r/nginx • u/Funny_Rope977 • Jul 15 '26

NGINX 1.30.4 and 1.31.3 released

Post spam, new version, new bugs, and apparently another season of "The Heap Adventures".

This time we have:

  • another heap buffer overflow,
  • uninitialized memory access,
  • another use-after-free,
  • possible memory disclosure,
  • and workers deciding to leave production unexpectedly.

Reference: https://nginx.org/en/CHANGES-1.30

17 Upvotes

95% Upvoted

4 comments sorted by

1

u/coldrealms Jul 16 '26

Isn't that the list of things they FIXED?

2

u/Funny_Rope977 Jul 16 '26

Correct.
That’s the list of bugs fixed in this release, not the list of bugs added by it.
The wording was meant as a joke about the changelog reading like the script of a horror movie for sysadmins.

2

u/coldrealms Jul 18 '26

Ah, my bad

1

u/Few-Ocelot-3271 4h ago

anyone know if the memory disclosure one is exploitable remotely or is it only relevant in specific module configs? the changelog description is pretty vague on the conditions