Release announcements and news from the n.wtf repository. Browse posts by tag.
A bug fix release a week after the 1.31.7 security update, with no CVEs. It changes how working_directory resolves relative paths, silences a kernel TLS log alert, and fixes an HTTP/3 crash on strict alignment platforms.
A security release. nginx 1.31.7 fixes five CVEs, including two worker buffer overflows and an HTTP/3 request body bug, and the bundled OpenSSL moves to 4.0.3, which fixes fourteen more.
A security release. Upstream fixes a heap buffer overflow in HTTP/3 that needs an old OpenSSL to trigger, and closes two holes in the predicate location code that shipped two weeks ago.
A feature release. Locations can now match on a variable, request bodies can be read before location matching, and the new JSON module is built into the n.wtf packages.
A quiet release upstream, but the packaging around it changed a lot. Every third-party module is now dynamic, Brotli and Zstd moved to opt-in snippets, and the bundled OpenSSL jumps to 4.0.2.
Upstream fixes three security issues, including a heap buffer overflow in map with regex. Packages are live for all supported releases, upgrade now.
The lowercase name is the software, the all-caps name is a brand, and n.wtf follows the software.