From 8008da299f2d7321b3831b1cdca315aa3973ad04 Mon Sep 17 00:00:00 2001 From: Shubham Chakraborty Date: Thu, 30 Apr 2026 11:10:32 +0530 Subject: [PATCH] package/nginx: security bump to version 1.28.3 Fixes the following security issues: - CVE-2026-27654: Buffer overflow in ngx_http_dav_module when using the alias directive with WebDAV COPY or MOVE requests. - CVE-2026-27784 & CVE-2026-32647: Buffer overflows in ngx_http_mp4_module when processing specially crafted MP4 files. - CVE-2026-27651: NULL pointer dereference in the mail proxy module during CRAM-MD5 or APOP authentication retries. - CVE-2026-28753: DNS PTR record manipulation in auth_http or SMTP proxy. - CVE-2026-28755: OCSP certificate check bypass in the stream module. For a full list of changes, see: https://nginx.org/en/CHANGES-1.28 Signed-off-by: Shubham Chakraborty Signed-off-by: Marcus Hoffmann --- package/nginx/nginx.hash | 2 +- package/nginx/nginx.mk | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/package/nginx/nginx.hash b/package/nginx/nginx.hash index 7b79036b20..1d11937987 100644 --- a/package/nginx/nginx.hash +++ b/package/nginx/nginx.hash @@ -1,4 +1,4 @@ # Locally calculated after checking pgp signature -sha256 40e7a0916d121e8905ef50f2a738b675599e42b2224a582dd938603fed15788e nginx-1.28.1.tar.gz +sha256 2c96a946bfb0882a21744ed429770a2123ae1828c7c48665092993ddee91a918 nginx-1.28.3.tar.gz # License files, locally calculated sha256 77c01620abf36ed747b7eca4bd271e49023fe3a8e2b3525bcf4b09c8e3aa28e4 LICENSE diff --git a/package/nginx/nginx.mk b/package/nginx/nginx.mk index 41490caee2..a8b7ee7319 100644 --- a/package/nginx/nginx.mk +++ b/package/nginx/nginx.mk @@ -4,7 +4,7 @@ # ################################################################################ -NGINX_VERSION = 1.28.1 +NGINX_VERSION = 1.28.3 NGINX_SITE = https://nginx.org/download NGINX_LICENSE = BSD-2-Clause NGINX_LICENSE_FILES = LICENSE