NGINX is a high performance edge web server with the lowest memory footprint
and the key features to build modern and efficient web infrastructure.
NGINX functionality includes HTTP server, HTTP and mail reverse proxy, caching,
load balancing, compression, request throttling, connection multiplexing and
reuse, SSL offload and HTTP media streaming.
See also: https://nginx.org/
devel/grpc: Update to 1.85.1
- Remove outdated CONFLICTS_INSTALL:
- grpc130 and grpc134 were removed over 4.5 years ago
- grpc142 was removed over 2.5 years ago
- Bump PORTREVISION of dependent ports for shlib change
Changes: https://github.com/grpc/grpc/releases
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Build the dynamic_upstream, ip2location and auth_krb5 modules from their own
www/nginx-module-* ports instead of inline GH_TUPLE sources, like the other
3rd-party modules. The auth_krb5 GSSAPI substitution moves to pre-configure,
where the sources now arrive. Put the BROTLI option block in the same order
as the rest.
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: build the brotli module from its port
Build the brotli module from its own www/nginx-module-brotli port instead
of inline GH_TUPLE sources, like the other 3rd-party modules.
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Build the otel and redis modules from their own ports instead of inline
sources. OTEL now tracks the official nginx-otel upstream instead of the
osokin snapshot, and HTTP_REDIS builds from a maintained redis module in
place of the unmaintained one.
Sponsored by: Netzkommune GmbH
databases/libdrizzle: Update to 1.0
The standalone tarball ended with 0.8 in 2009. The library went on inside
the drizzle server release, still written in C and with the same interface.
On top of that it now speaks the authentication of current MySQL, which had
dropped mysql_native_password: the plugin is negotiated, an auth switch is
followed and caching_sha2_password is answered, in the clear over a unix
socket and with the public key of the server over tcp. A server that does
not offer plugin authentication still sees the packet it always did, and
connecting over a unix socket works on FreeBSD for the first time.
The release puts its headers on a path of its own, so the servers that can
build the drizzle module are pointed at it.
The sample programs are gone with the old tarball, and with them the
dependency on sqlite3.
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Build the echo, headers_more, eval, set_misc, srcache, rds_json, rds_csv,
xss and drizzle modules from their own ports instead of bundling the
sources here.
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Chase the vod module update, which these ports build in themselves.
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Build the dav_ext, auth_digest, subs_filter, link and upload modules from
their own source ports. freenginx drops HTTP_SUBS_FILTER, which needs a
structure field freenginx does not provide.
Sponsored by: Netzkommune GmbH
www/nginx: Switch CPE_PRODUCT to nginx_open_source
The NVD changed the product name it files nginx vulnerabilities under.
All 26 advisories published since February 2024 use f5:nginx_open_source,
while f5:nginx has received a single one in that time, CVE-2025-23419.
The two sets of CVE identifiers do not overlap at all, so the old name
no longer matches current advisories.
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Bump PORTREVISION for the array-var and encrypted-session updates. Both
modules are built into these ports, and a BUILD_DEPENDS does not rebuild
them by itself.
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Build the auth_ldap module from its own source port, and add the
cert_expiry, ip_anon, stream limit_req and syslog5424 modules.
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Build the memc, encrypted_session, fancyindex, auth_pam and geoip2 modules
from their own source ports.
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Build the iconv and json_status modules from their own source ports.
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: Drop the pcre1 dependency
Nothing calls a pcre1 symbol; modsecurity3 itself is built with pcre2.
The slave ports kept listing PCRE_ONE, an option that no longer exists.
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: Bump PORTREVISION for the module updates
The cache_purge, njs and lua modules are built into these ports, and a
BUILD_DEPENDS does not rebuild them by itself.
