The ModSecurity-nginx connector is the connection point between Nginx and libmodsecurity
(ModSecurity v3). Said another way, this project provides a communication channel between Nginx
and libmodsecurity. This connector is required to use LibModSecurity with Nginx.
The ModSecurity-nginx connector takes the form of an Nginx module.
The module simply serves as a layer of communication between Nginx and ModSecurity.
Notice that this project depends on libmodsecurity rather than ModSecurity (version 2.9 or less).
security/modsecurity3-nginx: Update to 1.0.4.20260926
Pin the connector at the same commit as www/nginx-module-modsecurity3, so
that both ways of building this module use the same source.
While here: WWW named the SpiderLabs repository, which moved to
owasp-modsecurity, and COMMENT said "Instruction detection".
Sponsored by: Netzkommune GmbH
security/modsecurity3-nginx: Chase the nginx update to 1.30.5
Read the version from www/nginx/version.mk instead of keeping a copy,
so the port follows the nginx updates on its own.
Sponsored by: Netzkommune GmbH
security/modsecurity3-nginx: Switch to the owasp-modsecurity account
The ModSecurity-nginx repository now lives in the owasp-modsecurity
organisation; the SpiderLabs path only works through GitHub's redirect.
Move the pin from e6a568a to 9eb44fd, the current master, which is what the
nginx ports use as well.
Sponsored by: Netzkommune GmbH
www/nginx: Update to 1.30.4
Changes:
*) Security: heap buffer overflow when using the map directive with
regex matching (CVE-2026-42533)
*) Security: uninitialized memory access when using unnamed regex
captures with the "slice" directive or background cache update
(CVE-2026-60005)
*) Security: use-after-free when processing a specially crafted
proxied backend response with the ngx_http_ssi_filter_module
(CVE-2026-56434)
Release Notes: https://nginx.org/en/CHANGES-1.30
Security: 56feeac6-8263-11f1-92ba-bc24110523fe
Security: CVE-2026-42533
Security: CVE-2026-56434
Security: CVE-2026-60005
PR: 296830
Sponsored by: Netzkommune GmbH
www/nginx: Update to 1.30.2
hanges with nginx 1.30.2 22 May
2026
*) Security: a heap memory buffer overflow might occur in a worker
process when using a configuration with overlapping captures in
ngx_http_rewrite_module, potentially resulting in arbitrary code
execution (CVE-2026-9256).
Thanks to Mufeed VH of Winfunc Research.
PR: 295498
Sponsored by: Netzkommune GmbH
www/nginx: Update to 1.28.3
Changes with nginx 1.28.3 24 Mar
2026
*) Security: a buffer overflow might occur while handling a COPY or
MOVE
request in a location with "alias", allowing an attacker to
modify
the source or destination path outside of the document root
(CVE-2026-27654).
Thanks to Calif.io in collaboration with Claude and Anthropic
Research.
*) Security: processing of a specially crafted mp4 file by the
(Only the first 15 lines of the commit message are shown above )
security/(modsecurity3|modsecurity-nginx) : switch to PCRE2 and fix NGINX
version
Change PCRE to PCRE2.
Update NGINX version to 1.28.2.
PR: 293279
Sponsored by: Netzkommune GmbH
security/modsecurity3-nginx: update to latest 1.0.4 snapshot
Upstream continues to receive fixes and small improvements after the
1.0.4 release. Switch the GitHub fetch from the 1.0.4 tag to commit
b94f2d3 and bump PORTREVISION accordingly.
Sponsored by: Netzkommune GmbH
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
(Only the first 15 lines of the commit message are shown above )
security/modsecurity3-nginx: Update to 1.0.3
Changelog:
Support http protocol versions besides 0.9, 1.0, 1.1, 2.0
[Issue #224 - @HQuest, @martinhsv]
Support for building with nginx configured with PCRE2
[Issue #260 - @defanator]
Sponsored by: Netzkommune GmbH
security/modsecurity3-nginx: Update to 1.0.2
Changelog:
- Fix auditlog in case of internal redirect
- Fix nginx sends response without headers
- Fix nginx not clearing body cache
- Fix config setting not respected: client_body_in_file_only on
- Fix audit_log not generated for disruptive actions
- Exit more gracefully if uri length is zero
Sponsored by: Netzkommune GmbH
Mark Broken on armv6
configuring additional dynamic modules
adding module in
/wrkdirs/usr/ports/security/modsecurity3-nginx/work/ModSecurity-nginx-1.0.1
checking for ModSecurity library ... not found
checking for ModSecurity library in /usr/local/modsecurity ... not found
./configure: error: ngx_http_modsecurity_module requires the ModSecurity
library.
===> Script "configure" failed unexpectedly.
Sponsored by: Netzkommune GmbH
Bump PORTREVISION for ports depending on the canonical version of GCC
as defined in Mk/bsd.default-versions.mk which has moved from GCC 8.3
to GCC 9.1 under most circumstances now after revision 507371.
This includes ports
- with USE_GCC=yes or USE_GCC=any,
- with USES=fortran,
- using Mk/bsd.octave.mk which in turn features USES=fortran, and
- with USES=compiler specifying openmp, nestedfct, c11, c++0x, c++11-lang,
c++11-lib, c++14-lang, c++17-lang, or gcc-c++11-lib
plus, everything INDEX-11 shows with a dependency on lang/gcc9 now.
PR: 238330
New Port: security/modsecurity-nginx
The ModSecurity-nginx connector is the connection point between Nginx and
libmodsecurity
(ModSecurity v3). Said another way, this project provides a communication
channel between Nginx
and libmodsecurity. This connector is required to use LibModSecurity with Nginx.
The ModSecurity-nginx connector takes the form of an Nginx module.
The module simply serves as a layer of communication between Nginx and
ModSecurity.
Notice that this project depends on libmodsecurity rather than ModSecurity
(version 2.9 or less).
WWW: https://github.com/SpiderLabs/ModSecurity-nginx
Sponsored by: Netzkommune GmbH
