1.2.10 (Aug. 25 2021)
fix: Nchan could not be built without openssl due to hiredis dependency
(introduced in v1.2.9)
feature: allow no separator for http-raw-stream (thanks @sclem)
1.2.9 (Aug. 12 2021)
feature: Redis cluster reconfiguration check timer,
nchan_redis_cluster_check_interval setting
fix: detect Redis cluster reconfiguration when publishing messages in "nostore" mode
update: hiredis updated to v1.0.0
fix: segfault on out-of-shared-memory condition for multiplexed publishers
Changes with nginx 1.20.1
*) Security: 1-byte memory overwrite might occur during DNS server
response processing if the "resolver" directive was used, allowing an
attacker who is able to forge UDP packets from the DNS server to
cause worker process crash or, potentially, arbitrary code execution
(CVE-2021-23017).
nginx-rtmp-module v1.2.2:
Fixed segfaults.
1.2.8 (Apr. 12 2021)
feature: nchan_subscriber_info locations for receiving customizable info from
subscribers of a given channel.
fix: incorrect lgging of disconnected subscribers with 400 error instead of 499
(bug introduced in v1.2.7)
feature: add $nchan_channel_subscriber_last_seen, $nchan_channel_subscriber_count
and $nchan_channel_message_count variables
fix: GCC 10 compatibility
Changelog:
* nginx modules:
*) Feature: introduced global "ngx" object.
The following methods were added:
ngx.log(level, msg)
The following properties were added:
ngx.INFO,
ngx.WARN,
ngx.ERR.
*) Feature: added support for Buffer object where string
is expected.
*) Feature: added Buffer version of existing properties.
The following properties were added:
r.requestBuffer (r.requestBody),
r.responseBuffer (r.responseBody),
r.rawVariables (r.variables),
s.rawVariables (s.variables).
The following events were added in stream module:
upstream (upload),
downstream (download).
*) Improvement: added aliases to existing properties.
The following properties were added:
r.requestText (r.requestBody),
r.responseText (r.responseBody).
*) Improvement: throwing an exception in r.internalRedirect()
for a subrequest.
*) Bugfix: fixed promise r.subrequest() with error_page redirect.
*) Bugfix: fixed promise events handling.
* Core:
*) Feature: added TypeScript definitions for built-in
modules.
Thanks to Jakub Jirutka.
*) Feature: tracking unhandled promise rejection.
*) Feature: added initial iterator support.
Thanks to Artem S. Povalyukhin.
*) Improvement: TypeScript definitions are refactored.
Thanks to Jakub Jirutka.
*) Improvement: added forgotten support for
Object.prototype.valueOf() in Buffer.from().
*) Bugfix: fixed heap-use-after-free in JSON.parse().
*) Bugfix: fixed heap-use-after-free in JSON.stringify().
*) Bugfix: fixed JSON.stringify() for arrays resizable via
getters.
*) Bugfix: fixed heap-buffer-overflow for
RegExp.prototype[Symbol.replace].
*) Bugfix: fixed returned value for Buffer.prototype.write*
functions.
*) Bugfix: fixed querystring.stringify().
Thanks to Artem S. Povalyukhin.
*) Bugfix: fixed the catch handler for
Promise.prototype.finally().
*) Bugfix: fixed querystring.parse().
Upstream changes since 0.56:
1.0:
* Parse body of PATCH requests
* Scientific notation in json
* Log clarification
* Fixed country code when geoip library fail to get geolocation or ip is private/local address
* Fixed issues to setup nxapi on ES5 and added country location on stats and generated whitelists
1.1:
* Fixed various compilation issues
* Fixed valid JSON blocked by Rule ID 15
* Fixed documentation
* Updated libinjection to 3.9.2
* Added Content-type: application/vnd.api+json
* Added JSON logging output for events
* Implemented Whitelist for IPs and CIDRs and support for IPv4 and IPv6
1.1a:
* Fixed 3 vulnerabilities related to the WAF.
