[dependabot]

Warning

Cooldown could not be applied because no publication date was available from the registry.

Bumps macbre/nginx-http3 from 1.27.0 to 1.31.6.

Release notes

Sourced from macbre/nginx-http3's releases.

nginx 1.31.6 and njs 1.0.1

Changes with nginx 1.31.6                                        15 Sep 2026
*) Security: a heap memory buffer overflow might occur in a worker
   process under certain configurations when using HTTP/3 with OpenSSL
   3.5.0 and earlier (CVE-2026-90439).
   Thanks to Banny Liao.
*) Change: now the QUIC transport parameters extension received in an

SSL connection is always ignored.
*) Bugfix: binary upgrade refused to work if the control API socket was

specified and the new nginx executable was built with the

ngx_http_perl_module.
*) Bugfix: an error while evaluating a predicate in a predicate location

was ignored and the predicate was treated as false.
*) Bugfix: an error during a nested location lookup might be ignored if

locations given by regular expressions or predicates were configured

at the current level.
*) Bugfix: a segmentation fault might occur while reading configuration

if the "geo" directive with the "ranges" parameter was used and the

corresponding binary base file was corrupted.

nginx 1.31.3

Changes with nginx 1.31.3                                        15 Jul 2026
*) Security: heap buffer overflow might occur in a worker process when
   using the map directive with regex matching if the map variable was
   included in a string expression after a capture affected by this map;
   a similar issue might happen when using a non-cacheable variable in a
   string expression (CVE-2026-42533).
   Thanks to Mufeed VH of Winfunc Research and Maxim Dounin.
*) Security: uninitialized memory access might occur when using unnamed

regex captures with the "slice" directive or background cache update,

which could result in worker process memory disclosure or worker

process termination (CVE-2026-60005).
*) Security: use-after-free might occur when processing a specially

crafted proxied backend response with the ngx_http_ssi_filter_module

(CVE-2026-56434).

Thanks to P4P3R-HAK.
*) Change: the size of headers and trailers in HTTP/2 responses in the


</tr></table>

... (truncated)

Commits

• a17f651 nginx 1.31.6 and njs 1.0.1 (#198)
• 2fe109f Bump actions/stale from 10 to 11 (#195)
• f224196 nginx 1.31.3 (#194)
• 4ff1b7e Bump macbre/push-to-ghcr from 17 to 18 (#193)
• 38d16ae Bump actions/checkout from 6 to 7 (#192)
• a5cf4db nginx 1.31.2 (#191)
• c02d77a Update nginx version and module details in README
• df9ab72 nginx 1.31.1 and njs 0.9.9 (#190)
• 0ce2707 Upgrade base image from Alpine 3.20 to 3.23 (#189)
• 59f0352 Use njs v0.9.8 (#186)
• Additional commits viewable in compare view

[macbre]

@dependabot recreate