NGINXVERIFIED
release-1.31.2
Checked 29 Sep 2026. BlackTree preserves the last verified facts if a later source check is temporarily unavailable.
Open the official publisher source
← Lifecycle catalogue
RELEASE NOTESNGINXVERIFIED
PUBLISHER UPDATE · NGINX-1.31.2
NGINX-1.31.2 release notes and known issues
release-1.31.2
Scope: NGINX. This update record adds version, fix and known-issue context. Its publication date is not a lifecycle boundary.
Summary
nginx-1.31.2 mainline version has been released, with fixes for use-after-free vulnerability in the ngx_http_v3_module ( CVE-2026-42530 ), buffer overflow vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module ( CVE-2026-42055 ), and buffer overread vulnerability in the ngx_http_charset_module ( CVE-2026-48142 ). See official CHANGES on nginx.org. Below is a release summary generated by GitHub. What's Changed Use SipHash to speed up $request_id generation by @jimf5 in #1392 SSL: add $ssl_sigalgs variable by @VadimZhestikov in #1361 Xslt: fixed handle vsnprintf return value by @afonot in #747 GH: remove the set-creation-date.yaml workflow by @ac000 in #1435 Split clients: improved calculation of range boundaries by @pluknet in #1334 Style by @pluknet in #1440 GH: Fix the whitespace checker workflow by @ac000 in #1453 Secure link: Compare hashes in constant time by @sbhowmikf5 in #1433 Access log: Fix "request_length" format length by @nitin9977 in #1432 Updated OpenSSL used for win32 builds by @pluknet in #1469 Nginx 1.31.2 with security fixes (HTTP/2 proxy, grpc, HTTP/3, charset) by @arut in #1474 New Contributors @afonot made their first contribution in #747 @sbhowmikf5 made their first contribution in #1433 @nitin9977 made their first contribution in #1432 Full Changelog : release-1.31.1...release-1.31.2
Improvements and security content
- nginx-1.31.2 mainline version has been released, with fixes for use-after-free vulnerability in the ngx_http_v3_module ( CVE-2026-42530 ), buffer overflow vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module ( CVE-2026-42055 ), and buffer overread vulnerability in the ngx_http_charset_module ( CVE-2026-48142 ). See official CHANGES on nginx.org. Below is a release summary generated by GitHub. What's Changed Use SipHash to speed up $request_id generation by @jimf5 in #1392 SSL: add $ssl_sigalgs variable by @VadimZhestikov in #1361 Xslt: fixed handle vsnprintf return value by @afonot in #747 GH: remove the set-creation-date.yaml workflow by @ac000 in #1435 Split clients: improved calculation of range boundaries by @pluknet in #1334 Style by @pluknet in #1440 GH: Fix the whitespace checker workflow by @ac000 in #1453 Secure link: Compare hashes in constant time by @sbhowmikf5 in #1433 Access log: Fix "request_length" format length by @nitin9977 in #1432 Updated OpenSSL used for win32 builds by @pluknet in #1469 Nginx 1.31.2 with security fixes (HTTP/2 proxy, grpc, HTTP/3, charset) by @arut in #1474 New Contributors @afonot made their first contribution in #747 @sbhowmikf5 made their first contribution in #1433 @nitin9977 made their first contribution in #1432 Full Changelog : release-1.31.1...release-1.31.2
Known issues
Publisher statementNot stated. The verified publisher record does not contain a known-issues statement.
Affected products and versions
Products
- NGINX
Affected versions
- 1.31.2
- 1.31.1
Fixed versions or updates
- No fixed version is stated in this record.
Recommended action
Review the official publisher document before deployment.