* Fixed build on FreeBSD
Release Date: 29 September 2020
* nginx modules:
- Bugfix: fixed location merge.
- Bugfix: fixed r.httpVersion for HTTP/2.
* Core:
- Feature: added support for numeric separators (ES12).
- Feature: added remaining methods for %TypedArray%.prototype. The following
methods were added: every(), filter(), find(), findIndex(), forEach(),
includes(), indexOf(), lastIndexOf(), map(), reduce(), reduceRight(),
reverse(), some().
- Feature: added %TypedArray% remaining methods. The following methods were added: from(), of().
- Feature: added DataView object.
- Feature: added Buffer object implementation.
- Feature: added support for ArrayBuffer in TextDecoder.prototype.decode()
- Feature: added support for Buffer object in crypto methods.
- Feature: added support for Buffer object in fs methods.
- Change: Hash.prototype.digest() and Hmac.prototype.digest() now return a
Buffer instance instead of a byte string when encoding is not provided.
- Change: fs.readFile() and friends now return a Buffer instance instead of a
byte string when encoding is not provided.
- Bugfix: fixed function prototype property handler while setting.
- Bugfix: fixed function constructor property handler while setting.
- Bugfix: fixed String.prototype.indexOf() for byte strings.
- Bugfix: fixed RegExpBuiltinExec() with a global flag and byte strings.
- Bugfix: fixed RegExp.prototype[Symbol.replace] the when replacement value is a
function.
- Bugfix: fixed TextDecoder.prototype.decode() with non-zero TypedArray offset.
njs is a subset of the JavaScript language that allows extending nginx
functionality. njs is created in compliance with ECMAScript 5.1 (strict mode)
with some ECMAScript 6 and later extensions.
pkglint -r --network --only "migrate"
As a side-effect of migrating the homepages, pkglint also fixed a few
indentations in unrelated lines. These and the new homepages have been
checked manually.
Changes with nginx 1.16.1
*) Security: when using HTTP/2 a client might cause excessive memory
consumption and CPU usage (CVE-2019-9511, CVE-2019-9513,
CVE-2019-9516).
Changes with nginx 1.16.0 23 Apr 2019
*) 1.16.x stable branch.
Changes with nginx 1.15.12 16 Apr 2019
*) Bugfix: a segmentation fault might occur in a worker process if
variables were used in the "ssl_certificate" or "ssl_certificate_key"
directives and OCSP stapling was enabled.
Changes with nginx 1.15.11 09 Apr 2019
*) Bugfix: in the "ssl_stapling_file" directive on Windows.
Changes with nginx 1.15.10 26 Mar 2019
*) Change: when using a hostname in the "listen" directive nginx now
creates listening sockets for all addresses the hostname resolves to
(previously, only the first address was used).
*) Feature: port ranges in the "listen" directive.
*) Feature: loading of SSL certificates and secret keys from variables.
*) Workaround: the $ssl_server_name variable might be empty when using
OpenSSL 1.1.1.
*) Bugfix: nginx/Windows could not be built with Visual Studio 2015 or
newer; the bug had appeared in 1.15.9.
Changes with nginx 1.15.9 26 Feb 2019
*) Feature: variables support in the "ssl_certificate" and
"ssl_certificate_key" directives.
*) Feature: the "poll" method is now available on Windows when using
Windows Vista or newer.
*) Bugfix: if the "select" method was used on Windows and an error
occurred while establishing a backend connection, nginx waited for
the connection establishment timeout to expire.
*) Bugfix: the "proxy_upload_rate" and "proxy_download_rate" directives
in the stream module worked incorrectly when proxying UDP datagrams.
Changes with nginx 1.15.8 25 Dec 2018
*) Feature: the $upstream_bytes_sent variable.
Thanks to Piotr Sikora.
*) Feature: new directives in vim syntax highlighting scripts.
Thanks to Gena Makhomed.
*) Bugfix: in the "proxy_cache_background_update" directive.
*) Bugfix: in the "geo" directive when using unix domain listen sockets.
