nginx-1.31.7 mainline version has been released, with fixes for buffer overflow vulnerability when using alias with rewrite (CVE-2026-15176), buffer overflow vulnerability when evaluating string expressions with variables (CVE-2026-93479), request body injection vulnerability in HTTP/3 (CVE-2026-95101), session forgery vulnerability when using TLS session ticket key rotation (CVE-2026-97629), and use-after-free vulnerability when using ngx_http_ssi_module with AIO (CVE-2026-97205).

See official CHANGES on nginx.org.

Below is a release summary generated by GitHub.

What's Changed

• Dav: destination validation for COPY and MOVE with "alias" by @VadimZhestikov in #1764
• Version bump by @pluknet in #1773
• SSL: set c->error on connection reset SSL_read() error. by @pluknet in #1271
• SSL: support for iPAddress subjectAltName in certificates. by @jimf5 in #1264
• Rejected zero size in buffer-size directives. by @sbhowmikf5 in #1644
• HTTP/2: implement RFC 9218 Extensible Prioritization Scheme for HTTP by @ac000 in #1520
• QUIC: support BPF reload and binary upgrade by @saikrishnakumarreddy in #1756
• QUIC: fixed binary upgrade from older versions by @route443 in #1813
• Updated OpenSSL and PCRE used for win32 builds by @pluknet in #1816
• GeoIP2: support for GeoIP2 http & stream modules by @nitin9977 in #1655

Full Changelog: release-1.31.6...release-1.31.7