Sponsored by: Netzkommune GmbH
www/nginx: Security update to 1.30.6
Five security fixes: a buffer overflow with "alias" after "rewrite"
(CVE-2026-15176), a buffer overflow while evaluating string expressions
with variables (CVE-2026-93479), an HTTP/3 frame treated as the request
body (CVE-2026-95101), an uninitialized TLS session ticket key
(CVE-2026-97629), and a use-after-free with AIO and SSI "include virtual"
(CVE-2026-97205).
https://nginx.org/en/CHANGES-1.30
Security: CVE-2026-15176
Security: CVE-2026-93479
Security: CVE-2026-95101
Security: CVE-2026-97629
Security: CVE-2026-97205
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: Mark the MODSECURITY3 conflict
The option builds the same module from the same source into the same path
as security/modsecurity3-nginx. A build now stops with the name of the
package it collides with instead of overwriting its file.
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Build the accept_language, aws_auth, fips_check, modsecurity3 and sts
modules from their own source ports instead of fetching them with
GH_TUPLE.
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Build the gridfs, postgres, redis2 and sflow modules from their own
source ports instead of fetching them with GH_TUPLE.
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
- Announce the removal of the HTTP_NOTICE option after 2026-12-31.
nginx can return a fixed body itself.
- Announce the removal of the HTTP_UPSTREAM_STICKY option after
2026-12-31 in nginx and nginx-devel. nginx has its own sticky
directive since 1.29.6, freenginx does not.
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Announce the removal of the HTTP_UPSTREAM_FAIR option after 2026-12-31.
nginx can balance by least connections itself.
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Build the let, slowfs_cache, websockify and zstd modules from their own
source ports instead of fetching them with GH_TUPLE.
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Use the new www/nginx-module-ajp source port instead of fetching
nginx_ajp_module from GitHub.
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Fix three defects in the body filter of the zstd module. A worker spins
at 100% CPU forever when an empty flush buffer arrives and the compressor
has nothing left to flush. A response is truncated at 131072 bytes when
a single input buffer larger than that carries last_buf. An output
buffer that is already full when ZSTD_endStream() is due gets dropped.
Upstream has not taken a code change since April 2024.
PR: 299100
Sponsored by: Netzkommune GmbH
www/nginx*: Security update to 1.30.5 and 1.31.6
Changes with nginx 1.30.5 15 Sep 2026
*) Security: a heap memory buffer overflow might occur in a worker
process under certain configurations when using HTTP/3 with OpenSSL
3.5.0 and earlier (CVE-2026-90439).
Thanks to Banny Liao.
*) Change: now the QUIC transport parameters extension received in an
SSL connection is always ignored.
Changes with nginx 1.31.6 15 Sep 2026
*) Security: a heap memory buffer overflow might occur in a worker
(Only the first 15 lines of the commit message are shown above )
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Use the new www/nginx-module-vod source port instead of fetching
nginx-vod-module from GitHub.
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Bump PORTREVISION so the packages pick up the fixed lua, cache_purge
and njs module sources.
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Use the new www/nginx-module-form-input source port instead of fetching
form-input-nginx-module from GitHub. The module version is now
maintained in one place for these ports.
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Use the new www/nginx-module-cache-purge source port instead of
fetching ngx_cache_purge from GitHub. The module version is now
maintained in one place for these ports.
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Use the new www/nginx-module-array-var source port instead of fetching
array-var-nginx-module from GitHub. The module version is now
maintained in one place for these ports.
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Chase the www/nginx-module-njs update to 1.0.1, which contains
security fixes. Bump PORTREVISION so the packages pick up the new
module.
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Use the new www/nginx-module-njs source port instead of fetching njs
from GitHub. The module version is now maintained in one place for
these ports.
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Add www/nginx-module-ndk, a source-only port for the Nginx
Development Kit, and use it in the nginx ports instead of fetching
ngx_devel_kit from GitHub. The module version is now maintained in
one place for these ports.
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Point the MODSECURITY3 option at the owasp-modsecurity account, which now
hosts ModSecurity-nginx; the SpiderLabs path only works through GitHub's
redirect. Pin all three ports to the same commit 9eb44fd; they carried
v1.0.3, fd28e6a and v1.0.3.
Also restore two mangled lines in the freenginx MODSECURITY3 branch, which
had lost their first character, leaving the port without --with-ld-opt and
without the pcre2 dependency when the option was on.