*) Workaround: the "ignoring stale global SSL error ... bad length"
alerts might appear in logs when using the "ssl_early_data" directive
with OpenSSL.
*) Bugfix: in nginx/Windows.
*) Bugfix: in the ngx_http_autoindex_module on 32-bit platforms.
Changes with nginx 1.15.7 27 Nov 2018
*) Feature: the "proxy_requests" directive in the stream module.
*) Feature: the "delay" parameter of the "limit_req" directive.
Thanks to Vladislav Shabanov and Peter Shchuchkin.
*) Bugfix: memory leak on errors during reconfiguration.
*) Bugfix: in the $upstream_response_time, $upstream_connect_time, and
$upstream_header_time variables.
*) Bugfix: a segmentation fault might occur in a worker process if the
ngx_http_mp4_module was used on 32-bit platforms.
Changes with nginx 1.15.6 06 Nov 2018
*) Security: when using HTTP/2 a client might cause excessive memory
consumption (CVE-2018-16843) and CPU usage (CVE-2018-16844).
*) Security: processing of a specially crafted mp4 file with the
ngx_http_mp4_module might result in worker process memory disclosure
(CVE-2018-16845).
*) Feature: the "proxy_socket_keepalive", "fastcgi_socket_keepalive",
"grpc_socket_keepalive", "memcached_socket_keepalive",
"scgi_socket_keepalive", and "uwsgi_socket_keepalive" directives.
*) Bugfix: if nginx was built with OpenSSL 1.1.0 and used with OpenSSL
1.1.1, the TLS 1.3 protocol was always enabled.
*) Bugfix: working with gRPC backends might result in excessive memory
consumption.
Changes with nginx 1.15.5 02 Oct 2018
*) Bugfix: a segmentation fault might occur in a worker process when
using OpenSSL 1.1.0h or newer; the bug had appeared in 1.15.4.
*) Bugfix: of minor potential bugs.
Changes with nginx 1.15.4 25 Sep 2018
*) Feature: now the "ssl_early_data" directive can be used with OpenSSL.
*) Bugfix: in the ngx_http_uwsgi_module.
Thanks to Chris Caputo.
*) Bugfix: connections with some gRPC backends might not be cached when
using the "keepalive" directive.
*) Bugfix: a socket leak might occur when using the "error_page"
directive to redirect early request processing errors, notably errors
with code 400.
*) Bugfix: the "return" directive did not change the response code when
returning errors if the request was redirected by the "error_page"
directive.
*) Bugfix: standard error pages and responses of the
ngx_http_autoindex_module module used the "bgcolor" attribute, and
might be displayed incorrectly when using custom color settings in
browsers.
Thanks to Nova DasSarma.
*) Change: the logging level of the "no suitable key share" and "no
suitable signature algorithm" SSL errors has been lowered from "crit"
to "info".
Changes with nginx 1.15.3 28 Aug 2018
*) Feature: now TLSv1.3 can be used with BoringSSL.
*) Feature: the "ssl_early_data" directive, currently available with
BoringSSL.
*) Feature: the "keepalive_timeout" and "keepalive_requests" directives
in the "upstream" block.
*) Bugfix: the ngx_http_dav_module did not truncate destination file
when copying a file over an existing one with the COPY method.
*) Bugfix: the ngx_http_dav_module used zero access rights on the
destination file and did not preserve file modification time when
moving a file between different file systems with the MOVE method.
*) Bugfix: the ngx_http_dav_module used default access rights when
copying a file with the COPY method.
*) Workaround: some clients might not work when using HTTP/2; the bug
had appeared in 1.13.5.
*) Bugfix: nginx could not be built with LibreSSL 2.8.0.
Changes with nginx 1.15.2 24 Jul 2018
*) Feature: the $ssl_preread_protocol variable in the
ngx_stream_ssl_preread_module.
*) Feature: now when using the "reset_timedout_connection" directive
nginx will reset connections being closed with the 444 code.
*) Change: a logging level of the "http request", "https proxy request",
"unsupported protocol", and "version too low" SSL errors has been
lowered from "crit" to "info".
