nginx: baixar versions anteriors

*) Change in internal API: now the JSON parser reports strings with
escape sequences as separate events, and the
ngx_json_unescape_string() function decodes a string into a separate
buffer.
*) Change: now the path specified in the "working_directory" directive
is relative to nginx prefix directory, but not to the current
directory.
*) Bugfix: worker processes exited on start or during reconfiguration if
an invalid directory was specified in the "working_directory"
directive.
*) Bugfix: worker processes might be terminated abnormally on a SIGBUS
signal when using HTTP/3 on platforms with strict alignment
requirements.
Thanks to Daewoo Choi.
*) Bugfix: "recv() failed (5: Input/output error)" alerts might appear
in logs when closing SSL connections if kernel TLS was used with
OpenSSL 3.2.0 or newer.
*) Bugfix: nginx could not be built on Solaris if the --with-control-api
option was used.

*) Security: a buffer overflow might occur in a worker process when using the "alias" directive if the request URI was changed by the "rewrite" directive and was then mapped to a file path (CVE-2026-15176).
*) Security: a buffer overflow might occur in a worker process while evaluating string expressions with variables, which affected the document root calculation and request logging in the http and stream modules (CVE-2026-93479). Thanks to Matt Suiche of Tolmo Inc.
*) Security: when using HTTP/3 a part of an unknown frame might be treated as the request body, which might result in bypassing the "client_max_body_size" limit or injecting data in the proxied request (CVE-2026-95101). Thanks to Hansol Lee of GOTROOT.
*) Security: when using TLS session ticket key rotation, one of the keys was left uninitialized, which might allow to forge a session (CVE-2026-97629). Thanks to PhiNode Labs.
*) Security: when using asynchronous file I/O (AIO), use-after-free might occur in certain configurations if the SSI page has "include virtual" commands (CVE-2026-97205). Thanks to cyberlancer.
*) Feature: the ngx_http_geoip_module and ngx_stream_geoip_module now support databases in the MaxMind DB (MMDB) format.
*) Feature: now backend SSL certificates can be verified by IP address. Thanks to Maxim Dounin.
*) Feature: now QUIC supports reconfiguration and binary upgrade when using the "quic_bpf" directive.
*) Change: the ngx_http_v2_module now uses the RFC 9218 prioritization scheme, and RFC 7540 priority signals are ignored.
*) Bugfix: a segmentation fault might occur in a worker process or "request count is zero" alerts might appear in logs if the "X-Accel-Redirect" header line was cached and the cached response was then served to a client. Thanks to Jiří Setnička and Maxim Dounin.
*) Bugfix: a segmentation fault might occur in a worker process if the ngx_http_dav_module was used to handle COPY and MOVE methods in a location with the "alias" directive. Thanks to Maxim Dounin.
*) Bugfix: QUIC connections might be closed with the "quic flood detected" message in logs if the "http3_stream_buffer_size" directive was set to a small value; the bug had appeared in 1.27.5.
*) Bugfix: closing an SSL connection without close_notify was treated as a clean shutdown, including the case when the connection was reset; now "SSL_read() failed" errors appear in logs in this case. Thanks to Maxim Dounin.
*) Bugfix: "[crit] SSL_write() failed" messages might appear in logs when an error occurred while reading from an SSL connection.

*) Security: a heap memory buffer overflow might occur in a worker process under certain configurations when using HTTP/3 with OpenSSL 3.5.0 and earlier (CVE-2026-90439). Thanks to Banny Liao.
*) Change: now the QUIC transport parameters extension received in an SSL connection is always ignored.
*) Bugfix: binary upgrade refused to work if the control API socket was specified and the new nginx executable was built with the ngx_http_perl_module.
*) Bugfix: an error while evaluating a predicate in a predicate location was ignored and the predicate was treated as false.
*) Bugfix: an error during a nested location lookup might be ignored if locations given by regular expressions or predicates were configured at the current level.
*) Bugfix: a segmentation fault might occur while reading configuration if the "geo" directive with the "ranges" parameter was used and the corresponding binary base file was corrupted.

