NGINX is a high performance edge web server with the lowest memory footprint
and the key features to build modern and efficient web infrastructure.
NGINX functionality includes HTTP server, HTTP and mail reverse proxy, caching,
load balancing, compression, request throttling, connection multiplexing and
reuse, SSL offload and HTTP media streaming.
See also: https://nginx.org/
Reason:
Following the rename of security/openssl35 to security/openssl, the
HTTPV3_OSSL35 option has been renamed to HTTPV3_OSSL.
The saved setting does not carry over. If you had the old option
enabled, select the new one and rebuild the port:
# make -C /usr/ports/www/nginx-devel config
Number of commits found: 1304 (showing only 100 on this page) #
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Build the auth_ldap module from its own source port, and add the
cert_expiry, ip_anon, stream limit_req and syslog5424 modules.
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Build the memc, encrypted_session, fancyindex, auth_pam and geoip2 modules
from their own source ports.
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Build the iconv and json_status modules from their own source ports.
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: Drop the pcre1 dependency
Nothing calls a pcre1 symbol; modsecurity3 itself is built with pcre2.
The slave ports kept listing PCRE_ONE, an option that no longer exists.
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: Bump PORTREVISION for the module updates
The cache_purge, njs and lua modules are built into these ports, and a
BUILD_DEPENDS does not rebuild them by itself.
Sponsored by: Netzkommune GmbH
www/nginx-devel: Security update to 1.31.7
The same five security fixes as 1.30.6: CVE-2026-15176, CVE-2026-93479,
CVE-2026-95101, CVE-2026-97629 and CVE-2026-97205.
1.31.7 also lets the bundled geoip modules read MaxMind DB databases, which
the new HTTP_GEOIP and STREAM_GEOIP options enable; both are off by default
and pull net/libmaxminddb.
https://nginx.org/en/CHANGES
Security: CVE-2026-15176
Security: CVE-2026-93479
Security: CVE-2026-95101
Security: CVE-2026-97629
Security: CVE-2026-97205
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: Mark the MODSECURITY3 conflict
The option builds the same module from the same source into the same path
as security/modsecurity3-nginx. A build now stops with the name of the
package it collides with instead of overwriting its file.
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Build the accept_language, aws_auth, fips_check, modsecurity3 and sts
modules from their own source ports instead of fetching them with
GH_TUPLE.
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Build the gridfs, postgres, redis2 and sflow modules from their own
source ports instead of fetching them with GH_TUPLE.
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
- Announce the removal of the HTTP_NOTICE option after 2026-12-31.
nginx can return a fixed body itself.
- Announce the removal of the HTTP_UPSTREAM_STICKY option after
2026-12-31 in nginx and nginx-devel. nginx has its own sticky
directive since 1.29.6, freenginx does not.
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Announce the removal of the HTTP_UPSTREAM_FAIR option after 2026-12-31.
nginx can balance by least connections itself.
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Build the let, slowfs_cache, websockify and zstd modules from their own
source ports instead of fetching them with GH_TUPLE.
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Use the new www/nginx-module-ajp source port instead of fetching
nginx_ajp_module from GitHub.
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Fix three defects in the body filter of the zstd module. A worker spins
at 100% CPU forever when an empty flush buffer arrives and the compressor
has nothing left to flush. A response is truncated at 131072 bytes when
a single input buffer larger than that carries last_buf. An output
buffer that is already full when ZSTD_endStream() is due gets dropped.
Upstream has not taken a code change since April 2024.
PR: 299100
Sponsored by: Netzkommune GmbH
www/nginx-devel: Add NJS_QJS and NJS_XML options
The port pulled quickjs, libxml2 and libxslt unconditionally with NJS
and always built the QuickJS engine. Split this into the NJS_QJS and
NJS_XML options, so that www/nginx, www/nginx-devel and www/freenginx
offer the same set.
Sponsored by: Netzkommune GmbH
www/nginx*: Security update to 1.30.5 and 1.31.6
Changes with nginx 1.30.5 15 Sep 2026
*) Security: a heap memory buffer overflow might occur in a worker
process under certain configurations when using HTTP/3 with OpenSSL
3.5.0 and earlier (CVE-2026-90439).
Thanks to Banny Liao.
*) Change: now the QUIC transport parameters extension received in an
SSL connection is always ignored.
Changes with nginx 1.31.6 15 Sep 2026
*) Security: a heap memory buffer overflow might occur in a worker
(Only the first 15 lines of the commit message are shown above )
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Use the new www/nginx-module-vod source port instead of fetching
nginx-vod-module from GitHub.