*) Bugfix: DNS requests were not resent if initial sending of a request
failed.
*) Bugfix: the "reuseport" parameter of the "listen" directive was
ignored if the number of worker processes was specified after the
"listen" directive.
*) Bugfix: when using OpenSSL 1.1.0 or newer it was not possible to
switch off "ssl_prefer_server_ciphers" in a virtual server if it was
switched on in the default server.
*) Bugfix: SSL session reuse with upstream servers did not work with the
TLS 1.3 protocol.
Changes with nginx 1.15.1 03 Jul 2018
*) Feature: the "random" directive inside the "upstream" block.
*) Feature: improved performance when using the "hash" and "ip_hash"
directives with the "zone" directive.
*) Feature: the "reuseport" parameter of the "listen" directive now uses
SO_REUSEPORT_LB on FreeBSD 12.
*) Bugfix: HTTP/2 server push did not work if SSL was terminated by a
proxy server in front of nginx.
*) Bugfix: the "tcp_nopush" directive was always used on backend
connections.
*) Bugfix: sending a disk-buffered request body to a gRPC backend might
fail.
Changes with nginx 1.15.0 05 Jun 2018
*) Change: the "ssl" directive is deprecated; the "ssl" parameter of the
"listen" directive should be used instead.
*) Change: now nginx detects missing SSL certificates during
configuration testing when using the "ssl" parameter of the "listen"
directive.
*) Feature: now the stream module can handle multiple incoming UDP
datagrams from a client within a single session.
*) Bugfix: it was possible to specify an incorrect response code in the
"proxy_cache_valid" directive.
*) Bugfix: nginx could not be built by gcc 8.1.
*) Bugfix: logging to syslog stopped on local IP address changes.
*) Bugfix: nginx could not be built by clang with CUDA SDK installed;
the bug had appeared in 1.13.8.
*) Bugfix: "getsockopt(TCP_FASTOPEN) ... failed" messages might appear
in logs during binary upgrade when using unix domain listen sockets
on FreeBSD.
*) Bugfix: nginx could not be built on Fedora 28 Linux.
*) Bugfix: request processing rate might exceed configured rate when
using the "limit_req" directive.
*) Bugfix: in handling of client addresses when using unix domain listen
sockets to work with datagrams on Linux.
*) Bugfix: in memory allocation error handling.
Changes with nginx 1.15.10:
*) Change: when using a hostname in the "listen" directive nginx now
creates listening sockets for all addresses the hostname resolves to
(previously, only the first address was used).
*) Feature: port ranges in the "listen" directive.
*) Feature: loading of SSL certificates and secret keys from variables.
*) Workaround: the $ssl_server_name variable might be empty when using
OpenSSL 1.1.1.
*) Bugfix: nginx/Windows could not be built with Visual Studio 2015 or
newer; the bug had appeared in 1.15.9.
nginx-nchan:
1.2.5:
fix: using multiplexed channels with Redis in backup mode may result in worker crash
fix: nchan_publisher_channel_id could not be set exclusively in a publisher location
fix: Google pagespeed module compatibility
fix: nchan prevents nginx from starting if no http {} block is configured
1.2.4:
fix: Redis cluster info with zero-length hostname may result in worker crash
fix: build problems with included hiredis lib in FreeBSD
feature: nchan_redis_namespace and nchan_redis_ping_interval now work in upstream blocks
fix: websocket publisher did not publishing channel events
fix: Redis namespace was limited to 8 bytes
Changes with nginx 1.14.2
*) Bugfix: nginx could not be built by gcc 8.1.
*) Bugfix: nginx could not be built on Fedora 28 Linux.
*) Bugfix: in handling of client addresses when using unix domain listen
sockets to work with datagrams on Linux.
*) Change: the logging level of the "http request", "https proxy
request", "unsupported protocol", "version too low", "no suitable key
share", and "no suitable signature algorithm" SSL errors has been
lowered from "crit" to "info".
