Lataa nginx 1.31.7

*) Security: a buffer overflow might occur in a worker process when using the "alias" directive if the request URI was changed by the "rewrite" directive and was then mapped to a file path (CVE-2026-15176).
*) Security: a buffer overflow might occur in a worker process while evaluating string expressions with variables, which affected the document root calculation and request logging in the http and stream modules (CVE-2026-93479). Thanks to Matt Suiche of Tolmo Inc.
*) Security: when using HTTP/3 a part of an unknown frame might be treated as the request body, which might result in bypassing the "client_max_body_size" limit or injecting data in the proxied request (CVE-2026-95101). Thanks to Hansol Lee of GOTROOT.
*) Security: when using TLS session ticket key rotation, one of the keys was left uninitialized, which might allow to forge a session (CVE-2026-97629). Thanks to PhiNode Labs.
*) Security: when using asynchronous file I/O (AIO), use-after-free might occur in certain configurations if the SSI page has "include virtual" commands (CVE-2026-97205). Thanks to cyberlancer.
*) Feature: the ngx_http_geoip_module and ngx_stream_geoip_module now support databases in the MaxMind DB (MMDB) format.
*) Feature: now backend SSL certificates can be verified by IP address. Thanks to Maxim Dounin.
*) Feature: now QUIC supports reconfiguration and binary upgrade when using the "quic_bpf" directive.
*) Change: the ngx_http_v2_module now uses the RFC 9218 prioritization scheme, and RFC 7540 priority signals are ignored.
*) Bugfix: a segmentation fault might occur in a worker process or "request count is zero" alerts might appear in logs if the "X-Accel-Redirect" header line was cached and the cached response was then served to a client. Thanks to Jiří Setnička and Maxim Dounin.
*) Bugfix: a segmentation fault might occur in a worker process if the ngx_http_dav_module was used to handle COPY and MOVE methods in a location with the "alias" directive. Thanks to Maxim Dounin.
*) Bugfix: QUIC connections might be closed with the "quic flood detected" message in logs if the "http3_stream_buffer_size" directive was set to a small value; the bug had appeared in 1.27.5.
*) Bugfix: closing an SSL connection without close_notify was treated as a clean shutdown, including the case when the connection was reset; now "SSL_read() failed" errors appear in logs in this case. Thanks to Maxim Dounin.
*) Bugfix: "[crit] SSL_write() failed" messages might appear in logs when an error occurred while reading from an SSL connection.