NGINX Plus Updates & Release Notes

Based on NGINX Open Source 1.31.6

NGINX Plus PLS.37.2.0.1 CR is a feature release.

• The NGINX Database Connector module, which retrieves values for specified keys from Redis databases, also supports authentication and result caching.
• The session_sync_leeway directive for the Native OIDC module, which addresses session synchronization delays between cluster nodes.
• NGINX license status logging at startup when the configured error log level is notice or more verbose.
• PROXY Protocol version 2 support for the proxy_protocol directive in the Stream and Mail modules.
• Support for predicate locations, which sets a configuration based on the value of a variable evaluated during request processing.
• The ngx_http_json_module module, which extracts values from a JSON document and makes them available as variables.
• The client_body_early_read directive, which enables the client request body to be read immediately after the request headers are received based on specified conditions.
• Changes in behavior:
  • The QUIC transport parameters extension received over an SSL connection is now always ignored.
  • HTTP/2 and gRPC requests to upstream servers are now always sent with the :authority pseudo-header, while HTTP/1.1 requests are sent with the Host header.
• Security fix in the ngx_http_v3_module module: when using HTTP/3 with the proxy_request_buffering directive enabled, an unauthenticated remote attacker may be able to inject data into a proxied request (CVE-2026-95101).

Based on NGINX Open Source 1.31.3

NGINX Plus PLS.37.1.1.2 CR is a security release.

• Security fix in the ngx_http_v3_module module: when using HTTP/3 with OpenSSL versions 3.5.0 and earlier, a limited heap buffer overflow may occur during TLS handshake processing under certain configurations. The condition is non-deterministic and beyond an attacker’s control. This may cause a heap buffer overflow in the NGINX worker process, potentially resulting in restart and/or limited data corruption. (CVE-2026-90439).

Based on NGINX Open Source 1.29.8

NGINX Plus PLS.37.0.6.2 LTS is a security release.

• Security fix in the ngx_http_v3_module module: when using HTTP/3 with OpenSSL versions 3.5.0 and earlier, a limited heap buffer overflow may occur during TLS handshake processing under certain configurations. The condition is non-deterministic and beyond an attacker’s control. This may cause a heap buffer overflow in the NGINX worker process, potentially resulting in restart and/or limited data corruption. (CVE-2026-90439).

Based on NGINX Open Source 1.29.8

NGINX Plus PLS.37.0.5.1 LTS is a bugfix release. We recommend that all users on the LTS track upgrade to the latest LTS release to ensure they are running the most stable and secure version of NGINX Plus.

Security fixes

• Security fix: when a location is configured with the alias directive together with rewrite and a set or return directive referencing the $request_filename variable, a heap buffer overflow may occur while processing a crafted HTTP request. The issue may also occur when $request_filename is used in an access log format. This may cause an NGINX worker process to restart and, if Address Space Layout Randomization (ASLR) is disabled or bypassed, may allow code execution (CVE-2026-15176).
• Security fix: when the map directive uses regular expression matching and the root directive or an access_log format references the map’s regular expression capture variables before the map output variable, a heap buffer overflow may occur while processing a crafted HTTP request. The issue may also occur when a non-cacheable variable is used in a string expression under certain conditions. This may cause an NGINX worker process to restart and, if Address Space Layout Randomization (ASLR) is disabled or bypassed, may allow code execution (CVE-2026-93479).
• Security fix in the ngx_http_ssl_module module: when the ssl_session_cache directive is configured with a shared cache and no ssl_session_ticket_key directives are specified to automatically rotate SSL session ticket keys, a remote unauthenticated attacker may forge client SSL sessions. The condition is non-deterministic and beyond the attacker’s control. This may allow an attacker to bypass client certificate verification and gain unauthorized access to sensitive resources or information (CVE-2026-97629).
• Security fix in the ngx_http_core_module module: when asynchronous file I/O (aio) is enabled in certain configurations, processing Server Side Includes (SSI) containing include virtual commands may trigger a use-after-free condition in the NGINX worker process. This may cause memory corruption or a worker process crash and, if Address Space Layout Randomization (ASLR) is disabled or bypassed, may allow code execution (CVE-2026-97205).

Based on NGINX Open Source 1.31.3

NGINX Plus PLS.37.1.0.1

NGINX Plus PLS.37.1.0.1 CR is a feature release.