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Bump PORTREVISION so the packages pick up the fixed lua, cache_purge
and njs module sources.
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Use the new www/nginx-module-form-input source port instead of fetching
form-input-nginx-module from GitHub. The module version is now
maintained in one place for these ports.
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Use the new www/nginx-module-cache-purge source port instead of
fetching ngx_cache_purge from GitHub. The module version is now
maintained in one place for these ports.
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Use the new www/nginx-module-array-var source port instead of fetching
array-var-nginx-module from GitHub. The module version is now
maintained in one place for these ports.
Sponsored by: Netzkommune GmbH
www/nginx-devel: Update to 1.31.5
Changes with nginx 1.31.5 02 Sep
2026
*) Feature: control API.
*) Feature: predicate locations.
*) Feature: the ngx_http_json_module.
*) Feature: the "client_body_early_read" directive.
*) Bugfix: use-after-free might occur in a worker process if
proxying
(Only the first 15 lines of the commit message are shown above )
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Chase the www/nginx-module-njs update to 1.0.1, which contains
security fixes. Bump PORTREVISION so the packages pick up the new
module.
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Use the new www/nginx-module-njs source port instead of fetching njs
from GitHub. The module version is now maintained in one place for
these ports.
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Add www/nginx-module-ndk, a source-only port for the Nginx
Development Kit, and use it in the nginx ports instead of fetching
ngx_devel_kit from GitHub. The module version is now maintained in
one place for these ports.
Sponsored by: Netzkommune GmbH
www/nginx-devel: Update to 1.31.4
*) Feature: the "proxy_protocol" directive in the stream and mail
modules now supports the PROXY protocol version 2.
*) Change: now HTTP/2 and gRPC requests to backends are always sent with
the ":authority" pseudo-header, and HTTP/1.1 requests - with the
"Host" header.
*) Bugfix: a segmentation fault might occur in a worker process if the
"select" method was used.
*) Bugfix: incomplete gRPC responses with a non-zero "Content-Length"
header line are now treated as malformed.
(Only the first 15 lines of the commit message are shown above )
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Point the MODSECURITY3 option at the owasp-modsecurity account, which now
hosts ModSecurity-nginx; the SpiderLabs path only works through GitHub's
redirect. Pin all three ports to the same commit 9eb44fd; they carried
v1.0.3, fd28e6a and v1.0.3.
Also restore two mangled lines in the freenginx MODSECURITY3 branch, which
had lost their first character, leaving the port without --with-ld-opt and
without the pcre2 dependency when the option was on.
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Copy the module sources with cp instead of COPYTREE_SHARE in the
LUA and LUASTREAM pre-configure targets. COPYTREE_SHARE hardlinks
the files and then fails to chmod them when poudriere builds as an
unprivileged user.
Convert www/nginx-module-lua into a pure source-only port. The
prebuilt DSO conflicted with the module built by the nginx ports.
Add compat patches so lua-nginx-module builds against freenginx.
PR: 297651
Reported by: Brad Ackerman
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Rename www/lua-stream-nginx-module to www/nginx-module-lua-stream
to follow the nginx-module-* naming scheme for dedicated 3rd-party
module ports and adjust the consumers. Relax the BUILD_DEPENDS to
an unversioned dependency while here, matching the LUA option.
While here, rename the internal NJS_QJS_CFLAGS variable to
_NJS_QJS_CFLAGS so it is no longer treated as an option helper.
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Start moving the bundled 3rd-party modules into dedicated
nginx-module-* ports, so that module versions are maintained in a
single place instead of the GH_TUPLE lists of the nginx ports.
As a first step, convert www/nginx-module-lua into a hybrid port
that installs the lua-nginx-module sources next to the prebuilt
DSO and use them in the three nginx ports via an unversioned
BUILD_DEPENDS instead of fetching from GitHub.
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
- Add new NJS_QJS option to build the NJS module with the QuickJS
engine (lang/quickjs), which upstream recommends since njs 1.0.0
- Warn users with NJS enabled that the built-in njs engine is EOL
- Keep builds deterministic with NJS_QJS disabled (NJS_QUICKJS=NO)
- nginx-devel: remove leftover NJS_QJS bits pointing to deleted
patches; stop the QuickJS include path from clobbering the base
cc-opt flags
- nginx-full: enable NJS_QJS by default
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Update bundled third-party modules; where upstream now offers a tag,
switch from a commit hash to the version tag:
- array_var: v0.05 -> v0.06
- cache_purge: hash -> 3.0.2
- ngx_devel_kit: v0.3.3 -> v0.3.4
- drizzle: hash -> v0.1.14
- aws_auth: -> f3d9862 (stays on a hash; the 2.1.1 tag lacks the
OpenSSL 3.0 build fix)
Adjust the drizzle config patch to the module's new extraction
directory name.
