LoginSign Up
← Back to all sparks
N

NGINX

INFRA · APIS
Velocity5.0

High-performance web server, reverse proxy and load balancer

nginx.org ↗

nginx patched HTTP/3 twice in a month and is trimming old platform code on mainline.

web-serverreverse-proxyhttp3securityopen-source
◆Current state
nginx runs a 1.31 mainline and a 1.30 stable line. After 1.31.5 added a native control API, a JSON module and predicate locations in September, the following releases were mostly security: 1.31.6 and 1.30.5 fixed an HTTP/3 buffer overflow (CVE-2026-90439), then 1.31.7 and 1.30.6 fixed five more CVEs including HTTP/3 request body injection. 1.31.8 on October 21 removed the Win32 iocp event module and fixed further HTTP/3 issues.
◆Where it's heading
HTTP/3 has needed fixes in each of the last three mainline releases, two of them CVEs. Mainline is adding features and removing legacy code at the same time, while stable gets the CVE backports.
◆Prediction
More HTTP/3 fixes on both lines are likely; on mainline, follow-up work on the control API and JSON module is the next feature thread to watch.

◆Recent moves

  1. 23d ago

    nginx 1.31.8 removes the Win32 iocp module, fixes HTTP/3

    nginx 1.31.8 mainline removes the Win32 iocp event module and fixes undefined behaviour in HTTP/3 with empty encoder field values, plus smaller fixes.

    View source ↗
  2. 1mo ago

    nginx 1.31.7 fixes five CVEs on mainline

    The mainline gets the same five CVE fixes as 1.30.6, plus WebDAV COPY and MOVE destination validation with alias.

    View source ↗
  3. 1mo ago

    nginx 1.30.6 fixes five CVEs including HTTP/3 injection

    Fixes five CVEs on the stable line, including buffer overflows with alias plus rewrite, HTTP/3 request body injection and TLS session ticket forgery.

    View source ↗
  4. 1mo ago

    nginx 1.30.5 fixes an HTTP/3 buffer overflow

    The stable-line backport of the HTTP/3 buffer overflow fix, released minutes after 1.31.6. Anyone running ngx_http_v3_module on 1.30 needed it.

    View source ↗
  5. 1mo ago

    nginx 1.31.6 fixes HTTP/3 overflow and control API bugs

    Two weeks after the control API arrived, mainline fixes an HTTP/3 buffer overflow and the first bugs in the new features: predicate location variable errors and control API socket inheritance on binary upgrade.

    View source ↗
  6. 2mo ago

    release-1.31.5

    ⚡ SPARK

    NGINX 1.31.5 lands a native control API, a JSON parser module, and predicate-based location matching — three capabilities that were previously commercial-only or required external modules. The control API enables runtime reconfiguration without a reload, a gap that has historically pushed operators toward NGINX Plus. This release marks a structural shift in what the open-source distribution offers.

    View source ↗