Repository navigation
v5.0.1
·
2 commits
to main
since this release
Immutable
release. Only release title and notes can be modified.
馃攼 Security update for NGINX users
Note
CVEs below are in nginx/nginx upstream, not in this repo. This release only bumps the NGINX we install.
Upstream CVEs (NGINX 1.30.6)
| CVE | nginx | Issue | F5 advisory |
|---|---|---|---|
| CVE-2026-15176 | Med | Buffer overflow when using alias with rewrite |
K000162416 |
| CVE-2026-93479 | Med | Buffer overflow in script evaluation (string expressions with variables) | K000162607 |
| CVE-2026-95101 | Med | Request body injection in HTTP/3 | K000162613 |
| CVE-2026-97629 | Med | Session forgery with TLS session ticket key rotation | K000162606 |
| CVE-2026-97205 | Med | Use-after-free in ngx_http_ssi_module with AIO |
K000162608 |
Fixed in 1.30.6+ stable (1.31.7+ mainline) per nginx.org advisories.
What's Changed
- Security: Update NGINX to 1.30.6 for Alpine and Debian by @jaydrogers
- Updated
SECURITY.mdwith clearer reporting instructions, including where to report vulnerabilities in PHP itself - Updated CI/CD Actions versions to latest versions
Full Changelog: v5.0.0...v5.0.1
Contributors
jaydrogers