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Copy the module sources with cp instead of COPYTREE_SHARE in the
LUA and LUASTREAM pre-configure targets. COPYTREE_SHARE hardlinks
the files and then fails to chmod them when poudriere builds as an
unprivileged user.
Convert www/nginx-module-lua into a pure source-only port. The
prebuilt DSO conflicted with the module built by the nginx ports.
Add compat patches so lua-nginx-module builds against freenginx.
PR: 297651
Reported by: Brad Ackerman
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Rename www/lua-stream-nginx-module to www/nginx-module-lua-stream
to follow the nginx-module-* naming scheme for dedicated 3rd-party
module ports and adjust the consumers. Relax the BUILD_DEPENDS to
an unversioned dependency while here, matching the LUA option.
While here, rename the internal NJS_QJS_CFLAGS variable to
_NJS_QJS_CFLAGS so it is no longer treated as an option helper.
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Start moving the bundled 3rd-party modules into dedicated
nginx-module-* ports, so that module versions are maintained in a
single place instead of the GH_TUPLE lists of the nginx ports.
As a first step, convert www/nginx-module-lua into a hybrid port
that installs the lua-nginx-module sources next to the prebuilt
DSO and use them in the three nginx ports via an unversioned
BUILD_DEPENDS instead of fetching from GitHub.
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
- Add new NJS_QJS option to build the NJS module with the QuickJS
engine (lang/quickjs), which upstream recommends since njs 1.0.0
- Warn users with NJS enabled that the built-in njs engine is EOL
- Keep builds deterministic with NJS_QJS disabled (NJS_QUICKJS=NO)
- nginx-devel: remove leftover NJS_QJS bits pointing to deleted
patches; stop the QuickJS include path from clobbering the base
cc-opt flags
- nginx-full: enable NJS_QJS by default
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Update bundled third-party modules; where upstream now offers a tag,
switch from a commit hash to the version tag:
- array_var: v0.05 -> v0.06
- cache_purge: hash -> 3.0.2
- ngx_devel_kit: v0.3.3 -> v0.3.4
- drizzle: hash -> v0.1.14
- aws_auth: -> f3d9862 (stays on a hash; the 2.1.1 tag lacks the
OpenSSL 3.0 build fix)
Adjust the drizzle config patch to the module's new extraction
directory name.
For freenginx, add a patch to ngx_aws_auth: freenginx dropped
ngx_http_request_t.start_sec, so obtain the request time from
ngx_time() there instead.
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-party modules management
Move the bundled fdintino nginx-upload-module to release 2.3.0 and work
around its PCRE2 incompatibility.
Since the removal of the PCRE1 option nginx is built against PCRE2 only.
The module's regex filter for upload_pass_form_field still tests the
ngx_regex_exec() return code for "rc == 0", which is only true under
PCRE1; PCRE2 returns the number of captures (>= 0) on a match, so
matching
form fields were silently dropped and upload_pass_form_field was
unusable
on any dynamic (DSO) build. Relax the test to "rc >= 0" (workaround
from
upstream pull request 152).
freenginx: additionally adapt the module to the removal of r->start_sec
in freenginx >= 1.29 (nginx_version >= 1029000), which is otherwise a
build failure.
PR: 271781
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: 3rd-pary modules managemeht
Fix build and loading of the 3rd party gridfs module after the
devel/mongo-c-driver 2.x update.
The module config now obtains include and linker flags from
pkg-config instead of deriving them from the ports tree's
DISTVERSION. The previous approach ran a recursive make into
devel/mongo-c-driver on every make invocation, even with GRIDFS
unset, and derived the libbson include path from the mongo-c-driver
version although devel/libbson is a separate port with its own
DISTVERSION. Both directories happen to carry the same version
today, so the mismatch was not visible yet.
While here, add the missing assert.h include. The module calls
assert() without declaring it, which left an unresolvable symbol
"assert" in the shared object -- libc only exports __assert. Since
nginx dlopen()s modules with RTLD_NOW, load_module refused to load
the module at runtime.