Feature: control API.
Feature: predicate locations.
Feature: the ngx_http_json_module.
Feature: the "client_body_early_read" directive.
Bugfix: use-after-free might occur in a worker process if proxying with buffering was used and an error occurred while sending the response to an HTTP/2 client.
Bugfix: a worker process might not exit or "accept4() failed (9: Bad file descriptor)" alerts might appear in logs if the worker process ran out of file descriptors before graceful shutdown.
Bugfix: requests to FastCGI and uwsgi backends were malformed if a parameter name was too long.
Bugfixes in HTTP/3, ngx_http_slice_module, and ngx_http_memcached_module.

Feature: the "proxy_protocol" directive in the stream and mail modules now supports the PROXY protocol version 2.
Change: now HTTP/2 and gRPC requests to backends are always sent with the ":authority" pseudo-header, and HTTP/1.1 requests - with the "Host" header.
Bugfix: a segmentation fault might occur in a worker process if the "select" method was used.
Bugfix: incomplete gRPC responses with a non-zero "Content-Length" header line are now treated as malformed.
Bugfix: in binary compatibility with third-party modules using script codes; the bug had appeared in 1.31.3.
Bugfix: in the ngx_http_perl_module.
Thanks to David Carlier.
Bugfixes in HTTP/2, HTTP/3, ngx_http_image_filter_module, and ngx_http_grpc_module.

*) Security: heap buffer overflow might occur in a worker process when using the map directive with regex matching if the map variable was included in a string expression after a capture affected by this map; a similar issue might happen when using a non-cacheable variable in a string expression (CVE-2026-42533). Thanks to Mufeed VH of Winfunc Research and Maxim Dounin.
*) Security: uninitialized memory access might occur when using unnamed regex captures with the "slice" directive or background cache update, which could result in worker process memory disclosure or worker process termination (CVE-2026-60005).
*) Security: use-after-free might occur when processing a specially crafted proxied backend response with the ngx_http_ssi_filter_module (CVE-2026-56434). Thanks to P4P3R-HAK.
*) Change: the size of headers and trailers in HTTP/2 responses in the ngx_http_proxy_v2_module and ngx_http_grpc_module is now limited with "proxy_buffer_size" and "grpc_buffer_size" directives.
*) Change: loading of external entities is now disabled in the ngx_http_xslt_filter_module. Thanks to Maxim Dounin.
*) Feature: the "xml_external_entities" directive in the ngx_http_xslt_filter_module. Thanks to Maxim Dounin.
*) Feature: the "proxy_socket_sndbuf", "proxy_socket_rcvbuf", "fastcgi_socket_sndbuf", "fastcgi_socket_rcvbuf", "grpc_socket_sndbuf", "grpc_socket_rcvbuf", "scgi_socket_sndbuf", "scgi_socket_rcvbuf", "uwsgi_socket_sndbuf", "uwsgi_socket_rcvbuf", "tunnel_socket_sndbuf", and "tunnel_socket_rcvbuf" directives.
*) Feature: cache line size detection for loongarch64. Thanks to Miao Wang.
*) Bugfix: now nginx rejects HTTP/2 requests with out-of-order pseudo-headers.
*) Bugfix: in flow control in the ngx_http_v2_module.
*) Bugfix: "[error] upstream sent frame for unknown stream" and "[crit] cache file ... contains invalid header" messages might appear in logs when sending a cached HTTP/2 response in the ngx_http_proxy_v2_module if the "proxy_cache_revalidate" directive was used.
*) Bugfix: nginx might send the "Upgrade" header line in HTTP/2 and HTTP/3 responses.
*) Bugfix: in the ngx_http_perl_module. Thanks to Maxim Dounin.
*) Bugfix: IPv6 fragmentation might not be disabled when using QUIC on some operating systems.
*) Bugfix: in the ngx_http_auth_basic_module on Solaris.
*) Bugfixes and improvements in the ngx_http_tunnel_module.

