nginx.org ↗

Mainline and stable now move in lockstep, and almost every move is a CVE.

web-servercve-responsehttp3dual-branchproxying
◆Current state
NGINX is running 1.31.x mainline and 1.30.x stable in parallel, cutting matched pairs of releases minutes apart whenever a security fix lands. Every release in the window is security-driven: buffer overflows in map-with-regex and the rewrite module, memory disclosure in the slice module, use-after-free in SSI and HTTP/3, buffer overreads in charset, SCGI and uWSGI. Feature work is confined to what rides along — a SipHash-based request ID, an $ssl_sigalgs variable.
◆Where it's heading
The 1.30.0 stable branch pulled in a substantial feature set from 1.29.x — Early Hints, HTTP/2 to backend, Encrypted ClientHello, sticky upstream sessions, Multipath TCP, HTTP/1.1 keep-alive as the proxy default — and 1.31.0 added HTTP forward proxy and least_time load balancing. Since those, the project has been consolidating: hardening the newer protocol modules, particularly HTTP/2 and HTTP/3, where most of the recent CVEs cluster.
◆Prediction
Expect the paired mainline/stable security releases to continue at this cadence, with the vulnerability reports staying concentrated in HTTP/2, HTTP/3 and the proxying modules that 1.30 broadened.

◆Recent moves

  1. 17d ago

    Three CVEs: map regex overflow, slice disclosure, SSI use-after-free

    A buffer overflow reachable through map with regex, memory disclosure via the slice module, and a use-after-free in SSI — three separately configured modules, three separate memory-safety failures. Also carries a bounds check in complex value compilation and a reworked HTTP/2 CONTINUATION frame fix.

    View source ↗
  2. 17d ago

    Stable branch takes the same three CVE fixes

    The stable counterpart, cut three minutes before its mainline twin. The synchronized pairing is now the project's standard response to a disclosure and is the reason stable users no longer wait for a merge window.

    View source ↗
  3. 1mo ago

    Buffer overflow in HTTP/2 and gRPC proxy modules

    Fixes an overflow in the HTTP/2 and gRPC proxy modules plus a charset overread. The HTTP/2-to-backend proxying that 1.30 promoted to stable is exactly where the vulnerability landed.

    View source ↗
  4. 1mo ago

    HTTP/3 use-after-free fixed; $ssl_sigalgs variable added

    Three CVEs including a use-after-free in the HTTP/3 module, alongside the window's only real feature work: an $ssl_sigalgs variable and SipHash to speed up request ID generation. Feature additions now arrive as passengers on security releases.

    View source ↗
  5. 2mo ago

    Rewrite module overflow with overlapping captures

    A buffer overflow in the rewrite module triggered by overlapping captures, plus hardened escape-flag control and HTTP/2 response header length limits. The rewrite module has now produced overflow CVEs in three consecutive releases.

    View source ↗
  6. 2mo ago

    Stable backport of the rewrite module overflow fix

    A single-commit stable release carrying the rewrite module fix. Nothing here beyond the backport itself.

    View source ↗