Also correct a typo in one of the patch file names.
PR: 296604, 296605, 296606
Sponsored by: Netzkommune GmbH
www/nginx: Update to 1.30.4
Changes:
*) Security: heap buffer overflow when using the map directive with
regex matching (CVE-2026-42533)
*) Security: uninitialized memory access when using unnamed regex
captures with the "slice" directive or background cache update
(CVE-2026-60005)
*) Security: use-after-free when processing a specially crafted
proxied backend response with the ngx_http_ssi_filter_module
(CVE-2026-56434)
Release Notes: https://nginx.org/en/CHANGES-1.30
Security: 56feeac6-8263-11f1-92ba-bc24110523fe
Security: CVE-2026-42533
Security: CVE-2026-56434
Security: CVE-2026-60005
PR: 296830
Sponsored by: Netzkommune GmbH
www/nginx: Update to 1.30.3
Changes with nginx 1.30.3 17 Jun
2026
*) Security: a heap memory buffer overflow might occur in a worker
process when using a configuration with "ignore_invalid_headers
off;"
and "large_client_header_buffers" with large configured values
when
proxying a specially crafted request to HTTP/2 or gRPC backend,
allowing an attacker to cause worker process memory corruption or
segmentation fault in a worker process (CVE-2026-42055).
Thanks to Mufeed VH of Winfunc Research.
(Only the first 15 lines of the commit message are shown above )
www/{nginx,nginx-devel,freenginx}: 3rd-pary modules managemeht
Update mod_zip to 1.3.0 and switch Github author to evanmiller as this
seems to be author that the other, less current, versions are forked
from.
PR: 295934
Sponsored by: Netzkommune GmbH
www/{nginx,nginx-devel,freenginx}: use lua-stream-nginx-module port
Replace the embedded LUASTREAM GH_TUPLE handling with a
BUILD_DEPENDS on www/lua-stream-nginx-module and use the
module sources from the dedicated port during the build.
Add freenginx compatibility patches for lua-stream-nginx-module.
Also update lua-stream-nginx-module to version 0.0.17.
PR: 294426
Sponsored by: Netzkommune GmbH
www/nginx: Update to 1.30.2
hanges with nginx 1.30.2 22 May
2026
*) Security: a heap memory buffer overflow might occur in a worker
process when using a configuration with overlapping captures in
ngx_http_rewrite_module, potentially resulting in arbitrary code
execution (CVE-2026-9256).
Thanks to Mufeed VH of Winfunc Research.
PR: 295498
Sponsored by: Netzkommune GmbH
www/nginx: Update to 1.28.3
Changes with nginx 1.28.3 24 Mar
2026
*) Security: a buffer overflow might occur while handling a COPY or
MOVE
request in a location with "alias", allowing an attacker to
modify
the source or destination path outside of the document root
(CVE-2026-27654).
Thanks to Calif.io in collaboration with Claude and Anthropic
Research.
*) Security: processing of a specially crafted mp4 file by the
(Only the first 15 lines of the commit message are shown above )
devel/grpc: Update to 1.78.0
- Add OPENTELEMETRY option: disable by default for now due to build failure
- Bump PORTREVISION of dependent ports for shlib change
Changes: https://github.com/grpc/grpc/releases
www/*nginx: Switch nginx-vod-module to maintained fork
The original Kaltura nginx-vod-module repository is no longer actively
maintained and has been incompatible with FFmpeg 8 due to removed
legacy API calls.
Switch to the actively maintained fork:
https://github.com/diogoazevedos/nginx-vod-module
This restores compatibility with newer FFmpeg versions.
Reported by: Jim Terhune via ML
Sponsored by: Netzkommune GmbH
www/nginx: Update to 1.28.2
Changes with nginx 1.28.2 04 Feb
2026
*) Security: an attacker might inject plain text data in the
response
from an SSL backend (CVE-2026-1642).
*) Bugfix: use-after-free might occur after switching to the next
gRPC
or HTTP/2 backend.