*) Security: use-after-free might occur when using HTTP/3 and processing a specially crafted QUIC session, allowing an attacker to cause worker process memory corruption or segmentation fault in a worker process (CVE-2026-42530). Thanks to Trung Nguyen of CyStack.
*) Security: a heap memory buffer overflow might occur in a worker process when using a configuration with "ignore_invalid_headers off;" and "large_client_header_buffers" with large configured values when proxying a specially crafted request to HTTP/2 or gRPC backend, allowing an attacker to cause worker process memory corruption or segmentation fault in a worker process (CVE-2026-42055). Thanks to Mufeed VH of Winfunc Research.
*) Security: a heap memory buffer overread might occur in a worker process while handling a specially sent response with decoding from UTF-8 via the "charset_map" directive, allowing an attacker to cause a limited disclosure of worker proccess memory or segmentation fault in a worker process (CVE-2026-48142). Thanks to Han Yan of Xiaomi and p4p3r of CYBERONE.
*) Change: now the $request_id variable uses SipHash-2-4.
*) Feature: the $ssl_sigalgs variable.
*) Bugfix: a variable defined by the "split_clients" directive might be empty if all percentages were specified explicitly and summed up to 100%.
*) Bugfix: constant time "secure_link" hash comparison. Thanks to kodareef5.

* Security: a heap memory buffer overflow might occur in a worker process when using a configuration with overlapping captures in ngx_http_rewrite_module, potentially resulting in arbitrary code execution (CVE-2026-9256). Thanks to Mufeed VH of Winfunc Research.

*) Security: when using the "proxy_set_body" directive, an attacker might inject data in the proxied request to an HTTP/2 backend (CVE-2026-42926). Thanks to Mufeed VH of Winfunc Research.
*) Security: a heap memory buffer overflow might occur in a worker process while handling a specially crafted request by ngx_http_rewrite_module, potentially resulting in arbitrary code execution (CVE-2026-42945). Thanks to Leo Lin.
*) Security: a heap memory buffer overread might occur in a worker process while handling a specially crafted response by ngx_http_scgi_module or ngx_http_uwsgi_module, allowing an attacker to cause a disclosure of worker process memory or segmentation fault in a worker process (CVE-2026-42946). Thanks to Leo Lin.
*) Security: a heap memory buffer overread might occur in a worker process while handling a specially sent response with decoding from UTF-8 via the "charset_map" directive, allowing an attacker to cause a limited disclosure of worker proccess memory or segmentation fault in a worker process (CVE-2026-42934). Thanks to David Carlier.
*) Security: when using HTTP/3, processing of connection migration might cause new QUIC streams to receive a new client address before validation, allowing an attacker to cause address spoofing (CVE-2026-40460). Thanks to Rodrigo Laneth.
*) Security: use-after-free might occur during DNS server response processing if the "ssl_ocsp" directive was used, allowing an attacker to cause worker process memory corruption or segmentation fault in a worker process (CVE-2026-40701). Thanks to Leo Lin.
*) Change: now nginx rejects HTTP/2 and HTTP/3 requests with the "Connection", "Proxy-Connection", "Keep-Alive", "Transfer-Encoding", "Upgrade" header lines, and "TE" with any value other than "trailers".
*) Change: the ngx_http_dav_module now rejects a COPY or MOVE requests when the source and destination resources are the same or have a parent-child collection relationship.
*) Change: the logging level of the "invalid alert" and "record layer failure" SSL errors, and of the "SSL alert number N" for any alert numbers has been lowered from "crit" to "info".
*) Change: now the "sticky" module can be disabled with the --without-http_upstream_sticky_module configure option; the --without-http_upstream_sticky configure option is deprecated.
*) Feature: the ngx_http_tunnel_module; support for authenticating to proxies in the "auth_basic", "satisfy", and "auth_delay" directives.
*) Feature: the "least_time" directive inside the "upstream" block.
*) Feature: the "proxy_ssl_alpn" directive in the stream module.
*) Bugfix: connections with HTTP/2 backends might not be cached when using the "proxy_set_body" or "proxy_pass_request_body" directives.
*) Bugfix: proxied HTTP/0.9, SCGI, or uWSGI responses might be transferred incorrectly if the first line was not fully read.

