git: 2ce2108cbf87 - main - www/nginx: Update to 1.28.3
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Thu, 26 Mar 2026 21:08:50 UTC
The branch main has been updated by joneum:
URL: https://cgit.FreeBSD.org/ports/commit/?id=2ce2108cbf8791a60e72c04f4ef3b6ec85baedea
commit 2ce2108cbf8791a60e72c04f4ef3b6ec85baedea
Author: Jochen Neumeister <joneum@FreeBSD.org>
AuthorDate: 2026-03-26 21:06:44 +0000
Commit: Jochen Neumeister <joneum@FreeBSD.org>
CommitDate: 2026-03-26 21:08:40 +0000
www/nginx: Update to 1.28.3
Changes with nginx 1.28.3 24 Mar
2026
*) Security: a buffer overflow might occur while handling a COPY or
MOVE
request in a location with "alias", allowing an attacker to
modify
the source or destination path outside of the document root
(CVE-2026-27654).
Thanks to Calif.io in collaboration with Claude and Anthropic
Research.
*) Security: processing of a specially crafted mp4 file by the
ngx_http_mp4_module on 32-bit platforms might cause a worker
process
crash, or might have potential other impact (CVE-2026-27784).
Thanks to Prabhav Srinath (sprabhav7).
*) Security: processing of a specially crafted mp4 file by the
ngx_http_mp4_module might cause a worker process crash, or might
have
potential other impact (CVE-2026-32647).
Thanks to Xint Code and Pavel Kohout (Aisle Research).
*) Security: a segmentation fault might occur in a worker process if
the
CRAM-MD5 or APOP authentication methods were used and
authentication
retry was enabled (CVE-2026-27651).
Thanks to Arkadi Vainbrand.
*) Security: an attacker might use PTR DNS records to inject data in
auth_http requests, as well as in the XCLIENT command in the
backend
SMTP connection (CVE-2026-28753).
Thanks to Asim Viladi Oglu Manizada, Colin Warren, Xiao Liu
(Yunnan
University), Yuan Tan (UC Riverside), and Bird Liu (Lanzhou
University).
*) Security: SSL handshake might succeed despite OCSP rejecting a
client
certificate in the stream module (CVE-2026-28755).
Thanks to Mufeed VH of Winfunc Research.
*) Change: now nginx limits the size and rate of QUIC stateless
reset
packets.
*) Bugfix: receiving a QUIC packet by a wrong worker process could
cause
the connection to terminate.
*) Bugfix: in the ngx_http_mp4_module.
Thanks to Andrew Lacambra.
Sponsored by: Netzkommune GmbH
---
security/modsecurity3-nginx/Makefile | 4 ++--
security/modsecurity3-nginx/distinfo | 6 +++---
www/nginx-acme/Makefile | 2 +-
www/nginx-acme/distinfo | 6 +++---
www/nginx-full/Makefile | 2 +-
www/nginx/Makefile | 2 +-
www/nginx/distinfo | 6 +++---
www/nginx/version.mk | 2 +-
8 files changed, 15 insertions(+), 15 deletions(-)
diff --git a/security/modsecurity3-nginx/Makefile b/security/modsecurity3-nginx/Makefile
index fe3d9256fb57..a6b71d079ff2 100644
--- a/security/modsecurity3-nginx/Makefile
+++ b/security/modsecurity3-nginx/Makefile
@@ -1,6 +1,6 @@
PORTNAME= modsecurity3-nginx
DISTVERSION= 1.0.4
-PORTREVISION= 2
+PORTREVISION= 3
CATEGORIES= security www
MASTER_SITES= https://nginx.org/download/
DISTFILES= ${_NGINX_DISTNAME}${EXTRACT_SUFX}
@@ -84,7 +84,7 @@ _NGINX_TMPDIR= ${_NGINX_VARDIR}/tmp/nginx
_NGINX_VARDIR= /var
_NGINX_PORTNAME= nginx
-_NGINX_PORTVERSION= 1.28.2
+_NGINX_PORTVERSION= 1.28.3
_NGINX_DISTNAME= ${_NGINX_PORTNAME}-${_NGINX_PORTVERSION}
do-install:
diff --git a/security/modsecurity3-nginx/distinfo b/security/modsecurity3-nginx/distinfo
index 9cbf095fc6f0..2fd9b7c9aec2 100644
--- a/security/modsecurity3-nginx/distinfo