*) Bugfix: when using OpenSSL 1.1.0 or newer it was not possible to
switch off "ssl_prefer_server_ciphers" in a virtual server if it was
switched on in the default server.
*) Bugfix: nginx could not be built with LibreSSL 2.8.0.
*) Bugfix: if nginx was built with OpenSSL 1.1.0 and used with OpenSSL
1.1.1, the TLS 1.3 protocol was always enabled.
*) Bugfix: sending a disk-buffered request body to a gRPC backend might
fail.
*) Bugfix: connections with some gRPC backends might not be cached when
using the "keepalive" directive.
*) Bugfix: a segmentation fault might occur in a worker process if the
ngx_http_mp4_module was used on 32-bit platforms.
Changes with nginx 1.14.1 06 Nov 2018
*) Security: when using HTTP/2 a client might cause excessive memory
consumption (CVE-2018-16843) and CPU usage (CVE-2018-16844).
*) Security: processing of a specially crafted mp4 file with the
ngx_http_mp4_module might result in worker process memory disclosure
(CVE-2018-16845).
*) Bugfix: working with gRPC backends might result in excessive memory
consumption.
Changes with nginx 1.15.2:
*) Feature: the $ssl_preread_protocol variable in the
ngx_stream_ssl_preread_module.
*) Feature: now when using the "reset_timedout_connection" directive
nginx will reset connections being closed with the 444 code.
*) Change: a logging level of the "http request", "https proxy request",
"unsupported protocol", and "version too low" SSL errors has been
lowered from "crit" to "info".
*) Bugfix: DNS requests were not resent if initial sending of a request
failed.
*) Bugfix: the "reuseport" parameter of the "listen" directive was
ignored if the number of worker processes was specified after the
"listen" directive.
*) Bugfix: when using OpenSSL 1.1.0 or newer it was not possible to
switch off "ssl_prefer_server_ciphers" in a virtual server if it was
switched on in the default server.
*) Bugfix: SSL session reuse with upstream servers did not work with the
TLS 1.3 protocol.
Changes with nginx 1.15.1:
*) Feature: the "random" directive inside the "upstream" block.
*) Feature: improved performance when using the "hash" and "ip_hash"
directives with the "zone" directive.
*) Feature: the "reuseport" parameter of the "listen" directive now uses
SO_REUSEPORT_LB on FreeBSD 12.
*) Bugfix: HTTP/2 server push did not work if SSL was terminated by a
proxy server in front of nginx.
*) Bugfix: the "tcp_nopush" directive was always used on backend
connections.
*) Bugfix: sending a disk-buffered request body to a gRPC backend might
fail.
Changes with nginx 1.15.0:
*) Change: the "ssl" directive is deprecated; the "ssl" parameter of the
"listen" directive should be used instead.
*) Change: now nginx detects missing SSL certificates during
configuration testing when using the "ssl" parameter of the "listen"
directive.
*) Feature: now the stream module can handle multiple incoming UDP
datagrams from a client within a single session.
*) Bugfix: it was possible to specify an incorrect response code in the
"proxy_cache_valid" directive.
*) Bugfix: nginx could not be built by gcc 8.1.
*) Bugfix: logging to syslog stopped on local IP address changes.
*) Bugfix: nginx could not be built by clang with CUDA SDK installed;
the bug had appeared in 1.13.8.
*) Bugfix: "getsockopt(TCP_FASTOPEN) ... failed" messages might appear
in logs during binary upgrade when using unix domain listen sockets
on FreeBSD.
*) Bugfix: nginx could not be built on Fedora 28 Linux.
*) Bugfix: request processing rate might exceed configured rate when
using the "limit_req" directive.
*) Bugfix: in handling of client addresses when using unix domain listen
sockets to work with datagrams on Linux.
*) Bugfix: in memory allocation error handling.
nginx-1.14.0 stable version has been released, incorporating new features and bug fixes from the 1.13.x mainline branch - including the mirror module, HTTP/2 push, the gRPC proxy module, and more.
