All Versions
14
Latest Version
Avg Release Cycle
63 days
Latest Release
1250 days ago

Changelog History
Page 1

  • v1.42.0 Changes

    November 23, 2020
    • lib: fix ubsan errors (Patch from Asra Ali) (GH-1468)
    • lib: Don't send RST_STREAM to idle stream (GH-1477)
    • lib: nghttp2_map backed by nghttp2_ksl
    • doc: Update sphinx_rtd_theme
    • doc: nghttp2_session_send is also affected by max concurrent streams (Patch from Tomas Krizek) (GH-1489)
    • doc: clarify flow control behaviour for nghttp2_session_send() (Patch from Tomas Krizek) (GH-1488)
    • ๐Ÿ— build: Add missing cmake/FindSystemd.cmake to dist (GH-1526)
    • third-party: Bump llhttp to 2.2.0
    • ๐Ÿ’Ž third-party: Bump mruby to 2.1.2
    • nghttpx: Deal with the case when h2 backend is retired before it is initialized
    • nghttpx: Add accesslog variables to record request path without query (GH-1511)
    • nghttpx: Fix stall when TLS follows after proxy protocol
    • ๐ŸŒฒ nghttpx: Fix logging integer

  • v1.41.0 Changes

    June 02, 2020
    • ๐Ÿ›  Fix CVE-2020-11080
    • lib: Implement max settings option (Patch from James M Snell)
    • lib: Earlier check for settings flood (Patch from James M Snell)
    • lib: Fix receiving stream data stall (GH-1444)
    • ๐Ÿ— build: cmake: Make hard-coded static lib suffix optional (Patch from Viktor Szakats) (GH-1418)
    • third-party: Bump llhttp to 2.0.4 (GH-1442)
    • ๐Ÿ‘ nghttpx: Add PROXY-protocol v2 support (GH-1452)
    • nghttpx: Fix get_x509_serial for long serial numbers (Patch from Jacky Tian) (GH-1455)
    • h2load: Allow port in --connect-to
    • h2load: add --connect-to option (Patch from Lucas Pardue) (GH-1426)

  • v1.40.0 Changes

    November 15, 2019
    • lib: Add nghttp2_check_authority as public API (GH-1413)
    • lib: Fix the bug that stream is closed with wrong error code (GH-1408)
    • lib: Faster huffman encoding and decoding (GH-1405)
    • ๐Ÿ— build: Avoid filename collision of static and dynamic lib (Patch from William A Rowe Jr) (GH-1394)
    • build: Add new flag ENABLE_STATIC_CRT for Windows (Patch from William A Rowe Jr) (GH-1393)
    • ๐Ÿ— build: cmake: Support building nghttpx with systemd (Patch from Andrew Penkrat) (GH-1377)
    • โšก๏ธ third-party: Update neverbleed to fix memory leak
    • ๐Ÿ’Ž nghttpx: Fix bug that mruby is incorrectly shared between backends (GH-1392)
    • nghttpx: Reconnect h1 backend if it lost connection before sending headers
    • nghttpx: Returns 408 if backend timed out before sending headers
    • nghttpx: Fix request stall (GH-1378)

  • v1.39.2 Changes

    August 13, 2019

    ๐Ÿš€ This release fixes CVE-2019-9511 โ€œData Dribbleโ€ and CVE-2019-9513
    โ€œResource Loopโ€ vulnerability in nghttpx and nghttpd. Specially crafted HTTP/2
    frames cause Denial of Service by consuming CPU time. Check out
    ๐Ÿ”’ https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
    for details. For nghttpx, additionally limiting inbound traffic by --read-rate and --read-burst options is quite effective against this kind of attack.

    • ๐Ÿ›  Fix CVE-2019-9511 and CVE-2019-9513
    • Add nghttp2_option_set_max_outbound_ack API function
    • nghttpx: Fix request stall

  • v1.39.1 Changes

    June 11, 2019
    • ๐Ÿ”ง nghttpx: Fix bug that log-level is not set with cmd-line or configuration file
    • 0๏ธโƒฃ nghttpx: Fix FPE with default backend

  • v1.39.0 Changes

    June 11, 2019
    • lib: Ignore content-length in 200 response to CONNECT request (GH-1347)
    • โฌ†๏ธ third-party: Upgrade mruby to 2.0.1 (GH-1337)
    • ๐Ÿ‘ asio: support boost-1.70 (Patch from Adam Goล‚ฤ™biowski) (GH-1335)
    • ๐Ÿ“œ src: Replace http-parser with llhttp (GH-1340)
    • nghttpx: Ignore Content-Length and Transfer-Encoding in 1xx or 200 to CONNECT (GH-1347)
    • ๐Ÿ”ง nghttpx: Fix unchanged log level on configuration reload (GH-1356)

  • v1.38.0 Changes

    April 18, 2019
    • lib: Fix bug that on_header callback is still called after stream is closed (GH-1331)
    • โšก๏ธ third-party: Update http-parser to v2.9.1
    • nghttpx: Fix bug that altered authority and path affect backend selection (GH-1334)
    • nghttpx: Fix bug that chunked request stalls (GH-1333)
    • ๐ŸŒฒ nghttpx: Don't log authorization request header field value with -LINFO (GH-1332)
    • nghttpx: Fix for compilation against modern LibreSSL (Patch from Jeff 'Raid' Baitis) (GH-1270)

  • v1.37.0 Changes

    March 08, 2019
    • lib: Take into account larger frame size for prioritization
    • lib: Reuse name when indexing header by referencing dynamic table
    • ๐Ÿ— build: Explicitly set install location when building shared libs (Patch from Don) (GH-1303)
    • nghttpx: Fix backend stall if header and request body are sent in 2 packets
    • nghttpx: Backend address selection with weight (GH-1297)
    • nghttpx: Fix compilation with boringssl (Patch from Simon Frankenberger) (GH-1295)

  • v1.36.0 Changes

    January 18, 2019
    • build: Disable shared library if ENABLE_SHARED_LIB is OFF (Patch from Brendan Heinonen) (GH-1285)
    • ๐Ÿ“œ third-party: Use http-parser to v2.9.0 (GH-1294)
    • โšก๏ธ third-party: Update mruby to 2.0.0
    • nghttpx: Pool h1 backend connection per address (GH-1292)
    • nghttpx: Randomize backend address round robin order per thread (GH-1291)
    • nghttpx: Fix getting long serial numbers for openssl < 1.1 (Patch from Josh Braegger) (GH-1287)
    • ๐Ÿ”Š h2load: add an option to write per-request logs (Patch from dawg) (GH-1256)
    • asio: added access to the number of the current server port (Patch from Pedro Santos) (GH-1257)

  • v1.35.1 Changes

    December 09, 2018
    • nghttpx: Fix broken trailing slash handling (GH-1276)