ngx_http_cache_purge v3.0.4

Security Fixes

• CVE-2026-108981 - Fixed a symlink traversal vulnerability during cache tree traversal. An attacker with the ability to create symbolic links inside the cache directory could potentially cause cache purge operations to delete arbitrary files accessible to the NGINX worker process.

Bug Fixes

• a6da135 Prevented symlink traversal when walking cache trees (#72) - @hsntgm

Security References

• CVE: https://nvd.nist.gov/vuln/detail/CVE-2026-108981
• Fixed version: 3.0.4
• Affected versions: Not yet confirmed
• Severity: Pending assessment