similar to: NGINX has moved to Github!

Привет от команды NGINX! Мы рады сообщить, что официальный репозиторий разработки NGINX Open Source был перенесен с Mercurial на GitHub [1][2][3], где с сегодняшнего дня мы начинаем принимать патчи в форме Pull Request. Отчеты об ошибках, запросы на новую функциональность и улучшения теперь принимаются в разделе «Issues» на GitHub. Форумы сообщества интегрированы в раздел GitHub “Discussions”,

Изменения в nginx 1.25.5 16.04.2024 *) Добавление: виртуальные сервера в модуле stream. *) Добавление: модуль ngx_stream_pass_module. *) Добавление: параметры deferred, accept_filter и setfib директивы listen в модуле stream. *) Добавление: определение размера строки кеша процессора для некоторых архитектур. Спасибо

Changes with nginx 1.25.5 16 Apr 2024 *) Feature: virtual servers in the stream module. *) Feature: the ngx_stream_pass_module. *) Feature: the "deferred", "accept_filter", and "setfib" parameters of the "listen" directive in the stream module. *) Feature: cache line size detection for some

Changes with nginx 1.2.7 12 Feb 2013 *) Change: now if the "include" directive with mask is used on Unix systems, included files are sorted in alphabetical order. *) Change: the "add_header" directive adds headers to 201 responses. *) Feature: the "geo" directive now supports IPv6 addresses in CIDR

Changes with nginx 1.0.1 03 May 2011 *) Change: now the "split_clients" directive uses MurmurHash2 algorithm because of better distribution. Thanks to Oleg Mamontov. *) Change: now long strings starting with zero are not considered as false values. Thanks to Maxim Dounin. *) Change: now nginx uses a

Hello! Greg MacManus, of iSIGHT Partners Labs, found a security problem in several recent versions of nginx. A stack-based buffer overflow might occur in a worker process while handling a specially crafted request, potentially resulting in arbitrary code execution (CVE-2013-2028). The problem affects nginx 1.3.9 - 1.4.0. The problem is fixed in nginx 1.5.0, 1.4.1. Patch for the problem can be

Changes with nginx 0.7.66 07 Jun 2010 *) Security: now nginx/Windows ignores default file stream name. Thanks to Jose Antonio Vazquez Gonzalez. *) Change: now the charset filter runs before the SSI filter. *) Change: now no message is written in an error log if a variable is not found by $r->variable() method. *) Change:

Changes with nginx 0.8.41 15 Jun 2010 *) Security: nginx/Windows worker might be terminated abnormally if a requested file name has invalid UTF-8 encoding. *) Change: now nginx allows to use spaces in a request line. *) Bugfix: the "proxy_redirect" directive changed incorrectly a backend "Refresh" response

Changes with nginx 1.3.10 25 Dec 2012 *) Change: domain names specified in configuration file are now resolved to IPv6 addresses as well as IPv4 ones. *) Change: now if the "include" directive with mask is used on Unix systems, included files are sorted in alphabetical order. *) Change: the "add_header"

Изменения в nginx 1.23.4 28.03.2023 *) Изменение: теперь протокол TLSv1.3 разрешён по умолчанию. *) Изменение: теперь nginx выдаёт предупреждение при переопределении параметров listen-сокета, задающих используемые протоколы. *) Изменение: теперь, если клиент использует pipelining, nginx закрывает соединения с ожиданием

Hello! Four security issues were identified in nginx HTTP/3 implementation, which might allow an attacker that uses a specially crafted QUIC session to cause a worker process crash (CVE-2024-31079, CVE-2024-32760, CVE-2024-35200), worker process memory disclosure on systems with MTU larger than 4096 bytes (CVE-2024-34161), or might have potential other impact (CVE-2024-31079, CVE-2024-32760).