*) Bugfix: fixed warning when compiling with MSVC 2022 x86.
(Only the first 15 lines of the commit message are shown above )
*/*: update NGINX JavaScript to 0.9.5
Changes with njs 0.9.5
Release Date: 13 January 2026
nginx modules:
Feature: added native module support for qjs engine for http and
stream.
Bugfix: fixed js_body_filter with multiple chunks for qjs engine.
Bugfix: fixed buffer_type inheritance in if blocks for
js_body_filter. Previously, when js_body_filter was used inside an if
(Only the first 15 lines of the commit message are shown above )
mail/phpmailer7: Update to 7.0.1
-Use From domain when generating CIDs in msgHTML.
-Update to PHPCompatibility 10, resolve numerous PHPCS issues in PHP 8.5.
-Revise GitHub actions for PHP 8.5 and experimental 8.6 tests.
-Switch gmail example from the deprecated IMAP extension to use
directorytree/imapengine for IMAP uploads.
-Set htmlspecialchars() flags explicitly and consistently.
-Convert XOAUTH2 token exceptions into PHPMailer Exceptions. The original
exception is available as an inner exception.
-Deprecate VERSION constants in POP3 and SMTP classes.
-Remove dependency on roave/security-advisories; it's now built into composer
2.9.
-Update Dutch, Esperanto, and Norwegian translations.
Sponsored by: Netzkommune GmbH
www/*nginx: update 3rd party otel
Update nginx-otel to a newer upstream revision to fix OTEL builds
with system gRPC.
PR: 288764
Sponsored by: Netzkommune GmbH
www/lua-resty-core: update to 0.1.32
- Update lua-resty-core from 0.1.31 to 0.1.32
- Bump PORTREVISION for freenginx, nginx, and nginx-devel
PR: 290817
Approvd by: zi (autoapproved)
Sponsored by: Netzkommune GmbH
www/nginx: do not link to libpostproc for thumbextractor module
libpostproc has been removed from newer ffmpeg and it not needed
with ffmpeg6 either
PR: 289067
*/*: update NGINX JavaScript to 0.9.4
Changes with njs 0.9.4
Release Date: 28 October 2025
nginx modules:
Feature: added HTTP forward proxy support for ngx.fetch() API.
Core:
Bugfix: fixed r.subrequest() to a location with JS handler for
QuickJS. The bug became visible after bellard/quickjs@42eb2795.
Sponsored by: Netzkommune GmbH
*/*: update NGINX JavaScript to 0.9.3
Changes with njs 0.9.3
Release Date: 07 October 2025
nginx modules:
- Bugfix: fixed heap-use-after-free while module loading.
- Bugfix: fixed heap-use-after-free in js_set handler used in log
phase. The issue was introduced in 04f6dfb (0.9.2).
Changes with njs 0.9.2
(Only the first 15 lines of the commit message are shown above )
www/nginx: Update to 1.28.0
Changes with nginx 1.28.0:
*) 1.28.x stable branch.
*) Bugfix: nginx could not be built by gcc 15 if ngx_http_v2_module or
ngx_http_v3_module modules were used.
*) Bugfix: nginx might not be built by gcc 14 or newer with -O3 -flto
optimization if ngx_http_v3_module was used.
Update 3rd party module:
- Luastream to 0.0.16
- Passenger to 6.0.27
PR: 286312
Sponsored by: Netzkommune GmbH
www/nginx: Update to 1.26.3
Changes with nginx 1.26.3 05 Feb 2025
*) Security: insufficient check in virtual servers handling with
TLSv1.3 SNI allowed to reuse SSL sessions in a different virtual server,
to bypass client SSL certificates verification (CVE-2025-23419).
*) Bugfix: in the ngx_http_mp4_module.
Thanks to Nils Bars.
*) Workaround: "gzip filter failed to use preallocated memory"
alerts appeared in logs when using zlib-ng.
*) Bugfix: nginx could not build libatomic library using the library
(Only the first 15 lines of the commit message are shown above )
