Esta es una versión anterior. La versión actual es 1.31.8. nginx 1.31.8 · Fecha de publicación:
1.31.7 forma parte de la rama 1.31, que sigue teniendo soporte. endoflife.date
Archivos de instalación 1.31.7
| Arquitectura | Tipo | Ámbito | Tamaño del archivo | Descargar | SHA256 |
|---|---|---|---|---|---|
| 64 bits | ZIP → Portable | — | 2,8 MB | nginx.org | VirusTotal |
El enlace y el SHA256 proceden del manifiesto comunitario del Administrador de paquetes de Windows. Conviene comparar el hash del archivo descargado antes de ejecutarlo.
Notas de la versión
*) Security: a buffer overflow might occur in a worker process when using the "alias" directive if the request URI was changed by the "rewrite" directive and was then mapped to a file path (CVE-2026-15176).
*) Security: a buffer overflow might occur in a worker process while evaluating string expressions with variables, which affected the document root calculation and request logging in the http and stream modules (CVE-2026-93479). Thanks to Matt Suiche of Tolmo Inc.
*) Security: when using HTTP/3 a part of an unknown frame might be treated as the request body, which might result in bypassing the "client_max_body_size" limit or injecting data in the proxied request (CVE-2026-95101). Thanks to Hansol Lee of GOTROOT.
*) Security: when using TLS session ticket key rotation, one of the keys was left uninitialized, which might allow to forge a session (CVE-2026-97629). Thanks to PhiNode Labs.
*) Security: when using asynchronous file I/O (AIO), use-after-free might occur in certain configurations if the SSI page has "include virtual" commands (CVE-2026-97205). Thanks to cyberlancer.
*) Feature: the ngx_http_geoip_module and ngx_stream_geoip_module now support databases in the MaxMind DB (MMDB) format.
*) Feature: now backend SSL certificates can be verified by IP address. Thanks to Maxim Dounin.
*) Feature: now QUIC supports reconfiguration and binary upgrade when using the "quic_bpf" directive.
*) Change: the ngx_http_v2_module now uses the RFC 9218 prioritization scheme, and RFC 7540 priority signals are ignored.
*) Bugfix: a segmentation fault might occur in a worker process or "request count is zero" alerts might appear in logs if the "X-Accel-Redirect" header line was cached and the cached response was then served to a client. Thanks to Jiří Setnička and Maxim Dounin.
*) Bugfix: a segmentation fault might occur in a worker process if the ngx_http_dav_module was used to handle COPY and MOVE methods in a location with the "alias" directive. Thanks to Maxim Dounin.
*) Bugfix: QUIC connections might be closed with the "quic flood detected" message in logs if the "http3_stream_buffer_size" directive was set to a small value; the bug had appeared in 1.27.5.
*) Bugfix: closing an SSL connection without close_notify was treated as a clean shutdown, including the case when the connection was reset; now "SSL_read() failed" errors appear in logs in this case. Thanks to Maxim Dounin.
*) Bugfix: "[crit] SSL_write() failed" messages might appear in logs when an error occurred while reading from an SSL connection.
