LoginSign Up
← Back to all sparks
N

NGINX

INFRA · APIS
Velocity6.3

High-performance web server, reverse proxy and load balancer

nginx.org ↗

NGINX 1.31.5 ships a native control API, JSON module, and predicate locations — NGINX Plus features in open source.

web-serverreverse-proxyopen-sourceapihttp
◆Current state
NGINX's mainline branch is moving quickly on native capability expansion. The 1.31.5 release adds three features that were previously exclusive to NGINX Plus or third-party modules: a runtime control API, a built-in JSON parser module, and predicate-based location matching. This follows 1.31.4 adding JSON serialization and data model libraries, and 1.31.3 patching three CVEs including memory corruption in the map module and a use-after-free in SSI.
◆Where it's heading
NGINX is actively pulling capabilities from the commercial F5 NGINX stack into the open-source mainline. The control API in particular has been a core NGINX Plus differentiator — it enables runtime reconfiguration without a reload, which is the key operational advantage of the Plus tier. Narrowing that gap signals a shift in F5's NGINX strategy toward openness, likely driven by competitive pressure from Envoy, Traefik, and Caddy.
◆Prediction
The control API surface will expand across subsequent mainline releases — the 1.31.5 implementation likely covers a narrow initial subset. Rate limiting and upstream management via API are the natural next additions, along with further JSON module maturation.

◆Recent moves

  1. 13d ago

    release-1.31.5

    ⚡ SPARK

    NGINX 1.31.5 lands a native control API, a JSON parser module, and predicate-based location matching — three capabilities that were previously commercial-only or required external modules. The control API enables runtime reconfiguration without a reload, a gap that has historically pushed operators toward NGINX Plus. This release marks a structural shift in what the open-source distribution offers.

    View source ↗
  2. 27d ago

    release-1.31.4

    NGINX 1.31.4 added a core JSON data model and serialization library, stream PROXY protocol v2 upstream write support, and a cluster of correctness fixes. The JSON/data libraries are clearly the groundwork for the JSON module shipped in 1.31.5 — this is the foundation layer. Stream PROXY protocol v2 write support extends NGINX's proxy fidelity for TCP/UDP streams.

    View source ↗
  3. 2mo ago

    release-1.31.3

    NGINX 1.31.3 patched three CVEs: a buffer overflow when using map with regex (CVE-2026-42533), a memory disclosure in the slice module (CVE-2026-60005), and a use-after-free in the SSI module (CVE-2026-56434). Memory corruption CVEs in widely-deployed infrastructure get patched fast for good reason — these represent real exploit surface on production servers.

    View source ↗
  4. 2mo ago

    release-1.30.4

    The 1.30.4 stable release backports the same three CVE fixes from 1.31.3 to the stable branch, with no other changes. Standard security backport work for users who stay on stable rather than mainline.

    View source ↗
  5. 3mo ago

    release-1.30.3

    NGINX 1.30.3 patched two CVEs in the stable branch: a buffer overflow in the HTTP/2 proxy and gRPC modules (CVE-2026-42055) and a buffer overread in the charset module (CVE-2026-48142). Security-focused stable release with no new functionality.

    View source ↗
  6. 3mo ago

    release-1.31.2

    NGINX 1.31.2 combined security patches (HTTP/3 use-after-free, HTTP/2 proxy buffer overflow, charset buffer overread) with two capability additions: SipHash for $request_id generation and a new $ssl_sigalgs variable. The SipHash change improves $request_id distribution and performance; the ssl_sigalgs variable adds useful TLS introspection for logging and routing decisions.

    View source ↗