marciocavalante-rdstation opened a new issue, #14121: URL: https://github.com/apache/apisix/issues/14121
### Current Behavior As per [NGINX Security Advisories](https://nginx.org/en/security_advisories.html) and [OpenResty 1.31.8.1 release announcement list of fixes incorporated from NGINX](https://openresty.org/en/ann-1031008001.html#version-highlights), APISIX latest to date (3.19.0) and master branch versions are suitable to several critical NGINX vulnerabilities: 3.19.0 (latest) - openresty/1.29.2.4: [CVE-2026-42055](https://www.cve.org/CVERecord?id=CVE-2026-42055) [CVE-2026-48142](https://www.cve.org/CVERecord?id=CVE-2026-48142) [CVE-2026-42533](https://www.cve.org/CVERecord?id=CVE-2026-42533) [CVE-2026-60005](https://www.cve.org/CVERecord?id=CVE-2026-60005) [CVE-2026-56434](https://www.cve.org/CVERecord?id=CVE-2026-56434) [CVE-2026-90439](https://www.cve.org/CVERecord?id=CVE-2026-90439) [CVE-2026-15176](https://www.cve.org/CVERecord?id=CVE-2026-15176) [CVE-2026-97205](https://www.cve.org/CVERecord?id=CVE-2026-97205) [CVE-2026-97629](https://www.cve.org/CVERecord?id=CVE-2026-97629) [CVE-2026-95101](https://www.cve.org/CVERecord?id=CVE-2026-95101) [CVE-2026-93479](https://www.cve.org/CVERecord?id=CVE-2026-93479) Master branch version (according to PR #14041 ) - openresty/1.31.1.1: [CVE-2026-42530](https://www.cve.org/CVERecord?id=CVE-2026-42530) [CVE-2026-42055](https://www.cve.org/CVERecord?id=CVE-2026-42055) [CVE-2026-48142](https://www.cve.org/CVERecord?id=CVE-2026-48142) [CVE-2026-42533](https://www.cve.org/CVERecord?id=CVE-2026-42533) [CVE-2026-60005](https://www.cve.org/CVERecord?id=CVE-2026-60005) [CVE-2026-56434](https://www.cve.org/CVERecord?id=CVE-2026-56434) [CVE-2026-90439](https://www.cve.org/CVERecord?id=CVE-2026-90439) [CVE-2026-15176](https://www.cve.org/CVERecord?id=CVE-2026-15176) [CVE-2026-97205](https://www.cve.org/CVERecord?id=CVE-2026-97205) [CVE-2026-97629](https://www.cve.org/CVERecord?id=CVE-2026-97629) [CVE-2026-95101](https://www.cve.org/CVERecord?id=CVE-2026-95101) [CVE-2026-93479](https://www.cve.org/CVERecord?id=CVE-2026-93479) - despite being in the OpenResty list of fixes, this shouldn't affect NGINX 1.31.1.1 anyway. ### Expected Behavior OpenResty updated to version 1.31.8.1+, incorporating the already available NGINX critical fixes for the CVEs listed in this issue. ### Error Logs _No response_ ### Steps to Reproduce N/A ### Environment - APISIX version: 3.19.0 - Operating system: Linux apisix 6.12.85+ #1 SMP Wed Jun 17 20:13:06 UTC 2026 x86_64 GNU/Linux - OpenResty / Nginx version: openresty/1.29.2.4 - etcd version, if relevant : not relevant - APISIX Dashboard version, if relevant: not relevant - Plugin runner version, for issues related to plugin runners: N/A - LuaRocks version, for installation issues: not relevant -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
