From: Mark Patruck Subject: www/nginx 1.30.6 (fixes 5x CVE) To: Robert Nagy Cc: ports@openbsd.org Date: Wed, 14 Oct 2026 20:58:25 +0200 Update to www/nginx 1.30.6 released few hours ago. - buffer overflow vulnerability when using alias with rewrite (CVE-2026-15176) - buffer overflow vulnerability when evaluating string expressions with variables (CVE-2026-93479) - request body injection vulnerability in HTTP/3 (CVE-2026-95101) - session forgery vulnerability when using TLS session ticket key rotation (CVE-2026-97629) - use-after-free vulnerability when using ngx_http_ssi_module with AIO (CVE-2026-97205) - bug fixes Changelog: https://nginx.org/en/CHANGES-1.30 Index: Makefile =================================================================== RCS file: /cvs/ports/www/nginx/Makefile,v retrieving revision 1.212 diff -u -p -r1.212 Makefile --- Makefile 21 Sep 2026 09:19:36 -0000 1.212 +++ Makefile 14 Oct 2026 18:57:20 -0000 @@ -19,7 +19,7 @@ COMMENT-securelink= nginx HMAC secure li COMMENT-stream= nginx TCP/UDP proxy module COMMENT-xslt= nginx XSLT filter module -VERSION= 1.30.5 +VERSION= 1.30.6 REVISION= 0 DISTNAME= nginx-${VERSION} CATEGORIES= www Index: distinfo =================================================================== RCS file: /cvs/ports/www/nginx/distinfo,v retrieving revision 1.104 diff -u -p -r1.104 distinfo --- distinfo 17 Sep 2026 13:53:58 -0000 1.104 +++ distinfo 14 Oct 2026 18:57:20 -0000 @@ -4,7 +4,7 @@ SHA256 (kvspb-nginx-auth-ldap-83c059b735 SHA256 (leev-ngx_http_geoip2_module-3.4.tar.gz) = rXL8IzSNcVozCZSYRTH6ubNgbhYEgyNnN/mkppV9lFI= SHA256 (libinjection-libinjection-b9fcaaf9e50e9492807b23ffcc6af46ee1f203b9.tar.gz) = CgAuESgzLBvJVgyd+sSv8+sWYk4CnlYDB5CHT+oKi+E= SHA256 (nginx-1.30.0-chroot.patch) = verI7zwpFLZwG4rOIswpPlZUB1if66TDGL3HN2/RUAU= -SHA256 (nginx-1.30.5.tar.gz) = bCBWWqIyXLgiFq6AT0pP8YdReQFHWaOBxC3cjhHEkG0= +SHA256 (nginx-1.30.6.tar.gz) = PPRvXtdQTUYBJYZre+qZ+zV/MdiH4uY7NVAzEOm4tsg= SHA256 (nginx-modules-ngx_http_hmac_secure_link_module-2.0.0.tar.gz) = vu4c/D/6sEJdkwPSNXBKPpxLM39c/clEel8eS4DqdI4= SHA256 (nginx-njs-1.0.0.tar.gz) = Vv5lYFScvLf7V0BTS1QbsVMlDYdyqhasGLww6wzEmN0= SHA256 (openresty-headers-more-nginx-module-v0.40.tar.gz) = wUy15smYWQwgnvv3e9djfOLKsCMy5BknVqivWya6QoQ= @@ -18,7 +18,7 @@ SIZE (kvspb-nginx-auth-ldap-83c059b73566 SIZE (leev-ngx_http_geoip2_module-3.4.tar.gz) = 8877 SIZE (libinjection-libinjection-b9fcaaf9e50e9492807b23ffcc6af46ee1f203b9.tar.gz) = 2218439 SIZE (nginx-1.30.0-chroot.patch) = 8217 -SIZE (nginx-1.30.5.tar.gz) = 1328600 +SIZE (nginx-1.30.6.tar.gz) = 1331698 SIZE (nginx-modules-ngx_http_hmac_secure_link_module-2.0.0.tar.gz) = 29111 SIZE (nginx-njs-1.0.0.tar.gz) = 1011616 SIZE (openresty-headers-more-nginx-module-v0.40.tar.gz) = 29982 -- Mark Patruck ( mark at wrapped.cx ) GPG key 0xF2865E51 / 187F F6D3 EE04 1DCE 1C74 F644 0D3C F66F F286 5E51 https://www.wrapped.cx