Hi, thank you for the report.
The 1.26.3-3+deb13u8 update took particular care to preserve ABI compatibility while backporting the fix for CVE-2026-42533. Unfortunately, the backport added private *.hh headers to ngx_module_deps in auto/modules. These dependencies are propagated to third-party module builds, but the headers are not shipped in nginx-dev. This mismatch caused the reported build failure. I am working on a fix. It should remove the private headers from auto/modules while keeping them available for the internal nginx build. Here: "https://salsa.debian.org/nginx-team/nginx/-/work_items/47"; As a temporary workaround, the incorrect private-header dependencies can be removed from the installed auto/modules file: sed -i \ -e '/src\/http\/ngx_http_script\.hh/d' \ -e '/src\/stream\/ngx_stream_script\.hh/d' \ /usr/share/nginx/src/auto/modules Thanks Jan