• Deferred license autorenewal: the license_pending_token directive which allows adding a license via the API. API v10 now supports adding a license with the PUT method.
• Variable-based rate limiting allowing rate limits to be configured dynamically based on variables.
• SSL and TLS
  • The proxy_ssl_alpn directive for stream.
  • The $ssl_sigalgs variable that returns the signature algorithm for the server certificate for an established SSL connection.
  • Lowered the logging level of some SSL alert and record-layer errors from crit to info.
• HTTP/2, HTTP/3, QUIC, and gRPC
  • Improved HTTP/2 and HTTP/3 protocol validation, including stricter handling of connection-related headers, pseudo-headers, and invalid response metadata.
  • Fixed multiple HTTP/2 proxying issues related to flow control, backend connection caching, cached responses, and incorrect Upgrade headers.
  • The size of headers and trailers in HTTP/2 responses is now limited with proxy_buffer_size and grpc_buffer_size directives.
  • Fixed QUIC IPv6 fragmentation handling on some operating systems.
• Proxying
  • Configurable socket send and receive buffer directives proxy_socket_sndbuf and proxy_socket_rcvbuf, also for FastCGI, gRPC, SCGI, uWSGI, and tunnel upstream connections.
  • Fixed transfer of proxied HTTP/0.9, SCGI, and uWSGI responses when the first response line was not fully read.
• Security and hardening
  • Improved secure_link hash comparison to use constant-time comparison.
  • Updated the $request_id variable to use SipHash-2-4.
  • Improved WebDAV validation for COPY and MOVE requests involving identical or parent-child resources.
• Other fixes and improvements
  • XSLT filter module: the new xml_external_entities directive, loading of external XML entities is now enabled.
  • Fixed an issue where split_clients variables could be empty when explicitly configured percentages summed to 100%.
  • Fixed issues in the ngx_http_tunnel_module module.
  • Security fix: when a location is configured with the alias directive together with rewrite and a set or return directive referencing the $request_filename variable, a heap buffer overflow may occur while processing a crafted HTTP request. The issue may also occur when $request_filename is used in an access log format. This may cause an NGINX worker process to restart and, if Address Space Layout Randomization (ASLR) is disabled or bypassed, may allow code execution (CVE-2026-15176).
  • Security fix: when the map directive uses regular expression matching and the root directive or an access_log format references the map’s regular expression capture variables before the map output variable, a heap buffer overflow may occur while processing a crafted HTTP request. The issue may also occur when a non-cacheable variable is used in a string expression under certain conditions. This may cause an NGINX worker process to restart and, if Address Space Layout Randomization (ASLR) is disabled or bypassed, may allow code execution (CVE-2026-93479).
  • Security fix in the ngx_http_ssl_module module: when the ssl_session_cache directive is configured with a shared cache and no ssl_session_ticket_key directives are specified to automatically rotate SSL session ticket keys, a remote unauthenticated attacker may forge client SSL sessions. The condition is non-deterministic and beyond the attacker’s control. This may allow an attacker to bypass client certificate verification and gain unauthorized access to sensitive resources or information (CVE-2026-97629).
  • Security fix in the ngx_http_core_module module: when asynchronous file I/O (aio) is enabled in certain configurations, processing Server Side Includes (SSI) containing include virtual commands may trigger a use-after-free condition in the NGINX worker process. This may cause memory corruption or a worker process crash and, if Address Space Layout Randomization (ASLR) is disabled or bypassed, may allow code execution (CVE-2026-97205).

Based on NGINX Open Source 1.29.8

NGINX Plus PLS.37.0.4.1 LTS is a bugfix release:

• If the Host header field value set by proxy_set_header evaluates to an empty string, the value of $proxy_host is used instead. This prevents sending upstream requests without a Host (HTTP/1.1) or :authority (HTTP/2) header, and also allows health checks to pass in some configurations. The bug appeared in NGINX Plus PLS.37.0.0.1 LTS.
• Restored compatibility with some third-party dynamic modules available in our repository, for example, Set-Misc and Lua. The bug appeared in NGINX Plus PLS.37.0.3.1 LTS.

NGINX Plus PLS.37.0.3.1 LTS is a security release.

Security fix in the ngx_http_ssi_module module

when the ssi and proxy_pass with disabled buffering (off) directives are configured, an unauthenticated attacker with man-in-the-middle (MITM) ability to control responses from an upstream server may be able to cause a heap buffer over-read in the NGINX worker process, leading to limited modification of memory or a restart (CVE-2026-56434).

Security fix

when the map directive with regex matching is configured and the map variable is included in a string expression following the captures affected by this map. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR (CVE-2026-42533).

Security fix in the ngx_http_slice_module module

when the slice directive and unnamed regex captures are configured or when a background cache update happens, unauthenticated attackers can send requests that with conditions beyond the attacker’s control cause uninitialized memory access in the NGINX worker process, leading to limited disclosure of memory or a restart (CVE-2026-60005).

Security fix

when NGINX Plus is configured to use the MQTT filter module (ngx_stream_mqtt_filter_module), unauthenticated attackers can send requests with conditions beyond the attacker’s control to cause a heap buffer over-read in the NGINX worker process, leading to a restart (CVE-2026-60065).

