[Buildroot] [PATCH] package/nginx: security bump to version 1.30.6

[Buildroot] [PATCH] package/nginx: security bump to version 1.30.6

[Peter Korsgaard]

Fixes the following vulnerabilities:

Changes with nginx 1.30.6                                        14 Oct 2026

    *) Security: a buffer overflow might occur in a worker process when
       using the "alias" directive if the request URI was changed by the
       "rewrite" directive and was then mapped to a file path
       (CVE-2026-15176).

    *) Security: a buffer overflow might occur in a worker process while
       evaluating string expressions with variables, which affected the
       document root calculation and request logging in the http and stream
       modules (CVE-2026-93479).
       Thanks to Matt Suiche of Tolmo Inc.

    *) Security: when using HTTP/3 a part of an unknown frame might be
       treated as the request body, which might result in bypassing the
       "client_max_body_size" limit or injecting data in the proxied request
       (CVE-2026-95101).
       Thanks to Hansol Lee of GOTROOT.

    *) Security: when using TLS session ticket key rotation, one of the keys
       was left uninitialized, which might allow to forge a session
       (CVE-2026-97629).
       Thanks to PhiNode Labs.

    *) Security: when using asynchronous file I/O (AIO), use-after-free
       might occur in certain configurations if the SSI page has "include
       virtual" commands (CVE-2026-97205).
       Thanks to cyberlancer.

Changes with nginx 1.30.5                                        15 Sep 2026

    *) Security: a heap memory buffer overflow might occur in a worker
       process under certain configurations when using HTTP/3 with OpenSSL
       3.5.0 and earlier (CVE-2026-90439).
       Thanks to Banny Liao.

Changes with nginx 1.30.4                                        15 Jul 2026

    *) Security: heap buffer overflow might occur in a worker process when
       using the map directive with regex matching if the map variable was
       included in a string expression after a capture affected by this map;
       a similar issue might happen when using a non-cacheable variable in a
       string expression (CVE-2026-42533).
       Thanks to Mufeed VH of Winfunc Research and Maxim Dounin.

    *) Security: uninitialized memory access might occur when using unnamed
       regex captures with the "slice" directive or background cache update,
       which could result in worker process memory disclosure or worker
       process termination (CVE-2026-60005).

    *) Security: use-after-free might occur when processing a specially
       crafted proxied backend response with the ngx_http_ssi_filter_module
       (CVE-2026-56434).
       Thanks to P4P3R-HAK.

https://nginx.org/en/CHANGES-1.30

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
---
 package/nginx/nginx.hash | 2 +-
 package/nginx/nginx.mk   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/package/nginx/nginx.hash b/package/nginx/nginx.hash
index 6c3afa889d..646b51997e 100644
--- a/package/nginx/nginx.hash
+++ b/package/nginx/nginx.hash
@@ -1,4 +1,4 @@
 # Locally calculated after checking pgp signature
-sha256  e5823dc6f45610993def93ebf6cfce68264af4958c77e874b7d20f3709001b8f  nginx-1.30.3.tar.gz
+sha256  3cf46f5ed7504d460125866b7bea99fb357f31d887e2e63b35503310e9b8b6c8  nginx-1.30.6.tar.gz
 # License files, locally calculated
 sha256  08845fe39e06b51dad7685c28140ab49577a86e947523e16b536a46caf89ad5c  LICENSE
diff --git a/package/nginx/nginx.mk b/package/nginx/nginx.mk
index ad61ef6140..c330e81ebf 100644
--- a/package/nginx/nginx.mk
+++ b/package/nginx/nginx.mk
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-NGINX_VERSION = 1.30.3
+NGINX_VERSION = 1.30.6
 NGINX_SITE = https://nginx.org/download
 NGINX_LICENSE = BSD-2-Clause
 NGINX_LICENSE_FILES = LICENSE
-- 
2.47.3

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH] package/nginx: security bump to version 1.30.6

[Thomas Petazzoni via buildroot]

On Thu, Oct 22, 2026 at 09:00:02AM +0200, Peter Korsgaard wrote:
> Fixes the following vulnerabilities:
> 
> Changes with nginx 1.30.6                                        14 Oct 2026
> 
>     *) Security: a buffer overflow might occur in a worker process when
>        using the "alias" directive if the request URI was changed by the
>        "rewrite" directive and was then mapped to a file path
>        (CVE-2026-15176).
> 
>     *) Security: a buffer overflow might occur in a worker process while
>        evaluating string expressions with variables, which affected the
>        document root calculation and request logging in the http and stream
>        modules (CVE-2026-93479).
>        Thanks to Matt Suiche of Tolmo Inc.
> 
>     *) Security: when using HTTP/3 a part of an unknown frame might be
>        treated as the request body, which might result in bypassing the
>        "client_max_body_size" limit or injecting data in the proxied request
>        (CVE-2026-95101).
>        Thanks to Hansol Lee of GOTROOT.
> 
>     *) Security: when using TLS session ticket key rotation, one of the keys
>        was left uninitialized, which might allow to forge a session
>        (CVE-2026-97629).
>        Thanks to PhiNode Labs.
> 
>     *) Security: when using asynchronous file I/O (AIO), use-after-free
>        might occur in certain configurations if the SSI page has "include
>        virtual" commands (CVE-2026-97205).
>        Thanks to cyberlancer.
> 
> Changes with nginx 1.30.5                                        15 Sep 2026
> 
>     *) Security: a heap memory buffer overflow might occur in a worker
>        process under certain configurations when using HTTP/3 with OpenSSL
>        3.5.0 and earlier (CVE-2026-90439).
>        Thanks to Banny Liao.
> 
> Changes with nginx 1.30.4                                        15 Jul 2026
> 
>     *) Security: heap buffer overflow might occur in a worker process when
>        using the map directive with regex matching if the map variable was
>        included in a string expression after a capture affected by this map;
>        a similar issue might happen when using a non-cacheable variable in a
>        string expression (CVE-2026-42533).
>        Thanks to Mufeed VH of Winfunc Research and Maxim Dounin.
> 
>     *) Security: uninitialized memory access might occur when using unnamed
>        regex captures with the "slice" directive or background cache update,
>        which could result in worker process memory disclosure or worker
>        process termination (CVE-2026-60005).
> 
>     *) Security: use-after-free might occur when processing a specially
>        crafted proxied backend response with the ngx_http_ssi_filter_module
>        (CVE-2026-56434).
>        Thanks to P4P3R-HAK.
> 
> https://nginx.org/en/CHANGES-1.30
> 
> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

Applied to master, thanks!

Best regards,

Thomas Petazzoni
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot