1.26.3

Binaries

• nginx-*-i686.exe: 32-bit nginx
• nginx-*-i686-debug.exe: 32-bit nginx with debugging log and symbols
• nginx-slim-*-i686.exe: 32-bit nginx without openssl
• nginx-*-x86_64.exe: 64-bit nginx
• nginx-*-x86_64-debug.exe: 64-bit nginx with debugging log and symbols
• nginx-slim-*-x86_64.exe: 64-bit nginx without openssl

Sources

• nginx 1.26.3 (nginx/nginx@1be0fb0)
• zlib 1.3.1 (madler/zlib@02725ce)
• pcre2-10.42 (PCRE2Project/pcre2@52c0884)
• openssl 3.0.15

Nginx changelog

Changes with nginx 1.26.3                                        05 Feb 2025

    *) Security: insufficient check in virtual servers handling with TLSv1.3
       SNI allowed to reuse SSL sessions in a different virtual server, to
       bypass client SSL certificates verification (CVE-2025-23419).

    *) Bugfix: in the ngx_http_mp4_module.
       Thanks to Nils Bars.

    *) Workaround: "gzip filter failed to use preallocated memory" alerts
       appeared in logs when using zlib-ng.

    *) Bugfix: nginx could not build libatomic library using the library
       sources if the --with-libatomic=DIR option was used.

    *) Bugfix: nginx now ignores QUIC version negotiation packets from
       clients.

    *) Bugfix: nginx could not be built on Solaris 10 and earlier with the
       ngx_http_v3_module.

    *) Bugfixes in HTTP/3.