For freenginx, add a patch to ngx_aws_auth: freenginx dropped
ngx_http_request_t.start_sec, so obtain the request time from
ngx_time() there instead.
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Move the bundled fdintino nginx-upload-module to release 2.3.0 and work
around its PCRE2 incompatibility.
Since the removal of the PCRE1 option nginx is built against PCRE2 only.
The module's regex filter for upload_pass_form_field still tests the
ngx_regex_exec() return code for "rc == 0", which is only true under
PCRE1; PCRE2 returns the number of captures (>= 0) on a match, so
matching
form fields were silently dropped and upload_pass_form_field was
unusable
on any dynamic (DSO) build. Relax the test to "rc >= 0" (workaround
from
upstream pull request 152).
freenginx: additionally adapt the module to the removal of r->start_sec
in freenginx >= 1.29 (nginx_version >= 1029000), which is otherwise a
build failure.
PR: 271781
Sponsored by: Netzkommune GmbH
www/{nginx-devel,freenginx}: 3rd-party modules management
The nginx_upstream_check_module extra-patches no longer matched the
current sources, so builds with HTTP_UPSTREAM_CHECK enabled failed.
nginx-devel: refresh the ngx_http_upstream_round_robin.c extra-patch for
nginx 1.31; reuse the patch already carried by www/nginx.
freenginx: regenerate the round_robin extra-patch against freenginx's
sources, and add extra-patch-ngx_http_upstream_check_module.c which
replaces the module's use of the ngx_http_status_t 'count' member
(removed in freenginx) with a local variable.
PR: 295745
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-pary modules managemeht
Fix build and loading of the 3rd party gridfs module after the
devel/mongo-c-driver 2.x update.
The module config now obtains include and linker flags from
pkg-config instead of deriving them from the ports tree's
DISTVERSION. The previous approach ran a recursive make into
devel/mongo-c-driver on every make invocation, even with GRIDFS
unset, and derived the libbson include path from the mongo-c-driver
version although devel/libbson is a separate port with its own
DISTVERSION. Both directories happen to carry the same version
today, so the mismatch was not visible yet.
While here, add the missing assert.h include. The module calls
assert() without declaring it, which left an unresolvable symbol
"assert" in the shared object -- libc only exports __assert. Since
nginx dlopen()s modules with RTLD_NOW, load_module refused to load
the module at runtime.
Also correct a typo in one of the patch file names.
PR: 296604, 296605, 296606
Sponsored by: Netzkommune GmbH
www/nginx-devel: Update to 1.31.3
Changes:
*) Security: heap buffer overflow when using the map directive with
regex matching (CVE-2026-42533)
*) Security: uninitialized memory access when using unnamed regex
captures with the "slice" directive or background cache update
(CVE-2026-60005)
*) Security: use-after-free when processing a specially crafted
proxied backend response with the ngx_http_ssi_filter_module
(CVE-2026-56434)
*) Change: the size of headers and trailers in HTTP/2 responses in
the ngx_http_proxy_v2_module and ngx_http_grpc_module is now
limited with "proxy_buffer_size" and "grpc_buffer_size"
(Only the first 15 lines of the commit message are shown above )
www/nginx-devel: Update to 1.31.2
Changes with nginx 1.31.2 17 Jun
2026
*) Security: use-after-free might occur when using HTTP/3 and
processing
a specially crafted QUIC session, allowing an attacker to cause
worker process memory corruption or segmentation fault in a
worker
process (CVE-2026-42530).
Thanks to Trung Nguyen of CyStack.
*) Security: a heap memory buffer overflow might occur in a worker
process when using a configuration with "ignore_invalid_headers
(Only the first 15 lines of the commit message are shown above )
www/{nginx,nginx-devel,freenginx}: 3rd-pary modules managemeht
Update mod_zip to 1.3.0 and switch Github author to evanmiller as this
seems to be author that the other, less current, versions are forked
from.
PR: 295934
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: use lua-stream-nginx-module port
Replace the embedded LUASTREAM GH_TUPLE handling with a
BUILD_DEPENDS on www/lua-stream-nginx-module and use the
module sources from the dedicated port during the build.
