Skip to content

NGINX

vrelease-1.31.3 scope: release Security

This release includes 3 security fixes for security teams reviewing exposed deployments.

Published 11d Reverse Proxies & Load Balancers
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 3 known CVEs

Topics

content-cache http http2 http3 https load-balancing
+9 more
mail-proxy-server nginx quic proxy security tcp-proxy-server tls udp-proxy-server web-server

Affected surfaces

rce_ssrf

ReleasePort's take

Moderate signal
editorial:auto 11d

Release 1.31.3 patches three critical CVEs in NGINX (CVE‑2026‑42533, CVE‑2026‑60005, CVE‑2026‑56434) and adds several stability improvements.

Why it matters: The update fixes high‑severity vulnerabilities—buffer overflow, memory disclosure, and use‑after‑free—affecting core HTTP handling; deploy before exploitation occurs.

Summary

AI summary

Updates Configure, GH, and Charset across a mixed release.

Changes in this release

Security Critical

Fixes buffer overflow vulnerability when using map with regex (CVE-2026-42533).

Fixes buffer overflow vulnerability when using map with regex (CVE-2026-42533).

Source: llm_adapter@2026-07-15

Confidence: high

 —
Security Critical

Fixes memory disclosure vulnerability in ngx_http_slice_module (CVE-2026-60005).

Fixes memory disclosure vulnerability in ngx_http_slice_module (CVE-2026-60005).

Source: llm_adapter@2026-07-15

Confidence: high

 —
Security Critical

Fixes use-after-free vulnerability in ngx_http_ssi_module (CVE-2026-56434).

Fixes use-after-free vulnerability in ngx_http_ssi_module (CVE-2026-56434).

Source: llm_adapter@2026-07-15

Confidence: high

 —
Feature Low

Adds rcvbuf and sndbuf directives for upstream sockets (stream and HTTP).

Adds rcvbuf and sndbuf directives for upstream sockets (stream and HTTP).

Source: llm_adapter@2026-07-15

Confidence: high

 —
Feature Low

Disables loading of external entities by default in XSLT processing.

Disables loading of external entities by default in XSLT processing.

Source: llm_adapter@2026-07-15

Confidence: high

 —
Feature Low

Configures cache line size for loongarch64 architecture.

Configures cache line size for loongarch64 architecture.

Source: llm_adapter@2026-07-15

Confidence: high

 —
Bugfix Medium

Adds missing bounds check in ngx_{http,stream}_compile_complex_value().

Adds missing bounds check in ngx_{http,stream}_compile_complex_value().

Source: llm_adapter@2026-07-15

Confidence: high

 —
Bugfix Medium

Fixes setting of IPV6_DONTFRAG socket option.

Fixes setting of IPV6_DONTFRAG socket option.

Source: llm_adapter@2026-07-15

Confidence: high

 —
Bugfix Medium

Fixes memory leak in ngx_ssl_get_ech_outer_server_name().

Fixes memory leak in ngx_ssl_get_ech_outer_server_name().

Source: llm_adapter@2026-07-15

Confidence: high

 —
Bugfix Medium

Fixes overlapping memcpy issue in HTTP/2 CONTINUATION frames.

Fixes overlapping memcpy issue in HTTP/2 CONTINUATION frames.

Source: llm_adapter@2026-07-15

Confidence: low

 —
Bugfix Low

Rejects HTTP/2 requests with pseudo-headers after headers.

Rejects HTTP/2 requests with pseudo-headers after headers.

Source: granite4.1:30b@2026-07-15-audit

Confidence: low

 —
Full changelog

nginx-1.31.3 mainline version has been released, with fixes for buffer overflow vulnerability when using map with regex (CVE-2026-42533), memory disclosure vulnerability when using ngx_http_slice_module (CVE-2026-60005), and use-after-free vulnerability when using ngx_http_ssi_module (CVE-2026-56434).

See official CHANGES on nginx.org.

Below is a release summary generated by GitHub.

What's Changed

  • Configure: set cache line size for loongarch64 by @shankerwangmiao in https://github.com/nginx/nginx/pull/1489
  • HTTP/2: fix overlapping memcpy in CONTINUATION frames by @wufengwind in https://github.com/nginx/nginx/pull/1486
  • Add missing bounds check in ngx_{http,stream}_compile_complex_value() by @wufengwind in https://github.com/nginx/nginx/pull/1484
  • Revert "HTTP/2: fixed overlapping memcpy in CONTINUATION frames" by @ac000 in https://github.com/nginx/nginx/pull/1517
  • GH: explicitly set permissions in workflows by @ac000 in https://github.com/nginx/nginx/pull/1451
  • Charset: disabled charset_map with utf-8 in the first column by @pluknet in https://github.com/nginx/nginx/pull/1523
  • Upstream: Upgrade header processing by @vinaykumar-1591 in https://github.com/nginx/nginx/pull/1476
  • Fix setting the IPV6_DONTFRAG socket option by @arut in https://github.com/nginx/nginx/pull/1544
  • Xslt: disable loading of external entities by default by @VadimZhestikov in https://github.com/nginx/nginx/pull/1549
  • SSL: fixed memory leak in ngx_ssl_get_ech_outer_server_name(). by @devnexen in https://github.com/nginx/nginx/pull/1471
  • Fixing HTTP/2 issues by @hongzhidao in https://github.com/nginx/nginx/pull/1441
  • Perl fixes by @pluknet in https://github.com/nginx/nginx/pull/1556
  • Configure: include crypt.h for crypt() feature tests by @bavshin-f5 in https://github.com/nginx/nginx/pull/1552
  • HTTP/2: Reject requests with pseudo-headers after headers by @nitin9977 in https://github.com/nginx/nginx/pull/1541
  • Stream and HTTP: rcvbuf and sndbuf directives for upstream sockets by @patrikwl in https://github.com/nginx/nginx/pull/1298
  • Tunnel body improvements by @arut in https://github.com/nginx/nginx/pull/1560
  • Nginx 1.31.3 security fixes by @arut in https://github.com/nginx/nginx/pull/1561
  • nginx-1.31.3-RELEASE by @pluknet in https://github.com/nginx/nginx/pull/1562

New Contributors

  • @shankerwangmiao made their first contribution in https://github.com/nginx/nginx/pull/1489
  • @wufengwind made their first contribution in https://github.com/nginx/nginx/pull/1486
  • @vinaykumar-1591 made their first contribution in https://github.com/nginx/nginx/pull/1476
  • @patrikwl made their first contribution in https://github.com/nginx/nginx/pull/1298

Full Changelog: https://github.com/nginx/nginx/compare/release-1.31.2...release-1.31.3

Security Fixes

  • CVE-2026-42533 — buffer overflow when using map with regex
  • CVE-2026-60005 — memory disclosure in ngx_http_slice_module
  • CVE-2026-56434 — use‑after‑free in ngx_http_ssi_module
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track NGINX

Get notified when new releases ship.

Sign up free

About NGINX

HTTP and reverse proxy server, mail proxy server, and generic TCP/UDP proxy server.

All releases →

Related context

Related CVEs

Beta — feedback welcome: [email protected]