NGINX Plus PLS.37.0.2.1 LTS

NGINX Plus PLS.37.0.2.1 LTS is a security release.

• Security fix in the ngx_http_charset_module module: when content is served or proxied through a location block with both source_charset utf-8; and a charset directive (for example, charset koi8-r;) configured, remote, unauthenticated attackers can send requests (in conjunction with conditions beyond their control) to cause a heap buffer over-read in the NGINX worker process, leading to limited disclosure of memory or a restart (CVE-2026-48142).

• Security fix in the ngx_http_v2_module and ngx_http_grpc_module modules: when NGINX Plus is configured to proxy HTTP/2 traffic by using proxy_http_version 2 or grpc_pass, ignore_invalid_headers set to off, and large_client_header_buffers size is larger than 2M, a remote unauthenticated attacker could send large headers while creating an upstream request. This may cause a heap-based buffer overflow in the NGINX worker process, leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR (CVE-2026-42055).

Based on NGINX Open Source 1.29.8

NGINX Plus PLS.37.0.0.1 LTS is the first LTS release.

New release model: Long-Term Support (LTS) Releases and Continuous Releases (CR).

• Agentic observability module: real-time MCP traffic monitoring.
• NGINX control REST API that provides an HTTP interface for controlling an NGINX Plus instance in addition to signal-based control.
• JSON-formatted error logs: the json parameter of the error_log directive.
• Customer error log variables: the error_log_tag directive.
• Enhanced upstream latency metrics with latency histograms: the response_time_hist data for each HTTP upstream.
• Basic authentication for HTTP CONNECT forward proxy.
• Encrypted Client Hello (ECH) support: the ssl_ech_file directive.
• Multipath TCP support: the multipath parameter of the listen directive.
• The max_headers directive that sets the maximum allowed number of header lines in requests.
• HTTP2 to upstreams support.
• Default HTTP 1.1 version to upstreams with keepalive enabled by default.
• Support for OpenSSL 4.0.
• Enhancements in the ACME, OpenTelemetry Distributed Tracing and Prometheus-njs modules.
• Security fix in the ngx_http_rewrite_module module: a heap memory buffer overflow might occur in a worker process while handling a specially crafted request by the module, potentially resulting in arbitrary code execution (CVE-2026-42945).
• Security fix in the ngx_http_scgi_module and ngx_http_uwsgi_module modules: a heap memory buffer overread might occur in a worker process while handling a specially crafted response by these modules, allowing an attacker to cause a disclosure of worker process memory or segmentation fault in a worker process (CVE-2026-42946).
• Security fix in the ngx_http_charset_module module: a heap memory buffer overread might occur in a worker process while handling a specially crafted response with decoding from UTF-8 via the charset_map directive, allowing an attacker to cause a limited disclosure of worker process memory or segmentation fault in a worker process (CVE-2026-42934).
• Security fix for HTTP/3: when using HTTP/3, processing of connection migration might cause new QUIC streams to receive a new client address before validation, allowing an attacker to cause address spoofing (CVE-2026-40460).
• Security fix in the ngx_http_ssl_module module: when the ssl_verify_client directive is set to on or optional, and the ssl_ocsp directive is set to on or the leaf parameters are configured with a resolver, an unauthenticated attacker can send requests that, under conditions beyond the attacker’s control, might cause a heap-use-after-free error in a NGINX worker process, potentially resulting in limited modification of data or a worker process restart (CVE-2026-40701).

This is a security release for NGINX Plus R36.

• Security fix in the ngx_http_rewrite_module module: a heap memory buffer overflow might occur in a worker process while handling a specially crafted request by the module, potentially resulting in arbitrary code execution (CVE-2026-42945).
• Security fix in the ngx_http_scgi_module and ngx_http_uwsgi_module modules: a heap memory buffer overread might occur in a worker process while handling a specially crafted response by these modules, allowing an attacker to cause a disclosure of worker process memory or segmentation fault in a worker process (CVE-2026-42946).
• Security fix in the ngx_http_charset_module module: a heap memory buffer overread might occur in a worker process while handling a specially crafted response with decoding from UTF-8 via the charset_map directive, allowing an attacker to cause a limited disclosure of worker process memory or segmentation fault in a worker process (CVE-2026-42934).
• Security fix for HTTP/3: when using HTTP/3, processing of connection migration might cause new QUIC streams to receive a new client address before validation, allowing an attacker to cause address spoofing (CVE-2026-40460).
• Security fix in the ngx_http_ssl_module module: when the ssl_verify_client directive is set to on or optional, and the ssl_ocsp directive is set to on or the leaf parameters are configured with a resolver, an unauthenticated attacker can send requests that, under conditions beyond the attacker’s control, might cause a heap-use-after-free error in a NGINX worker process, potentially resulting in limited modification of data or a worker process restart (CVE-2026-40701).