NGINX

vrelease-1.30.2 scope: release Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 12d Reverse Proxies & Load Balancers

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Topics

content-cache http http2 http3 https load-balancing

+9 more

mail-proxy-server nginx quic proxy security tcp-proxy-server tls udp-proxy-server web-server

Affected surfaces

rce_ssrf

ReleasePort's take

Light signal

editorial:auto 12d

ReleasePort Layer 1 release‑1.30.2 fixes a buffer overflow vulnerability in ngx_http_rewrite_module.

Why it matters: CVE‑2026‑9256 (severity not specified) affects ngx_http_rewrite_module; upgrade to release‑1.30.2 immediately if this module is used.

Summary

AI summary

Fixes buffer overflow vulnerability in ngx_http_rewrite_module (CVE-2026-9256).

Changes in this release

Type	Severity	Summary	CVE
Security	Medium	Fixes buffer overflow vulnerability in ngx_http_rewrite_module. Fixes buffer overflow vulnerability in ngx_http_rewrite_module. Source: llm_adapter@2026-05-22 Confidence: low	—

Full changelog

nginx-1.30.2 stable version has been released, with a fix for buffer overflow vulnerability in the ngx_http_rewrite_module (CVE-2026-9256).

See official CHANGES-1.30 on nginx.org.

Below is a release summary generated by GitHub.

What's Changed

nginx-1.30.2-RELEASE by @pluknet in https://github.com/nginx/nginx/pull/1397

Full Changelog: https://github.com/nginx/nginx/compare/release-1.30.1...release-1.30.2

Security Fixes

CVE-2026-9256 — buffer overflow vulnerability in ngx_http_rewrite_module

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track NGINX

Get notified when new releases ship.

About NGINX

HTTP and reverse proxy server, mail proxy server, and generic TCP/UDP proxy server.

All releases →