CVS commit: [pkgsrc-2026Q3] pkgsrc/www/nginx

["Benny Siegert" <bsiegert%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   bsiegert
Date:           Mon Nov  2 19:49:52 UTC 2026

Modified Files:
        pkgsrc/www/nginx [pkgsrc-2026Q3]: Makefile distinfo

Log Message:
Pullup ticket #7323 - requested by kim
www/nginx: security fix

Revisions pulled up:
- www/nginx/Makefile                                            1.200
- www/nginx/distinfo                                            1.146

---
   Module Name:    pkgsrc
   Committed By:   kim
   Date:           Thu Oct 15 18:49:40 UTC 2026

   Modified Files:
           pkgsrc/www/nginx: Makefile distinfo

   Log Message:
   nginx: Update to 1.30.6

   Changes with nginx 1.30.6                                        14 Oct 2026

       *) Security: a buffer overflow might occur in a worker process when
          using the "alias" directive if the request URI was changed by the
          "rewrite" directive and was then mapped to a file path
          (CVE-2026-15176).

       *) Security: a buffer overflow might occur in a worker process while
          evaluating string expressions with variables, which affected the
          document root calculation and request logging in the http and stream
          modules (CVE-2026-93479).
          Thanks to Matt Suiche of Tolmo Inc.

       *) Security: when using HTTP/3 a part of an unknown frame might be
          treated as the request body, which might result in bypassing the
          "client_max_body_size" limit or injecting data in the proxied request
          (CVE-2026-95101).
          Thanks to Hansol Lee of GOTROOT.

       *) Security: when using TLS session ticket key rotation, one of the keys
          was left uninitialized, which might allow to forge a session
          (CVE-2026-97629).
          Thanks to PhiNode Labs.

       *) Security: when using asynchronous file I/O (AIO), use-after-free
          might occur in certain configurations if the SSI page has "include
          virtual" commands (CVE-2026-97205).
          Thanks to cyberlancer.

       *) Change: the logging level of the "invalid alert" and "record layer
          failure" SSL errors, and of the "SSL alert number N" for any alert
          numbers has been lowered from "crit" to "info".

       *) Bugfix: a segmentation fault might occur in a worker process or
          "request count is zero" alerts might appear in logs if the
          "X-Accel-Redirect" header line was cached and the cached response was
          then served to a client.
          Thanks to Ji?? Setni?ka and Maxim Dounin.

       *) Bugfix: a segmentation fault might occur in a worker process if the
          ngx_http_dav_module was used to handle COPY and MOVE methods in a
          location with the "alias" directive.
          Thanks to Maxim Dounin.

       *) Bugfix: a segmentation fault might occur while reading configuration
          if the "geo" directive with the "ranges" parameter was used and the
          corresponding binary base file was corrupted.

       *) Bugfix: use-after-free might occur in a worker process if proxying
          with buffering was used and an error occurred while sending the
          response to an HTTP/2 client.

       *) Bugfix: a worker process might not exit or "accept4() failed (9: Bad
          file descriptor)" alerts might appear in logs if the worker process
          ran out of file descriptors before graceful shutdown.

       *) Bugfix: a segmentation fault might occur in a worker process if the
          "select" method was used.

       *) Bugfix: in binary compatibility with third-party modules using script
          codes; the bug had appeared in 1.30.4.

       *) Bugfix: in the ngx_http_perl_module.
          Thanks to Maxim Dounin.

       *) Bugfix: in flow control in the ngx_http_v2_module.

       *) Bugfix: "[error] upstream sent frame for unknown stream" and "[crit]
          cache file ... contains invalid header" messages might appear in logs
          when sending a cached HTTP/2 response in the ngx_http_proxy_v2_module
          if the "proxy_cache_revalidate" directive was used.

       *) Bugfix: IPv6 fragmentation might not be disabled when using QUIC on
          some operating systems.

       *) Bugfix: in the ngx_http_auth_basic_module on Solaris.

       *) Bugfixes in HTTP/3, ngx_http_image_filter_module,
          ngx_http_slice_module, and ngx_http_memcached_module.


