nginx-1.31.8 mainline version has been released.

See official CHANGES on nginx.org.

Below is a release summary generated by GitHub.

• Version bump by @pluknet in https://github.com/nginx/nginx/pull/1846
• HTTP/3: avoid undefined behaviour with empty encoder field values by @dgprivate in https://github.com/nginx/nginx/pull/1701
• Win32: removed the iocp event module by @VadimZhestikov in https://github.com/nginx/nginx/pull/1823
• Control: logged errors from accepted socket setup. by @OskarEichler in https://github.com/nginx/nginx/pull/1720
• Dav: restored the request URI on a destination mapping error by @VadimZhestikov in https://github.com/nginx/nginx/pull/1778
• SSL: ignored EIO after shutdown with kernel TLS by @VadimZhestikov in https://github.com/nginx/nginx/pull/1788
• SSL: workaround for i2d_SSL_SESSION() negative values by @VadimZhestikov in https://github.com/nginx/nginx/pull/1599
• Control API: use more portable ioctl(FIOASYNC) by @bavshin-f5 in https://github.com/nginx/nginx/pull/1819
• Fixed Priority parsing of large integers on 32-bit platforms by @nishat-06 in https://github.com/nginx/nginx/pull/1814
• JSON: parser API refactoring. by @ensh63 in https://github.com/nginx/nginx/pull/1806
• Fixed a typo by @osokin in https://github.com/nginx/nginx/pull/1857
• GH: workflow to generate windows zip by @saikrishnakumarreddy in https://github.com/nginx/nginx/pull/1815
• GH: request an id token and pass secrets to a callee in buildbot.yml by @thresheek in https://github.com/nginx/nginx/pull/1804
• Misc: fixed "zip" target with GNU sed by @pluknet in https://github.com/nginx/nginx/pull/1859
• HTTP/3: avoid unaligned stores in Huffman encoding by @daewoo1109 in https://github.com/nginx/nginx/pull/1317
• working_directory fixes by @pluknet in https://github.com/nginx/nginx/pull/1855
• nginx-1.31.8-RELEASE by @pluknet in https://github.com/nginx/nginx/pull/1886

• @dgprivate made their first contribution in https://github.com/nginx/nginx/pull/1701
• @OskarEichler made their first contribution in https://github.com/nginx/nginx/pull/1720
• @ensh63 made their first contribution in https://github.com/nginx/nginx/pull/1806
• @osokin made their first contribution in https://github.com/nginx/nginx/pull/1857
• @daewoo1109 made their first contribution in https://github.com/nginx/nginx/pull/1317

Full Changelog: https://github.com/nginx/nginx/compare/release-1.31.7...release-1.31.8

• [SECURITY] Container images: Update CA certificates to distrust "emSign ECC Root CA - G3" and "Comodo AAA Services root" following the compromise of eMudhra intermediate CA private keys.
• [SECURITY] Build with Go 1.27.3 to fix vulnerabilities in net/http, net/textproto, crypto/tls and html/template.
• [SECURITY] Bump golang.org/x/net to v0.60.0 to fix HTTP/2 vulnerabilities (GO-2026-6603, GO-2026-6610, GO-2026-6611, GO-2026-6612, GO-2026-6617).

• [SECURITY] Container images: Update CA certificates to distrust "emSign ECC Root CA - G3" and "Comodo AAA Services root" following the compromise of eMudhra intermediate CA private keys.
• [SECURITY] Build with Go 1.26.10 to fix vulnerabilities in net/http, net/textproto, crypto/tls and html/template.
• [SECURITY] Bump golang.org/x/net to v0.60.0 to fix HTTP/2 vulnerabilities (GO-2026-6603, GO-2026-6610, GO-2026-6611, GO-2026-6612, GO-2026-6617).
• [SECURITY] Bump OpenTelemetry to v1.45.0 to fix exporter endpoint URLs leaking into info logs (GO-2026-6505).
• [CHANGE] Building Prometheus now requires Go 1.26 or later.

This is a security release.

• (CVE-2026-105481) http: ensure agent data guard works without I/O (James M Snell)
• (CVE-2026-105482) dns: validate resolve inputs for null bytes (James M Snell)
• (CVE-2026-106069) tls: reject non-canonical IP addresses (Matteo Collina)
• (CVE-2026-106073) permission: check permission model in realpathSync (RafaelGSS)
• (CVE-2026-106074) crypto: reset random caches across snapshots (Filip Skokan)
• (CVE-2026-111497) src: expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (Antoine du Hamel)
• (CVE-2026-111497) deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov)
• crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel)
• deps: update c-ares to 1.34.9 (Node.js GitHub Bot)
• deps: update timezone to 2026e (Node.js GitHub Bot)
• deps: upgrade openssl sources to openssl-3.5.9 (Node.js GitHub Bot)
• deps: update sqlite to 3.53.4 (Node.js GitHub Bot)
• deps: update undici to 6.29.1 (Node.js GitHub Bot)

