# changelog

author: Nginx Packaging <nginx-packaging@f5.com> - 1.27.0-2.sles15.ngx
changelog:
  - Packages were updated to account for a change in CHANGES wording in
    1.27.0. No functional changes.


author: Nginx Packaging <nginx-packaging@f5.com> - 1.31.0-1.sles15.ngx
changelog:
  - 1.31.0-1
  - Security: Security: when using the "proxy_set_body" directive, an attacker
    might inject data in the proxied request to an HTTP/2 backend
    (CVE-2026-42926). Thanks to Mufeed VH of Winfunc Research.
  - Security: Security: a heap memory buffer overflow might occur in a worker
    process while handling a specially crafted request by
    ngx_http_rewrite_module, potentially resulting in arbitrary code execution
    (CVE-2026-42945). Thanks to Leo Lin.
  - Security: Security: a heap memory buffer overread might occur in a worker
    process while handling a specially crafted response by
    ngx_http_scgi_module or ngx_http_uwsgi_module, allowing an attacker to
    cause a disclosure of worker process memory or segmentation fault in a
    worker process (CVE-2026-42946). Thanks to Leo Lin.
  - Security: Security: a heap memory buffer overread might occur in a worker
    process while handling a specially sent response with decoding from UTF-8
    via the "charset_map" directive, allowing an attacker to cause a limited
    disclosure of worker proccess memory or segmentation fault in a worker
    process (CVE-2026-42934). Thanks to David Carlier.
  - Security: Security: when using HTTP/3, processing of connection migration
    might cause new QUIC streams to receive a new client address before
    validation, allowing an attacker to cause address spoofing
    (CVE-2026-40460). Thanks to Rodrigo Laneth.
  - Security: Security: use-after-free might occur during DNS server response
    processing if the "ssl_ocsp" directive was used, allowing an attacker to
    cause worker process memory corruption or segmentation fault in a worker
    process (CVE-2026-40701). Thanks to Leo Lin.


author: Nginx Packaging <nginx-packaging@f5.com> - 1.31.1-1.sles15.ngx
changelog:
  - 1.31.1-1
  - Security: a heap memory buffer overflow might occur in a worker process
    when using a configuration with overlapping captures in
    ngx_http_rewrite_module, potentially resulting in arbitrary code execution
    (CVE-2026-9256). Thanks to Mufeed VH of Winfunc Research.


author: Konstantin Pavlov <thresh@nginx.com> - 1.19.5+0.4.4-1.sles15.ngx
changelog:
  - base version updated to 1.19.5-1
  - Added a patch to fix promise subrequest with error_page redirect