+++ b/security/modsecurity3-nginx/distinfo
@@ -1,5 +1,5 @@
-TIMESTAMP = 1771870809
-SHA256 (nginx-1.28.2.tar.gz) = 20e5e0f2c917acfb51120eec2fba9a4ba4e1e10fd28465067cc87a7d81a829a3
-SIZE (nginx-1.28.2.tar.gz) = 1282351
+TIMESTAMP = 1774552910
+SHA256 (nginx-1.28.3.tar.gz) = 2c96a946bfb0882a21744ed429770a2123ae1828c7c48665092993ddee91a918
+SIZE (nginx-1.28.3.tar.gz) = 1284562
SHA256 (SpiderLabs-ModSecurity-nginx-e6a568a_GH0.tar.gz) = 0680f0c025b91e0f233cd908eac7da0f08ff5042f941c570d4ad8c8a94eea533
SIZE (SpiderLabs-ModSecurity-nginx-e6a568a_GH0.tar.gz) = 1161281
diff --git a/www/nginx-acme/Makefile b/www/nginx-acme/Makefile
index 78f87793da94..3dc37bbb0ded 100644
--- a/www/nginx-acme/Makefile
+++ b/www/nginx-acme/Makefile
@@ -1,6 +1,6 @@
PORTNAME= acme
PORTVERSION= 0.1.1
-PORTREVISION= 10
+PORTREVISION= 11
CATEGORIES= www
MASTER_SITES= https://github.com/nginx/nginx-${PORTNAME}/releases/download/v${PORTVERSION}/:acme \
https://nginx.org/download/:nginx
diff --git a/www/nginx-acme/distinfo b/www/nginx-acme/distinfo
index 3f8d3a71007d..1d91ca6f9b3f 100644
--- a/www/nginx-acme/distinfo
+++ b/www/nginx-acme/distinfo
@@ -1,8 +1,8 @@
-TIMESTAMP = 1771060848
+TIMESTAMP = 1774553068
SHA256 (nginx-acme-0.1.1.tar.gz) = c2158d7f9baa53a9186c406e82c3068832f03b87a1d1066b0d214a8bf834ddfd
SIZE (nginx-acme-0.1.1.tar.gz) = 77853
-SHA256 (nginx-1.28.2.tar.gz) = 20e5e0f2c917acfb51120eec2fba9a4ba4e1e10fd28465067cc87a7d81a829a3
-SIZE (nginx-1.28.2.tar.gz) = 1282351
+SHA256 (nginx-1.28.3.tar.gz) = 2c96a946bfb0882a21744ed429770a2123ae1828c7c48665092993ddee91a918
+SIZE (nginx-1.28.3.tar.gz) = 1284562
SHA256 (nginx-1.29.5.tar.gz) = 6744768a4114880f37b13a0443244e731bcb3130c0a065d7e37d8fd589ade374
SIZE (nginx-1.29.5.tar.gz) = 1310203
SHA256 (rust/crates/addr2line-0.24.2.crate) = dfbe277e56a376000877090da837660b4427aad530e3028d44e0bffe4f89a1c1
diff --git a/www/nginx-full/Makefile b/www/nginx-full/Makefile
index 2aa07336f5d9..12cdc6c3156d 100644
--- a/www/nginx-full/Makefile
+++ b/www/nginx-full/Makefile
@@ -1,5 +1,5 @@
PORTNAME= nginx
-PORTREVISION= 1
+PORTREVISION= 0
PKGNAMESUFFIX= -full
MAINTAINER= joneum@FreeBSD.org
diff --git a/www/nginx/Makefile b/www/nginx/Makefile
index 6f119bab65af..620e0a23f61d 100644
--- a/www/nginx/Makefile
+++ b/www/nginx/Makefile
@@ -1,7 +1,7 @@
PORTNAME= nginx
PORTVERSION= ${NGINX_VERSION}
.include "version.mk"
-PORTREVISION= 13
+PORTREVISION= 0
PORTEPOCH= 3
CATEGORIES= www
MASTER_SITES= https://nginx.org/download/ \
diff --git a/www/nginx/distinfo b/www/nginx/distinfo
index 9a1e15b1638f..70b7098dce9b 100644
--- a/www/nginx/distinfo
+++ b/www/nginx/distinfo
@@ -1,6 +1,6 @@
-TIMESTAMP = 1774468156
-SHA256 (nginx-1.28.2.tar.gz) = 20e5e0f2c917acfb51120eec2fba9a4ba4e1e10fd28465067cc87a7d81a829a3
-SIZE (nginx-1.28.2.tar.gz) = 1282351
+TIMESTAMP = 1774552697
+SHA256 (nginx-1.28.3.tar.gz) = 2c96a946bfb0882a21744ed429770a2123ae1828c7c48665092993ddee91a918
+SIZE (nginx-1.28.3.tar.gz) = 1284562
SHA256 (nginx_mogilefs_module-1.0.4.tar.gz) = 7ac230d30907f013dff8d435a118619ea6168aa3714dba62c6962d350c6295ae
SIZE (nginx_mogilefs_module-1.0.4.tar.gz) = 11208
SHA256 (ngx_http_redis-0.3.9.tar.gz) = 21f87540f0a44b23ffa5df16fb3d788bc90803b255ef14f9c26e3847a6f26f46
diff --git a/www/nginx/version.mk b/www/nginx/version.mk
index 78803684e7dd..bbe792b57f68 100644
--- a/www/nginx/version.mk
+++ b/www/nginx/version.mk
@@ -1 +1 @@
-NGINX_VERSION= 1.28.2
+NGINX_VERSION= 1.28.3