Hello! В реализации HTTP/3 в nginx были обнаружены четыре проблемы, которые позволяют атакующему с помощью специально созданной QUIC-сессии вызвать падение рабочего процесса (CVE-2024-31079, CVE-2024-32760, CVE-2024-35200), отправку клиенту части содержимого памяти рабочего процесса на системах с MTU больше 4096 байт (CVE-2024-34161), а также потенциально могут иметь другие последствия

éÚÍÅÎÅÎÉÑ × nginx 0.7.66 07.06.2010 *) âÅÚÏÐÁÓÎÏÓÔØ: ÔÅÐÅÒØ nginx/Windows ÉÇÎÏÒÉÒÕÅÔ ÉÍÑ ÐÏÔÏËÁ ÆÁÊÌÁ ÐÏ ÕÍÏÌÞÁÎÉÀ. óÐÁÓÉÂÏ Jose Antonio Vazquez Gonzalez. *) éÚÍÅÎÅÎÉÅ: ÔÅÐÅÒØ charset-ÆÉÌØÔÒ ÒÁÂÏÔÁÅÔ ÄÏ SSI-ÆÉÌØÔÒÁ. *) éÚÍÅÎÅÎÉÅ: ÔÅÐÅÒØ × ÌÏÇ ÏÛÉÂÏË ÎÅ ÐÉÛÅÔÓÑ ÓÏÏÂÝÅÎÉÅ, ÅÓÌÉ ÐÅÒÅÍÅÎÎÁÑ ÎÅ ÎÁÊÄÅÎÁ Ó ÐÏÍÏÝØÀ ÍÅÔÏÄÁ

Changes with nginx 0.8.35 01 Apr 2010 *) Change: now the charset filter runs before the SSI filter. *) Feature: the "chunked_transfer_encoding" directive. *) Bugfix: an "&" character was not escaped when it was copied in arguments part in a rewrite rule. *) Bugfix: nginx might be terminated abnormally while

Changes with nginx 0.8.33 01 Feb 2010 *) Security: now nginx/Windows ignores trailing spaces in URI. Thanks to Dan Crowley, Core Security Technologies. *) Security: now nginx/Windows ignores short files names. Thanks to Dan Crowley, Core Security Technologies. *) Change: now keepalive connections after POST requests are not

Changes with nginx 0.8.44 05 Jul 2010 *) Change: now nginx does not cache by default backend responses, if they have a "Set-Cookie" header line. *) Feature: the "listen" directive supports the "setfib" parameter. Thanks to Andrew Filonov. *) Bugfix: the "sub_filter" directive might change

Changes with nginx 1.1.19 12 Apr 2012 *) Security: specially crafted mp4 file might allow to overwrite memory locations in a worker process if the ngx_http_mp4_module was used, potentially resulting in arbitrary code execution (CVE-2012-2089). Thanks to Matthew Daley. *) Bugfix: nginx/Windows might be terminated abnormally.

A security issue was identified in the ngx_http_mp4_module, which might allow an attacker to cause a worker process crash by using a specially crafted mp4 file (CVE-2024-7347). The issue only affects nginx if it is built with the ngx_http_mp4_module (the module is not built by default) and the “mp4” directive is used in the configuration file. Further, the attack is only possible if an attacker is

В модуле ngx_http_mp4_module была обнаружена проблема, которая позволяет с помощью специально созданного mp4-файла вызвать падение рабочего процесса (CVE-2024-7347). Проблеме подвержен nginx, если он собран с модулем ngx_http_mp4_module (по умолчанию не собирается) и директива mp4 используется в конфигурационном файле. При этом атака возможна только в случае, если атакующий имеет возможность

Changes with nginx 0.9.2 06 Dec 2010 *) Feature: the "If-Unmodified-Since" client request header line support. *) Workaround: fallback to accept() syscall if accept4() was not implemented; the issue had appeared in 0.9.0. *) Bugfix: nginx could not be built on Cygwin; the issue had appeared in 0.9.0. *)