Feature: the "max_headers" directive. Thanks to Maxim Dounin.
Feature: OpenSSL 4.0 compatibility.
Feature: now the "include" directive inside the "geo" block supports wildcards.
Bugfix: in processing of HTTP 103 (Early Hints) responses from a proxied backend.
Bugfix: the $request_port and $is_request_port variables were not available in subrequests.

*) Security: a buffer overflow might occur while handling a COPY or MOVE request in a location with "alias", allowing an attacker to modify the source or destination path outside of the document root (CVE-2026-27654).
Thanks to Calif.io in collaboration with Claude and Anthropic Research.

*) Security: processing of a specially crafted mp4 file by the ngx_http_mp4_module on 32-bit platforms might cause a worker process crash, or might have potential other impact (CVE-2026-27784).
Thanks to Prabhav Srinath (sprabhav7).

*) Security: processing of a specially crafted mp4 file by the ngx_http_mp4_module might cause a worker process crash, or might have potential other impact (CVE-2026-32647).
Thanks to Xint Code and Pavel Kohout (Aisle Research).

*) Security: a segmentation fault might occur in a worker process if the CRAM-MD5 or APOP authentication methods were used and authentication retry was enabled (CVE-2026-27651).
Thanks to Arkadi Vainbrand.

*) Security: an attacker might use PTR DNS records to inject data in auth_http requests, as well as in the XCLIENT command in the backend SMTP connection (CVE-2026-28753).
Thanks to Asim Viladi Oglu Manizada, Colin Warren, Xiao Liu (Yunnan University), Yuan Tan (UC Riverside), and Bird Liu (Lanzhou University).

*) Security: SSL handshake might succeed despite OCSP rejecting a client certificate in the stream module (CVE-2026-28755).
Thanks to Mufeed VH of Winfunc Research.

*) Feature: the "multipath" parameter of the "listen" directive.

*) Feature: the "local" parameter of the "keepalive" directive in the "upstream" block.

*) Change: now the "keepalive" directive in the "upstream" block is enabled by default.

*) Change: now ngx_http_proxy_module supports keepalive by default; the default value for "proxy_http_version" is "1.1"; the "Connection" proxy header is not sent by default anymore.

*) Bugfix: an invalid HTTP/2 request might be sent after switching to the next upstream if buffered body was used in the ngx_http_grpc_module.

Feature: session affinity support; the "sticky" directive in the "upstream" block of the "http" module; the "server" directive supports the "route" and "drain" parameters.

Change: now nginx limits the size and rate of QUIC stateless reset packets.

Bugfix: receiving a QUIC packet by a wrong worker process could cause the connection to terminate.

Bugfix: "[crit] cache file ... contains invalid header" messages might appear in logs when sending a cached HTTP/2 response.

Bugfix: proxying to scgi backends might not work when using chunked transfer encoding and the "scgi_request_buffering" directive. Thanks to Mufeed VH.

Bugfix: in the ngx_http_mp4_module. Thanks to Andrew Lacambra.

Bugfix: nginx treated a comma as separator in the "Cookie" request header line when evaluating "$cookie_..." variables.

Bugfix: in IMAP command literal argument parsing.

- Security: an attacker might inject plain text data in the response from an SSL backend (CVE-2026-1642).
- Bugfix: use-after-free might occur after switching to the next gRPC or HTTP/2 backend.
- Bugfix: an invalid HTTP/2 request might be sent after switching to the next upstream.
- Bugfix: a response with multiple ranges might be larger than the source response.
- Bugfix: fixed setting HTTP_HOST when proxying to FastCGI, SCGI, and uwsgi backends.
- Bugfix: fixed warning when compiling with MSVC 2022 x86.
- Change: the logging level of the "ech_required" SSL error has been lowered from "crit" to "info".