Re: [Buildroot] [PATCH] package/nginx: security bump to version 1.30.6

[Thomas Petazzoni via buildroot <buildroot@buildroot.org>]

On Thu, Oct 22, 2026 at 09:00:02AM +0200, Peter Korsgaard wrote:
> Fixes the following vulnerabilities:
> 
> Changes with nginx 1.30.6                                        14 Oct 2026
> 
>     *) Security: a buffer overflow might occur in a worker process when
>        using the "alias" directive if the request URI was changed by the
>        "rewrite" directive and was then mapped to a file path
>        (CVE-2026-15176).
> 
>     *) Security: a buffer overflow might occur in a worker process while
>        evaluating string expressions with variables, which affected the
>        document root calculation and request logging in the http and stream
>        modules (CVE-2026-93479).
>        Thanks to Matt Suiche of Tolmo Inc.
> 
>     *) Security: when using HTTP/3 a part of an unknown frame might be
>        treated as the request body, which might result in bypassing the
>        "client_max_body_size" limit or injecting data in the proxied request
>        (CVE-2026-95101).
>        Thanks to Hansol Lee of GOTROOT.
> 
>     *) Security: when using TLS session ticket key rotation, one of the keys
>        was left uninitialized, which might allow to forge a session
>        (CVE-2026-97629).
>        Thanks to PhiNode Labs.
> 
>     *) Security: when using asynchronous file I/O (AIO), use-after-free
>        might occur in certain configurations if the SSI page has "include
>        virtual" commands (CVE-2026-97205).
>        Thanks to cyberlancer.
> 
> Changes with nginx 1.30.5                                        15 Sep 2026
> 
>     *) Security: a heap memory buffer overflow might occur in a worker
>        process under certain configurations when using HTTP/3 with OpenSSL
>        3.5.0 and earlier (CVE-2026-90439).
>        Thanks to Banny Liao.
> 
> Changes with nginx 1.30.4                                        15 Jul 2026
> 
>     *) Security: heap buffer overflow might occur in a worker process when
>        using the map directive with regex matching if the map variable was
>        included in a string expression after a capture affected by this map;
>        a similar issue might happen when using a non-cacheable variable in a
>        string expression (CVE-2026-42533).
>        Thanks to Mufeed VH of Winfunc Research and Maxim Dounin.
> 
>     *) Security: uninitialized memory access might occur when using unnamed
>        regex captures with the "slice" directive or background cache update,
>        which could result in worker process memory disclosure or worker
>        process termination (CVE-2026-60005).
> 
>     *) Security: use-after-free might occur when processing a specially
>        crafted proxied backend response with the ngx_http_ssi_filter_module
>        (CVE-2026-56434).
>        Thanks to P4P3R-HAK.
> 
> https://nginx.org/en/CHANGES-1.30
> 
> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

Applied to master, thanks!

Best regards,

Thomas Petazzoni
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot