Update to www/nginx 1.30.6 released few hours ago.

- buffer overflow vulnerability when using alias with rewrite
   (CVE-2026-15176)

- buffer overflow vulnerability when evaluating string expressions
   with variables (CVE-2026-93479)

- request body injection vulnerability in HTTP/3 (CVE-2026-95101)

- session forgery vulnerability when using TLS session ticket key
   rotation (CVE-2026-97629)

- use-after-free vulnerability when using ngx_http_ssi_module with
   AIO (CVE-2026-97205)

- bug fixes

Changelog: https://nginx.org/en/CHANGES-1.30


Index: Makefile
===================================================================
RCS file: /cvs/ports/www/nginx/Makefile,v
retrieving revision 1.212
diff -u -p -r1.212 Makefile
--- Makefile	21 Sep 2026 09:19:36 -0000	1.212
+++ Makefile	14 Oct 2026 18:57:20 -0000
@@ -19,7 +19,7 @@ COMMENT-securelink=	nginx HMAC secure li
  COMMENT-stream=		nginx TCP/UDP proxy module
  COMMENT-xslt=		nginx XSLT filter module
  
-VERSION=	1.30.5
+VERSION=	1.30.6
  REVISION=	0
  DISTNAME=	nginx-${VERSION}
  CATEGORIES=	www
Index: distinfo
===================================================================
RCS file: /cvs/ports/www/nginx/distinfo,v
retrieving revision 1.104
diff -u -p -r1.104 distinfo
--- distinfo	17 Sep 2026 13:53:58 -0000	1.104
+++ distinfo	14 Oct 2026 18:57:20 -0000
@@ -4,7 +4,7 @@ SHA256 (kvspb-nginx-auth-ldap-83c059b735
  SHA256 (leev-ngx_http_geoip2_module-3.4.tar.gz) = rXL8IzSNcVozCZSYRTH6ubNgbhYEgyNnN/mkppV9lFI=
  SHA256 (libinjection-libinjection-b9fcaaf9e50e9492807b23ffcc6af46ee1f203b9.tar.gz) = CgAuESgzLBvJVgyd+sSv8+sWYk4CnlYDB5CHT+oKi+E=
  SHA256 (nginx-1.30.0-chroot.patch) = verI7zwpFLZwG4rOIswpPlZUB1if66TDGL3HN2/RUAU=
-SHA256 (nginx-1.30.5.tar.gz) = bCBWWqIyXLgiFq6AT0pP8YdReQFHWaOBxC3cjhHEkG0=
+SHA256 (nginx-1.30.6.tar.gz) = PPRvXtdQTUYBJYZre+qZ+zV/MdiH4uY7NVAzEOm4tsg=
  SHA256 (nginx-modules-ngx_http_hmac_secure_link_module-2.0.0.tar.gz) = vu4c/D/6sEJdkwPSNXBKPpxLM39c/clEel8eS4DqdI4=
  SHA256 (nginx-njs-1.0.0.tar.gz) = Vv5lYFScvLf7V0BTS1QbsVMlDYdyqhasGLww6wzEmN0=
  SHA256 (openresty-headers-more-nginx-module-v0.40.tar.gz) = wUy15smYWQwgnvv3e9djfOLKsCMy5BknVqivWya6QoQ=
@@ -18,7 +18,7 @@ SIZE (kvspb-nginx-auth-ldap-83c059b73566
  SIZE (leev-ngx_http_geoip2_module-3.4.tar.gz) = 8877
  SIZE (libinjection-libinjection-b9fcaaf9e50e9492807b23ffcc6af46ee1f203b9.tar.gz) = 2218439
  SIZE (nginx-1.30.0-chroot.patch) = 8217
-SIZE (nginx-1.30.5.tar.gz) = 1328600
+SIZE (nginx-1.30.6.tar.gz) = 1331698
  SIZE (nginx-modules-ngx_http_hmac_secure_link_module-2.0.0.tar.gz) = 29111
  SIZE (nginx-njs-1.0.0.tar.gz) = 1011616
  SIZE (openresty-headers-more-nginx-module-v0.40.tar.gz) = 29982



--
Mark Patruck ( mark at wrapped.cx )
GPG key 0xF2865E51 / 187F F6D3 EE04 1DCE 1C74  F644 0D3C F66F F286 5E51
  
https://www.wrapped.cx