Skip to content

NGINX

vrelease-1.30.4 scope: release Security

This release includes 3 security fixes for security teams reviewing exposed deployments.

Published 11d Reverse Proxies & Load Balancers
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 3 known CVEs

Topics

content-cache http http2 http3 https load-balancing
+9 more
mail-proxy-server nginx quic proxy security tcp-proxy-server tls udp-proxy-server web-server

Affected surfaces

rce_ssrf

ReleasePort's take

Moderate signal
editorial:auto 11d

ReleasePort Layer 1 release‑1.30.4 patches three critical security flaws: a buffer overflow in map with regex handling, memory disclosure in ngx_http_slice_module, and a use‑after‑free in ngx_http_ssi_module.

Why it matters: CVEs CVE-2026-42533 (buffer overflow), CVE-2026-60005 (memory disclosure), and CVE-2026-56434 (use‑after‑free) all have severity 95; upgrade to release‑1.30.4 immediately.

Summary

AI summary

Fixes buffer overflow, memory disclosure, and use-after-free vulnerabilities.

Changes in this release

Security Critical

Fixes buffer overflow vulnerability in map with regex (CVE-2026-42533).

Fixes buffer overflow vulnerability in map with regex (CVE-2026-42533).

Source: llm_adapter@2026-07-15

Confidence: high

 —
Security Critical

Fixes memory disclosure vulnerability in ngx_http_slice_module (CVE-2026-60005).

Fixes memory disclosure vulnerability in ngx_http_slice_module (CVE-2026-60005).

Source: llm_adapter@2026-07-15

Confidence: high

 —
Security Critical

Fixes use-after-free vulnerability in ngx_http_ssi_module (CVE-2026-56434).

Fixes use-after-free vulnerability in ngx_http_ssi_module (CVE-2026-56434).

Source: llm_adapter@2026-07-15

Confidence: high

 —
Full changelog

nginx-1.30.4 stable version has been released, with fixes for buffer overflow vulnerability when using map with regex (CVE-2026-42533), memory disclosure vulnerability when using ngx_http_slice_module (CVE-2026-60005), and use-after-free vulnerability when using ngx_http_ssi_module (CVE-2026-56434).

See official CHANGES-1.30 on nginx.org.

Below is a release summary generated by GitHub.

What's Changed

  • Nginx 1.30.4 by @arut in https://github.com/nginx/nginx/pull/1563

Full Changelog: https://github.com/nginx/nginx/compare/release-1.30.3...release-1.30.4

Security Fixes

  • CVE-2026-42533 — buffer overflow when using map with regex
  • CVE-2026-60005 — memory disclosure in ngx_http_slice_module
  • CVE-2026-56434 — use-after-free in ngx_http_ssi_module
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track NGINX

Get notified when new releases ship.

Sign up free

About NGINX

HTTP and reverse proxy server, mail proxy server, and generic TCP/UDP proxy server.

All releases →

Related context

Related CVEs

Beta — feedback welcome: [email protected]