To generate a diff of this commit:
cvs rdiff -u -r1.197 -r1.197.2.1 pkgsrc/www/nginx/Makefile
cvs rdiff -u -r1.145 -r1.145.2.1 pkgsrc/www/nginx/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/nginx/Makefile
diff -u pkgsrc/www/nginx/Makefile:1.197 pkgsrc/www/nginx/Makefile:1.197.2.1
--- pkgsrc/www/nginx/Makefile:1.197     Wed Sep 16 10:36:51 2026
+++ pkgsrc/www/nginx/Makefile   Mon Nov  2 19:49:52 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.197 2026/09/16 10:36:51 kim Exp $
+# $NetBSD: Makefile,v 1.197.2.1 2026/11/02 19:49:52 bsiegert Exp $
 
-DISTNAME=      nginx-1.30.5
+DISTNAME=      nginx-1.30.6
 CATEGORIES=    www
 MASTER_SITES=  https://nginx.org/download/
 DISTFILES=     ${DEFAULT_DISTFILES}

Index: pkgsrc/www/nginx/distinfo
diff -u pkgsrc/www/nginx/distinfo:1.145 pkgsrc/www/nginx/distinfo:1.145.2.1
--- pkgsrc/www/nginx/distinfo:1.145     Wed Sep 16 10:36:51 2026
+++ pkgsrc/www/nginx/distinfo   Mon Nov  2 19:49:52 2026
@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.145 2026/09/16 10:36:51 kim Exp $
+$NetBSD: distinfo,v 1.145.2.1 2026/11/02 19:49:52 bsiegert Exp $
 
 BLAKE2s (array-var-nginx-module-0.06.tar.gz) = fa6ad2a2ce3c3eba3f69287b224e9c01fcaca29a083394ab74f2f655d3e2138b
 SHA512 (array-var-nginx-module-0.06.tar.gz) = bc72158856a1be18a26ee04c6b5b0f0a20bcce688610a493bf31e2a133e7eb12e11f7c18197a09a72b1513f6a08348ee5281b9d5b84cf43603539040ebd23c26
@@ -27,9 +27,9 @@ Size (naxsi-1.7-src-with-deps.tar.gz) = 
 BLAKE2s (nchan-1.3.7.tar.gz) = 27da0a52c9123186a321a01b02cb004eed0623110aafa6737dd43ceeff766010
 SHA512 (nchan-1.3.7.tar.gz) = 585c6f9107b84354e7f6c587f85cf554dd5c213b1e3baa75e0aee0b28520afb9cffff1812c32e81541a1f25773fc58d1b92ce6bd9d85accc12f37841633eb79b
 Size (nchan-1.3.7.tar.gz) = 665133 bytes
-BLAKE2s (nginx-1.30.5.tar.gz) = 237c8db3b063b174045fd960be5c8156101f17923f66bd4f6ce0c942aaa5eb85
-SHA512 (nginx-1.30.5.tar.gz) = 0e36c27b1a2c3c7f38b73990cef615c59f300ef1bd473a5ed23d5f89ff4e8cd51ca63754430a5dfe4fdaf48ed9eb64a3d74b0bf9a80226f700f99d1d2fa9000d
-Size (nginx-1.30.5.tar.gz) = 1328600 bytes
+BLAKE2s (nginx-1.30.6.tar.gz) = 78e41ca15d6a63eceaeefe4fe05955793807a8fd42935eea2a99b6f49cdbc348
+SHA512 (nginx-1.30.6.tar.gz) = 1b04fcb5a7ee3df573b1a0d792cf1f1cfc02d30d03592f2f04b2b2842d9f42364957f4420e53af380b9fffd5eb4a3a5c11f6d71643168db25baeea748cf94fa2
+Size (nginx-1.30.6.tar.gz) = 1331698 bytes
 BLAKE2s (nginx-dav-ext-module-3.0.0.tar.gz) = 8e823ffd605d4fca00eb3ca92a0954ca35fb178397e0b990fea7d47580ee582f
 SHA512 (nginx-dav-ext-module-3.0.0.tar.gz) = d0193ba90f1ef46c4e470630c4394bdf99d94fd2e3bd8be6cb2ba1655ec59944b1269025f032b79dc2c6dad366e54389ef6a6da2ddeb91d535a4027f2162fbde
 Size (nginx-dav-ext-module-3.0.0.tar.gz) = 14558 bytes