The library of the njs scripting language. njs, is a subset of the JavaScript
language that allows extending nginx functionality. njs is created in
compliance with ECMAScript 5.1 (strict mode) with some ECMAScript 6 and later
extensions. The compliance is still evolving.
devel/libnjs: Update to 1.0.2
Fixes memory corruption in RegExp operations, crashes after a failed
module compilation, and excessive resource usage when sorting huge sparse
arrays.
Sponsored by: Netzkommune GmbH
devel/libnjs: Update to 1.0.1
This release contains security fixes: a heap buffer overflow while
parsing namespace prefix lists in XML exclusive canonicalization and a
stack buffer overflow when exporting RSA keys larger than 4096 bits to
JWK in WebCrypto. Upstream has not assigned CVE numbers.
Changes: https://nginx.org/en/docs/njs/changes.html
Sponsored by: Netzkommune GmbH
*/*: update NGINX JavaScript to 0.9.5
Changes with njs 0.9.5
Release Date: 13 January 2026
nginx modules:
Feature: added native module support for qjs engine for http and
stream.
Bugfix: fixed js_body_filter with multiple chunks for qjs engine.
Bugfix: fixed buffer_type inheritance in if blocks for
js_body_filter. Previously, when js_body_filter was used inside an if
(Only the first 15 lines of the commit message are shown above )
*/*: update NGINX JavaScript to 0.9.4
Changes with njs 0.9.4
Release Date: 28 October 2025
nginx modules:
Feature: added HTTP forward proxy support for ngx.fetch() API.
Core:
Bugfix: fixed r.subrequest() to a location with JS handler for
QuickJS. The bug became visible after bellard/quickjs@42eb2795.
Sponsored by: Netzkommune GmbH
*/*: update NGINX JavaScript to 0.9.3
Changes with njs 0.9.3
Release Date: 07 October 2025
nginx modules:
- Bugfix: fixed heap-use-after-free while module loading.
- Bugfix: fixed heap-use-after-free in js_set handler used in log
phase. The issue was introduced in 04f6dfb (0.9.2).
Changes with njs 0.9.2
(Only the first 15 lines of the commit message are shown above )
*/*: update NGINX JavaScript: 0.9.0 -> 0.9.1 (+)
Bump PORTREVISION for www/unit.
<ChangeLog>
nginx modules:
*) Feature: added Fetch API for QuickJS engine.
*) Feature: added state file for a shared dictionary.
*) Bugfix: fixed handling of Content-Length header when
a body is provided for Fetch API.
(Only the first 15 lines of the commit message are shown above )
*/*: update NGINX JavaScript: 0.8.9 -> 0.8.10 (+)
<ChangeLog>
nginx modules:
*) Feature: reading r.requestText or r.requestBuffer from
a temp file.
Previously, an exception was thrown when accessing r.requestText
or r.requestBuffer if a client request body size exceeded
client_body_buffer_size.
*) Improvement: improved reporting of unhandled promise rejections.
*) Bugfix: fixed name corruption in variable and header processing.
(Only the first 15 lines of the commit message are shown above )
*/*: update NGINX JavaScript: 0.8.8 -> 0.8.9 (+)
<ChangeLog>
nginx modules:
*) Bugfix: removed extra VM creation per server.
Previously, when js_import was declared in http or stream blocks,
an extra copy of the VM instance was created for each server
block. This was not needed and consumed a lot of memory for
configurations with many server blocks.
This issue was introduced in 9b674412 (0.8.6) and was partially
fixed for location blocks only in 685b64f0 (0.8.7).
Core:
*) Feature: added fs module for QuickJS engine.
</ChangeLog>
*/*: update NGINX JavaScript: 0.8.5 -> 0.8.7 (+)
<ChangeLog>
Changes with njs 0.8.7 22 Oct 2024
nginx modules:
*) Bugfix: eliminated unnecessary VM creation.
Previously, njs consumed memory proportionally to the number of
nginx locations. The issue was introduced in 9b674412 (0.8.6).
*) Improvement: added strict syntax validation for js_body_filter.
*) Improvement: improved error messages for module loading
(Only the first 15 lines of the commit message are shown above )
*/*: update NGINX JavaScript: 0.8.4 -> 0.8.5 (+)
<ChangeLog>
*) Change: r.variables.var, r.requestText, r.responseText,
s.variables.var, and the "data" argument of the s.on() callback
with "upload" or "download" event types will now convert bytes
invalid in UTF-8 encoding into the replacement character. When
working with binary data, use r.rawVariables.var, r.requestBuffer,
r.responseBuffer, s.rawVariables.var, and the "upstream" or
"downstream" event type for s.on() instead.
*) Feature: added timeout argument for shared dictionary methods
add(), set() and incr().
(Only the first 15 lines of the commit message are shown above )
*/*: update NGINX JavaScript: 0.8.3 -> 0.8.4 (+)
<ChangeLog>
nginx modules:
*) Feature: allowing to set Server header for outgoing headers.
*) Improvement: validating URI and args arguments in r.subrequest().
*) Improvement: checking for duplicate js_set variables.
*) Bugfix: fixed clear() method of a shared dictionary without
timeout introduced in 0.8.3.
*) Bugfix: fixed r.send() with Buffer argument.
Core:
*) Feature: added QuickJS engine support in CLI.
*) Bugfix: fixed atob() with non-padded base64 strings.
</ChangeLog>
*/*: update NGINX JavaScript: 0.8.0 -> 0.8.1 (+)
<ChangeLog>
nginx modules:
*) Feature: introduced js_periodic directive.
The directive specifies a JS handler to run at regular intervals.
*) Feature: implemented items() method for a shared dictionary.
The method returns all the non-expired key-value pairs.
*) Bugfix: fixed size() and keys() methods of a shared dictionary.
*) Bugfix: fixed erroneous exception in r.internalRedirect()
introduced in 0.8.0.
Core:
*) Bugfix: fixed incorrect order of keys in
Object.getOwnPropertyNames().
</ChangeLog>
*/*: update NGINX JavaScript: 0.7.12 -> 0.8.0 (+)
<ChangeLog>
nginx modules:
*) Change: removed special treatment of forbidden headers in Fetch API
introduced in 0.7.10.
*) Change: removed deprecated since 0.5.0 r.requestBody and
r.responseBody in HTTP module.
*) Change: throwing an exception in r.internalRedirect() while
filtering in HTTP module.
(Only the first 15 lines of the commit message are shown above )
*/*: update NGINX JavaScript 0.7.10 -> 0.7.11
While I'm here drop pcre flavor support for lang/njs.
Bump PORTREVISION for www/nginx-devel.
<ChangeLog>
nginx modules:
*) Bugfix: added missed linking with libxml2 for the dynamic module.
The bug was introduced in 0.7.10.
Core:
*) Feature: added XMLNode API to modify XML documents.
(Only the first 15 lines of the commit message are shown above )
devel/libnjs: fix bulk build
[00:01:21] Warning: (devel/libnjs): Error: devel/libnjs has incorrect
CATEGORIES, first should be 'devel'. Please contact maintainer of the port to
fix this.