Add freenginx compatibility patches for lua-stream-nginx-module.
Also update lua-stream-nginx-module to version 0.0.17.
PR: 294426
Sponsored by: Netzkommune GmbH
www/nginx-devel: Update to 1.31.0
Changes with nginx 1.31.0 13 May
2026
*) Security: when using the "proxy_set_body" directive, an attacker
might inject data in the proxied request to an HTTP/2 backend
(CVE-2026-42926).
Thanks to Mufeed VH of Winfunc Research.
*) Security: a heap memory buffer overflow might occur in a worker
process while handling a specially crafted request by
ngx_http_rewrite_module, potentially resulting in arbitrary code
execution (CVE-2026-42945).
Thanks to Leo Lin.
(Only the first 15 lines of the commit message are shown above )
www/nginx-devel: Update to 1.29.8
Changes with nginx 1.29.8 07 Apr
2026
*) Feature: the "max_headers" directive.
Thanks to Maxim Dounin.
*) Feature: OpenSSL 4.0 compatibility.
*) Feature: now the "include" directive inside the "geo" block
supports
wildcards.
*) Bugfix: in processing of HTTP 103 (Early Hints) responses from a
proxied backend.
*) Bugfix: the $request_port and $is_request_port variables were not
available in subrequests.
Sponsored by: Netzkommune GmbH
www/nginx-devel: Update to 1.29.7
Changes with nginx 1.29.7 24 Mar
2026
*) Security: a buffer overflow might occur while handling a COPY or
MOVE
request in a location with "alias", allowing an attacker to
modify
the source or destination path outside of the document root
(CVE-2026-27654).
Thanks to Calif.io in collaboration with Claude and Anthropic
Research.
*) Security: processing of a specially crafted mp4 file by the
(Only the first 15 lines of the commit message are shown above )
devel/grpc: Update to 1.78.0
- Add OPENTELEMETRY option: disable by default for now due to build failure
- Bump PORTREVISION of dependent ports for shlib change
Changes: https://github.com/grpc/grpc/releases
www/*nginx: Switch nginx-vod-module to maintained fork
The original Kaltura nginx-vod-module repository is no longer actively
maintained and has been incompatible with FFmpeg 8 due to removed
legacy API calls.
Switch to the actively maintained fork:
https://github.com/diogoazevedos/nginx-vod-module
This restores compatibility with newer FFmpeg versions.
Reported by: Jim Terhune via ML
Sponsored by: Netzkommune GmbH
www/nginx-devel: Update to 1.29.5
Changes with nginx 1.29.5 04 Feb
2026
*) Security: an attacker might inject plain text data in the
response
from an SSL backend (CVE-2026-1642).
*) Bugfix: use-after-free might occur after switching to the next
gRPC
or HTTP/2 backend.
*) Bugfix: an invalid HTTP/2 request might be sent after switching
to
(Only the first 15 lines of the commit message are shown above )
*/*: update NGINX JavaScript to 0.9.5
Changes with njs 0.9.5
Release Date: 13 January 2026
nginx modules:
Feature: added native module support for qjs engine for http and
stream.
Bugfix: fixed js_body_filter with multiple chunks for qjs engine.
Bugfix: fixed buffer_type inheritance in if blocks for
js_body_filter. Previously, when js_body_filter was used inside an if
(Only the first 15 lines of the commit message are shown above )
www/lua-resty-core: update to 0.1.32
- Update lua-resty-core from 0.1.31 to 0.1.32
- Bump PORTREVISION for freenginx, nginx, and nginx-devel
PR: 290817
Approvd by: zi (autoapproved)
Sponsored by: Netzkommune GmbH
www/nginx-devel: Update to 1.29.4
Changelog:
*) Feature: the ngx_http_proxy_module supports HTTP/2.
*) Feature: Encrypted ClientHello TLS extension support when using
OpenSSL ECH feature branch; the "ssl_ech_file" directive.
Thanks to Stephen Farrell.
*) Change: validation of host and port in the request line, "Host"
header field, and ":authority" pseudo-header field has been
changed
to follow RFC 3986.
*) Change: now a single LF used as a line terminator in a chunked
(Only the first 15 lines of the commit message are shown above )
*/*: update NGINX JavaScript to 0.9.4
Changes with njs 0.9.4
Release Date: 28 October 2025
nginx modules:
Feature: added HTTP forward proxy support for ngx.fetch() API.
