Update to www/nginx 1.30.6 released few hours ago.
- buffer overflow vulnerability when using alias with rewrite
(CVE-2026-15176)
- buffer overflow vulnerability when evaluating string expressions
with variables (CVE-2026-93479)
- request body injection vulnerability in HTTP/3 (CVE-2026-95101)
- session forgery vulnerability when using TLS session ticket key
rotation (CVE-2026-97629)
- use-after-free vulnerability when using ngx_http_ssi_module with
AIO (CVE-2026-97205)
- bug fixes
Changelog: https://nginx.org/en/CHANGES-1.30
Index: Makefile
===================================================================
RCS file: /cvs/ports/www/nginx/Makefile,v
retrieving revision 1.212
diff -u -p -r1.212 Makefile
--- Makefile 21 Sep 2026 09:19:36 -0000 1.212
+++ Makefile 14 Oct 2026 18:57:20 -0000
@@ -19,7 +19,7 @@ COMMENT-securelink= nginx HMAC secure li
COMMENT-stream= nginx TCP/UDP proxy module
COMMENT-xslt= nginx XSLT filter module
-VERSION= 1.30.5
+VERSION= 1.30.6
REVISION= 0
DISTNAME= nginx-${VERSION}
CATEGORIES= www
Index: distinfo
===================================================================
RCS file: /cvs/ports/www/nginx/distinfo,v
retrieving revision 1.104
diff -u -p -r1.104 distinfo
--- distinfo 17 Sep 2026 13:53:58 -0000 1.104
+++ distinfo 14 Oct 2026 18:57:20 -0000
@@ -4,7 +4,7 @@ SHA256 (kvspb-nginx-auth-ldap-83c059b735
SHA256 (leev-ngx_http_geoip2_module-3.4.tar.gz) =
rXL8IzSNcVozCZSYRTH6ubNgbhYEgyNnN/mkppV9lFI=
SHA256
(libinjection-libinjection-b9fcaaf9e50e9492807b23ffcc6af46ee1f203b9.tar.gz) =
CgAuESgzLBvJVgyd+sSv8+sWYk4CnlYDB5CHT+oKi+E=
SHA256 (nginx-1.30.0-chroot.patch) =
verI7zwpFLZwG4rOIswpPlZUB1if66TDGL3HN2/RUAU=
-SHA256 (nginx-1.30.5.tar.gz) = bCBWWqIyXLgiFq6AT0pP8YdReQFHWaOBxC3cjhHEkG0=
+SHA256 (nginx-1.30.6.tar.gz) = PPRvXtdQTUYBJYZre+qZ+zV/MdiH4uY7NVAzEOm4tsg=
SHA256 (nginx-modules-ngx_http_hmac_secure_link_module-2.0.0.tar.gz) =
vu4c/D/6sEJdkwPSNXBKPpxLM39c/clEel8eS4DqdI4=
SHA256 (nginx-njs-1.0.0.tar.gz) = Vv5lYFScvLf7V0BTS1QbsVMlDYdyqhasGLww6wzEmN0=
SHA256 (openresty-headers-more-nginx-module-v0.40.tar.gz) =
wUy15smYWQwgnvv3e9djfOLKsCMy5BknVqivWya6QoQ=
@@ -18,7 +18,7 @@ SIZE (kvspb-nginx-auth-ldap-83c059b73566
SIZE (leev-ngx_http_geoip2_module-3.4.tar.gz) = 8877
SIZE
(libinjection-libinjection-b9fcaaf9e50e9492807b23ffcc6af46ee1f203b9.tar.gz) =
2218439
SIZE (nginx-1.30.0-chroot.patch) = 8217
-SIZE (nginx-1.30.5.tar.gz) = 1328600
+SIZE (nginx-1.30.6.tar.gz) = 1331698
SIZE (nginx-modules-ngx_http_hmac_secure_link_module-2.0.0.tar.gz) = 29111
SIZE (nginx-njs-1.0.0.tar.gz) = 1011616
SIZE (openresty-headers-more-nginx-module-v0.40.tar.gz) = 29982
--
Mark Patruck ( mark at wrapped.cx )
GPG key 0xF2865E51 / 187F F6D3 EE04 1DCE 1C74 F644 0D3C F66F F286 5E51
https://www.wrapped.cx
