Below is the auto-generated changelog, which includes all PRs that went into the release.
For a shorter version that highlights only important changes, see CHANGELOG.md.
What's Changed
Security
- Extend validation for OIDC extra args in AuthenticationFilter and Server Tokens in NginxProxy by @ciarams87 in #5467. This addresses CVE-2026-11311
- Extend validation for Access Log Format in NginxProxy by @ciarams87 in #5467. This addresses CVE-2026-50107
- Fix GRPCRoute BackendRef filter panic by @ciarams87 in #5467. This addresses CVE-2026-32682
🐛 Bug Fixes
- Fixes a bug where live gateway resources were incorrectly deleted after leader failover, causing traffic disruption by @salonichf5 in #5451
📦 Helm Chart
- Release 2.6.4 by @github-actions[bot] in #5464
🔨 Maintenance
- Bump to the latest preflight in release branch by @ciarams87 in #5366
- Update NGINX Agent to v3.11.1 (#5462) by @ciarams87 in #5465
Other Changes
- Operator Bundle v1.4.3 by @nginx-bot in #5369
Full Changelog: v2.6.3...v2.6.4
Contributors
ciarams87, nginx-bot, and salonichf5