Core:
Bugfix: fixed r.subrequest() to a location with JS handler for
QuickJS. The bug became visible after bellard/quickjs@42eb2795.
Sponsored by: Netzkommune GmbH
*/*: update NGINX JavaScript to 0.9.3
Changes with njs 0.9.3
Release Date: 07 October 2025
nginx modules:
- Bugfix: fixed heap-use-after-free while module loading.
- Bugfix: fixed heap-use-after-free in js_set handler used in log
phase. The issue was introduced in 04f6dfb (0.9.2).
Changes with njs 0.9.2
(Only the first 15 lines of the commit message are shown above )
www/nginx-devel: Update to 1.29.2
Changes with nginx 1.29.2 07 Oct
2025
*) Feature: now nginx can be built with AWS-LC.
Thanks Samuel Chiang.
*) Bugfix: now the "ssl_protocols" directive works in a virtual
server
different from the default server when using OpenSSL 1.1.1 or
newer.
*) Bugfix: SSL handshake always failed when using TLSv1.3 with
OpenSSL
(Only the first 15 lines of the commit message are shown above )
www/nginx-devel: security update from 1.29.0 to 1.29.1
*) Security: processing of a specially crafted login/password when using
the "none" authentication method in the ngx_mail_smtp_module might
cause worker process memory disclosure to the authentication server
(CVE-2025-53859).
<ChangeLog>
*) Change: now TLSv1.3 certificate compression is disabled by default.
*) Feature: the "ssl_certificate_compression" directive.
*) Feature: support for 0-RTT in QUIC when using OpenSSL 3.5.1 or newer.
(Only the first 15 lines of the commit message are shown above )
*/*: update NGINX JavaScript: 0.9.0 -> 0.9.1 (+)
Bump PORTREVISION for www/unit.
<ChangeLog>
nginx modules:
*) Feature: added Fetch API for QuickJS engine.
*) Feature: added state file for a shared dictionary.
*) Bugfix: fixed handling of Content-Length header when
a body is provided for Fetch API.
(Only the first 15 lines of the commit message are shown above )
www/nginx-devel: update from 1.28.0 to 1.29.0
<ChangeLog>
*) Feature: support for response code 103 from proxy and gRPC backends;
the "early_hints" directive.
*) Feature: loading of secret keys from hardware tokens with OpenSSL
provider.
*) Feature: support for the "so_keepalive" parameter of the "listen"
directive on macOS.
*) Change: the logging level of SSL errors in a QUIC handshake has been
changed from "error" to "crit" for critical errors, and to "info" for
(Only the first 15 lines of the commit message are shown above )
www/nginx-devel: security update from 1.27.5 to 1.28.0
<ChangeLog>
*) 1.28.x stable branch.
*) Bugfix: nginx could not be built by gcc 15 if ngx_http_v2_module or
ngx_http_v3_module modules were used.
*) Bugfix: nginx might not be built by gcc 14 or newer with -O3 -flto
optimization if ngx_http_v3_module was used.
</ChangeLog>
www/nginx-devel: update 1.27.4 -> 1.27.5
<ChangeLog>
*) Feature: CUBIC congestion control in QUIC connections.
*) Change: the maximum size limit for SSL sessions cached in shared
memory has been raised to 8192.
*) Bugfix: in the "grpc_ssl_password_file", "proxy_ssl_password_file",
and "uwsgi_ssl_password_file" directives when loading SSL
certificates and encrypted keys from variables; the bug had appeared
in 1.23.1.
*) Bugfix: in the $ssl_curve and $ssl_curves variables when using
pluggable curves in OpenSSL.
*) Bugfix: nginx could not be built with musl libc.
Thanks to Piotr Sikora.
*) Performance improvements and bugfixes in HTTP/3.
</ChangeLog>
*/*: update NGINX JavaScript: 0.8.9 -> 0.8.10 (+)
<ChangeLog>
nginx modules:
*) Feature: reading r.requestText or r.requestBuffer from
a temp file.
Previously, an exception was thrown when accessing r.requestText
or r.requestBuffer if a client request body size exceeded
client_body_buffer_size.
*) Improvement: improved reporting of unhandled promise rejections.
*) Bugfix: fixed name corruption in variable and header processing.
(Only the first 15 lines of the commit message are shown above )
www/nginx-devel: fix revision and project name for the third-party (+)
modsecurity module.
Bump PORTREVISION.
Fixes: 71d982a7dd4cf45b9f5e00074558b61c814a6a79
Reported by: Saiful Alam
Number of commits found: 1304 (showing only 100 on this page)
