When variables were used in the root or alias directives, or in the log file path of the access_log directive in the HTTP module or the access_log directive in the stream module, worker process memory corruption or a worker process crash could occur (CVE-2026-93479); the fix was ported from nginx 1.31.7.
When the ssl_session_cache directive was used with the shared parameter without the ssl_session_ticket_key directive, an attacker could forge a TLS session and bypass client certificate verification (CVE-2026-97629); the fix was ported from nginx 1.31.7.
When requests received over HTTP/3 were proxied, a part of an unknown frame might be treated as the request body, which might result in bypassing the client_max_body_size limit or injecting data into the proxied request (CVE-2026-95101); the fix was ported from nginx 1.31.7.
When the alias directive was used, if the request URI was changed by the rewrite directive and the $request_filename variable was evaluated afterwards, worker process memory corruption or a worker process crash could occur (CVE-2026-15176); the fix was ported from nginx 1.31.7.
When asynchronous file I/O (aio) was used in certain configurations, if an SSI page contained include virtual commands, worker process memory corruption or a worker process crash could occur (CVE-2026-97205); the fix was ported from nginx 1.31.7.
When the XML module of NJS failed to parse malformed XML, worker process memory leaked, which could lead to unbounded memory growth (CVE-2026-101025); the fix is in NJS 1.0.2, now shipped in the angie-module-njs package.
For attributes containing entity references, the XML module of NJS could return values that differed from the values used in XML canonicalization, which could affect the validation of signed XML documents (CVE-2026-101019); the fix is in NJS 1.0.2, now shipped in the angie-module-njs package.