• [68fa0df6d6] - crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel) #66877
• [dd6b47573b] - crypto: reset random caches across snapshots (Filip Skokan) nodejs-private/node-private#987
• [a62b7d5362] - crypto: harden X.509 conversion and formatting (Filip Skokan) nodejs-private/node-private#966
• [ec9e5e4a3e] - crypto: update root certificates to NSS 3.129 (Node.js GitHub Bot) #66496
• [a538a9515d] - deps: update c-ares to 1.34.9 (Node.js GitHub Bot) #66868
• [67d294739f] - deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov) nodejs-private/node-private#1002
• [1ab9db8a74] - deps: update timezone to 2026e (Node.js GitHub Bot) #66419
• [52b4bcab03] - deps: update timezone to 2026d (Node.js GitHub Bot) #66333
• [60f4833d41] - deps: update archs files for openssl-3.5.9 (Node.js GitHub Bot) #66396
• [05470dc308] - deps: upgrade openssl sources to openssl-3.5.9 (Node.js GitHub Bot) #66396
• [47333fe4f4] - deps: update sqlite to 3.53.4 (Node.js GitHub Bot) #64745
• [98258b855f] - deps: update sqlite to 3.53.3 (Node.js GitHub Bot) #64180
• [a8349b6408] - deps: update sqlite to 3.53.2 (Node.js GitHub Bot) #63774
• [e9e295bcc1] - deps: cherry-pick e807d4e379 from SQLite (Junsu Han) #63525
• [512a9b61f0] - deps: update sqlite to 3.53.1 (Node.js GitHub Bot) #63217
• [e708247254] - deps: update sqlite to 3.53.0 (Node.js GitHub Bot) #62699
• [857be5afa3] - deps: update undici to 6.29.1 (Node.js GitHub Bot) #66765
• [19c5056002] - dns: validate resolve inputs for null bytes (James M Snell) nodejs-private/node-private#984
• [e7b2985d59] - http: ensure agent data guard works without I/O (James M Snell) nodejs-private/node-private#983
• [50ab804edc] - permission: check permission model in realpathSync (RafaelGSS) nodejs-private/node-private#973
• [a18ec92752] - src: expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (Antoine du Hamel) nodejs-private/node-private#1002
• [4342503fd8] - tls: reject chains containing blocked public keys (Ulises Gascon) #66871
• [d7663560ac] - tls: reject non-canonical IP addresses (Matteo Collina) nodejs-private/node-private#982
• [beb4cd4cd3] - tls: match IPv6 hosts against IP-Address SANs (Pascal Garber) #64145
• [4b42e56aaf] - tools: retry Gatekeeper check and stapling after notarization (Ryan Aslett) #66855

This is a security release.

• (CVE-2026-105481) http: ensure agent data guard works without I/O (James M Snell)
• (CVE-2026-105482) dns: validate resolve inputs for null bytes (James M Snell)
• (CVE-2026-105483) tls: fix ip normalization regression (James M Snell)
• (CVE-2026-106069) tls: reject non-canonical IP addresses (Matteo Collina)
• (CVE-2026-106073) permission: check permission model in realpathSync (RafaelGSS)
• (CVE-2026-106074) crypto: reset random caches across snapshots (Filip Skokan)
• (CVE-2026-111497) src: expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (Antoine du Hamel)
• (CVE-2026-111497) deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov)
• crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel)
• deps: update c-ares to 1.34.9 (Node.js GitHub Bot)
• deps: update timezone to 2026e (Node.js GitHub Bot)
• deps: upgrade openssl sources to openssl-3.5.9 (Node.js GitHub Bot)
• deps: update undici to 7.30.1 (Node.js GitHub Bot)

• [2a73ee5a89] - crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel) #66877
• [4d6990b33c] - crypto: reset random caches across snapshots (Filip Skokan) nodejs-private/node-private#987
• [4b3c9bbf9f] - crypto: harden X.509 conversion and formatting (Filip Skokan) nodejs-private/node-private#1007
• [9243b105b6] - crypto: update root certificates to NSS 3.129 (Node.js GitHub Bot) #66496
• [1e39cd53c7] - deps: update c-ares to 1.34.9 (Node.js GitHub Bot) #66868
• [49dff6f57a] - deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov) nodejs-private/node-private#1002
• [fca511adc5] - deps: V8: backport 93cd21e8254b (Joyee Cheung) nodejs-private/node-private#1008
• [18711c7567] - deps: update timezone to 2026e (Node.js GitHub Bot) #66419
• [fa77cfb1ad] - deps: update timezone to 2026d (Node.js GitHub Bot) #66333
• [b84f9f186b] - deps: update archs files for openssl-3.5.9 (Node.js GitHub Bot) #66396
• [ff0664c3ba] - deps: upgrade openssl sources to openssl-3.5.9 (Node.js GitHub Bot) #66396
• [1d4c89ef87] - deps: update undici to 7.30.1 (Node.js GitHub Bot) #66764
• [843a1627dc] - dns: validate resolve inputs for null bytes (James M Snell) nodejs-private/node-private#984
• [96c3ccb1fc] - http: ensure agent data guard works without I/O (James M Snell) nodejs-private/node-private#983
• [8dc18a6218] - permission: check permission model in realpathSync (RafaelGSS) nodejs-private/node-private#973
• [b5f41529df] - src: expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (Antoine du Hamel) nodejs-private/node-private#1002
• [01acf0ee74] - tls: reject chains containing blocked public keys (Ulises Gascón) #66871
• [935918e342] - tls: reject non-canonical IP addresses (Matteo Collina) nodejs-private/node-private#982
• [de49c913f2] - tls: fix ip normalization regression (James M Snell) nodejs-private/node-private#985
• [9dc4bb57f0] - tools: retry Gatekeeper check and stapling after notarization (Ryan Aslett) #66855

This is a security release.

• (CVE-2026-106069, CVE-2026-106072) tls: reject non-canonical IP addresses (Matteo Collina) – High
• (CVE-2026-105482) dns: validate resolve inputs for null bytes (James M Snell) – High
• (CVE-2026-105483) tls: fix ip normalization regression (James M Snell) – High
• (CVE-2026-111497) src: expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (Antoine du Hamel) – High
• (CVE-2026-111497) deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov) – High
• (CVE-2026-105481) http: ensure agent data guard works without I/O (James M Snell) – Medium
• (CVE-2026-106074) crypto: reset random caches across snapshots (Filip Skokan) – Medium
• (CVE-2026-106070) zlib: avoid caching invalid ZIP local headers (Matteo Collina) – Low
• (CVE-2026-106071) src: fix the fs permission tree node on wildcard nodes (James M Snell) – Low
• (CVE-2026-106073) permission: check permission model in realpathSync (RafaelGSS) – Low
• deps: V8: backport 93cd21e8254b (Joyee Cheung)
• crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel)
• tls: reject chains containing blocked public keys (Ulises Gascon)
• deps: update c-ares to 1.34.9 (Node.js GitHub Bot)
• tools: retry Gatekeeper check and stapling after notarization (Ryan Aslett)
• crypto: harden X.509 conversion and formatting (Filip Skokan)

• [818e4ca061] - crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel) #66877
• [fd3c87ed43] - crypto: harden X.509 conversion and formatting (Filip Skokan) nodejs-private/node-private#966
• [acffa610db] - crypto: reset random caches across snapshots (Filip Skokan) nodejs-private/node-private#987
• [7895a5cd2d] - deps: update undici to 8.12.2 (Node.js GitHub Bot) #66721
• [12daa54d2e] - deps: V8: backport 93cd21e8254b (Joyee Cheung) nodejs-private/node-private#999
• [6a8b3db7e2] - deps: update c-ares to 1.34.9 (Node.js GitHub Bot) #66868
• [a6040b50d9] - deps: brotli: cherry-pick 0ed4268a4401abcb44720963 (Evgenii Kliuchnikov) nodejs-private/node-private#1002
• [6b78ea171d] - dns: validate resolve inputs for null bytes (James M Snell) nodejs-private/node-private#984
• [0683ee5f7d] - http: ensure agent data guard works without I/O (James M Snell) nodejs-private/node-private#983
• [e5cae10148] - Revert "module: synchronously load most ES modules" (Antoine du Hamel) #66786
• [cc244131aa] - permission: check permission model in realpathSync (RafaelGSS) nodejs-private/node-private#973
• [0392385841] - src: expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (Antoine du Hamel) nodejs-private/node-private#1002
• [c273a408c9] - src: fix the fs permission tree node on wildcard nodes (James M Snell) nodejs-private/node-private#986
• [a2caddd20e] - tls: reject chains containing blocked public keys (Ulises Gascon) #66871
• [ad788ccd07] - tls: reject non-canonical IP addresses (Matteo Collina) nodejs-private/node-private#982
• [cd4b05469c] - tls: fix ip normalization regression (James M Snell) nodejs-private/node-private#985
• [5fa440e0d7] - tools: retry Gatekeeper check and stapling after notarization (Ryan Aslett) #66855
• [745ad77156] - zlib: avoid caching invalid ZIP local headers (Matteo Collina) nodejs-private/node-private#981