From: Stuart Henderson <stu@spacehopper.org>
Subject: Re: www/nginx 1.30.6 (fixes 5x CVE)
To: Mark Patruck <mark@wrapped.cx>
Cc: Robert Nagy <robert@openbsd.org>, ports@openbsd.org
Date: Wed, 14 Oct 2026 21:25:37 +0100

On 2026/10/14 20:58, Mark Patruck wrote:
> Update to www/nginx 1.30.6 released few hours ago.

ok sthen with REVISION dropped (and for OPENBSD_8_0)

> - buffer overflow vulnerability when using alias with rewrite
>   (CVE-2026-15176)
> 
> - buffer overflow vulnerability when evaluating string expressions
>   with variables (CVE-2026-93479)
> 
> - request body injection vulnerability in HTTP/3 (CVE-2026-95101)
> 
> - session forgery vulnerability when using TLS session ticket key
>   rotation (CVE-2026-97629)
> 
> - use-after-free vulnerability when using ngx_http_ssi_module with
>   AIO (CVE-2026-97205)
> 
> - bug fixes
> 
> Changelog: https://nginx.org/en/CHANGES-1.30
> 
> 
> Index: Makefile
> ===================================================================
> RCS file: /cvs/ports/www/nginx/Makefile,v
> retrieving revision 1.212
> diff -u -p -r1.212 Makefile
> --- Makefile	21 Sep 2026 09:19:36 -0000	1.212
> +++ Makefile	14 Oct 2026 18:57:20 -0000
> @@ -19,7 +19,7 @@ COMMENT-securelink=	nginx HMAC secure li
>  COMMENT-stream=		nginx TCP/UDP proxy module
>  COMMENT-xslt=		nginx XSLT filter module
> -VERSION=	1.30.5
> +VERSION=	1.30.6
>  REVISION=	0
>  DISTNAME=	nginx-${VERSION}
>  CATEGORIES=	www
> Index: distinfo
> ===================================================================
> RCS file: /cvs/ports/www/nginx/distinfo,v
> retrieving revision 1.104
> diff -u -p -r1.104 distinfo
> --- distinfo	17 Sep 2026 13:53:58 -0000	1.104
> +++ distinfo	14 Oct 2026 18:57:20 -0000
> @@ -4,7 +4,7 @@ SHA256 (kvspb-nginx-auth-ldap-83c059b735
>  SHA256 (leev-ngx_http_geoip2_module-3.4.tar.gz) = rXL8IzSNcVozCZSYRTH6ubNgbhYEgyNnN/mkppV9lFI=
>  SHA256 (libinjection-libinjection-b9fcaaf9e50e9492807b23ffcc6af46ee1f203b9.tar.gz) = CgAuESgzLBvJVgyd+sSv8+sWYk4CnlYDB5CHT+oKi+E=
>  SHA256 (nginx-1.30.0-chroot.patch) = verI7zwpFLZwG4rOIswpPlZUB1if66TDGL3HN2/RUAU=
> -SHA256 (nginx-1.30.5.tar.gz) = bCBWWqIyXLgiFq6AT0pP8YdReQFHWaOBxC3cjhHEkG0=
> +SHA256 (nginx-1.30.6.tar.gz) = PPRvXtdQTUYBJYZre+qZ+zV/MdiH4uY7NVAzEOm4tsg=
>  SHA256 (nginx-modules-ngx_http_hmac_secure_link_module-2.0.0.tar.gz) = vu4c/D/6sEJdkwPSNXBKPpxLM39c/clEel8eS4DqdI4=
>  SHA256 (nginx-njs-1.0.0.tar.gz) = Vv5lYFScvLf7V0BTS1QbsVMlDYdyqhasGLww6wzEmN0=
>  SHA256 (openresty-headers-more-nginx-module-v0.40.tar.gz) = wUy15smYWQwgnvv3e9djfOLKsCMy5BknVqivWya6QoQ=
> @@ -18,7 +18,7 @@ SIZE (kvspb-nginx-auth-ldap-83c059b73566
>  SIZE (leev-ngx_http_geoip2_module-3.4.tar.gz) = 8877
>  SIZE (libinjection-libinjection-b9fcaaf9e50e9492807b23ffcc6af46ee1f203b9.tar.gz) = 2218439
>  SIZE (nginx-1.30.0-chroot.patch) = 8217
> -SIZE (nginx-1.30.5.tar.gz) = 1328600
> +SIZE (nginx-1.30.6.tar.gz) = 1331698
>  SIZE (nginx-modules-ngx_http_hmac_secure_link_module-2.0.0.tar.gz) = 29111
>  SIZE (nginx-njs-1.0.0.tar.gz) = 1011616
>  SIZE (openresty-headers-more-nginx-module-v0.40.tar.gz) = 29982
> 
> 
> 
> --
> Mark Patruck ( mark at wrapped.cx )
> GPG key 0xF2865E51 / 187F F6D3 EE04 1DCE 1C74  F644 0D3C F66F F286 5E51
> https://www.wrapped.cx
>