Three vulnerabilities are fixed, all in the worker process:
map directive with regex matching feeds a string expression, and a similar case with non-cacheable variables. This is the one to take seriously; map with regex is everywhere.slice directive or background cache updates. Upstream says it can disclose worker memory or crash the worker.If your config uses map with regex captures, slice, proxy caching, or SSI, treat the upgrade as urgent. Everyone else should not wait either; the full details are public in the upstream release notes.
Beyond the security fixes, 1.31.3 rejects HTTP/2 requests with out-of-order pseudo-headers, disables external entity loading in the XSLT filter by default (with a new xml_external_entities directive to turn it back on), and adds *_socket_sndbuf / *_socket_rcvbuf directives for tuning upstream socket buffers across the proxy, FastCGI, gRPC, SCGI, and uWSGI modules.
sudo apt update
sudo apt full-upgrade
nginx -v
# nginx version: nginx-n.wtf/1.31.3
full-upgrade lets apt add or remove dependencies when the package set changes between releases; plain apt upgrade can hold nginx back in that case.
Not on the repository yet? The install page has extrepo, one-line, DEB822, and Docker instructions.
]]>Both pages are official. They just name different things. The lowercase spelling is the name of the open-source server, chosen by its author and used consistently by the project itself. The all-caps spelling is a commercial brand that now belongs to F5. n.wtf packages the server, so this site writes nginx.
Igor Sysoev released nginx in 2004, and the project has written the name in lowercase ever since. nginx.org uses it throughout, including at sentence starts, and the CHANGES file for every release does the same. Netcraft looked at this exact question in a 2018 piece, "nginx, Nginx, NGiИX, or NGINX?!", and noted that the lowercase form also appeared in the HTTP Server headers of the 447 million sites running it at the time.
A stock installation still answers the same way. nginx.org itself, for example:
curl -sI https://nginx.org/ | grep -i '^server'
# Server: nginx/1.29.8
The ecosystem inherited the casing. The binary is /usr/sbin/nginx, the Debian and Ubuntu package is nginx, the config test command is nginx -t, and the packages from this repository identify themselves as nginx-n.wtf in nginx -V output. Nothing in the software itself ever prints NGINX. This site's own header says Server: n.wtf instead, set with the headers-more module, but that is us overriding the default, not the default.
The all-caps form arrived with commercialization. Nginx, Inc. was founded in 2011 to build a business around the server, later selling NGINX Plus, and it stylized the name as NGINX in its marketing. As the Netcraft piece points out, the company at one point drew the distinction itself: the company was "Nginx", the server it promoted was "NGINX". After F5 completed its acquisition of the company in May 2019, the brand followed, which is why every product on the F5 site today is NGINX-something.
The logo sidesteps the question entirely. It spells NGiИX with a mirrored Cyrillic И, a nod to the project's Russian origins, and matches neither spelling.
None of this is a complaint. F5 owns the NGINX trademark and can style its products however it likes. It just means the capitals mark F5's commercial line: NGINX Plus, NGINX One, NGINX Gateway Fabric. The server that Debian, Ubuntu, and this repository ship is the open-source project from nginx.org, and that project calls itself nginx.
This site follows upstream. Prose says nginx, lowercase, sentence start included. Package names, commands, and version strings are lowercase because that is what the software actually emits. The all-caps form appears in exactly one place: the trademark notice in the footer, because a trademark should be written the way its owner registered it.
If you upgrade through this repository, the casing question answers itself every time you check a version:
nginx -v
# nginx version: nginx-n.wtf/1.31.3
The software tells you its own name.
]]>