The njs dynamic modules for Angie have been installed.
To enable these modules, add the following to /usr/local/etc/angie/angie.conf
and reload angie:
load_module modules/ngx_http_js_module.so;
load_module modules/ngx_stream_js_module.so;
Please refer to the njs documentation for further details:
https://github.com/nginx/njs
https://angie.software/js_reference/
https://angie.software/http_js/
https://angie.software/stream_js/
Packages by version and architecture
latest
FreeBSD version
amd64
aarch64
i386
FreeBSD 16
1.0.1,1
1.0.1,1
–
FreeBSD 15
1.0.1,1
1.0.1,1
–
FreeBSD 14
1.0.1,1
1.0.1,1
1.0.1,1
quarterly (2026Q4)
FreeBSD version
amd64
aarch64
i386
FreeBSD 15
1.0.1,1
1.0.1,1
–
FreeBSD 14
1.0.1,1
1.0.1,1
1.0.1,1
version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.
Unaddressed and VuXML only (0)
No unaddressed CVE and nothing reported by pkg audit for the packaged version 1.0.1,1.
Fixed (1)
Show 1 fixed
VuXML entries whose affected range the packaged version has left.
www/angie-module-njs: Security update to 1.0.1
This maintenance update of njs fixes three security issues:
- Access control bypass in js_access when an asynchronous request body
continuation threw an exception or produced an unhandled rejection
(CVE-2026-18329). Previously, nginx could continue processing the
request as though the js_access check had succeeded. Affects
0.9.9-1.0.0. Thanks to Ta Duc Thien.
- Worker process crash when reading Response.statusText after an
upstream server returned a status line with an empty reason phrase
(CVE-2026-78222). Affects 0.5.1-1.0.0.
- Heap buffer overflow while parsing namespace prefix lists passed to
xml.exclusiveC14n() (CVE-2026-78689). Affects 0.7.10-1.0.0. Thanks to
Vladimir, Vulnerability Research Tech Lead @ Cyera, evilgensec.
PR: 298637
Changes: https://github.com/nginx/njs/releases/tag/1.0.1
Security: 6cf326a2-b38c-11f1-a655-3497f65b111b
Sponsored by: Netzkommune GmbH
www/angie: Security update to 1.12.2
This maintenance release fixes CVE-2026-90439:
When using an OpenSSL version without native HTTP/3 support (3.5.0
or earlier), if the default server for the address that accepted a
regular HTTPS request also used HTTP/3 (the listen directive with the
quic parameter, possibly on a different port), while a server block
without HTTP/3 was selected by domain name (SNI), limited worker process
memory corruption or a worker process crash could occur
(CVE-2026-90439); the fix was ported from nginx 1.31.6.
PR: 298632
Changes: https://en.angie.software/angie/docs/oss_changes/#angie-1-12-2
Security: 6cf2ff4b-b38c-11f1-a655-3497f65b111b
Sponsored by: Netzkommune GmbH
www/angie-module-njs: Update 0.9.9 => 1.0.0
With this milestone release, the QuickJS engine reaches feature parity
with njs and is now the recommended engine.
Changelog:
https://github.com/nginx/njs/releases/tag/1.0.0
PR: 296796
Sponsored by: UNIS Labs
www/angie: Update 1.11.2 => 1.11.3 (fix CVE-2026-1642, possible MITM attack)
Security: An attacker in a man-in-the-middle (MITM) position before a
proxied server using TLS, given conditions beyond the attacker's
control, could inject plaintext data into the response before the TLS
handshake begins (CVE-2026-1642); the fix was ported from nginx 1.29.5.
Changelog:
https://en.angie.software/angie/docs/oss_changes/#angie-1-11-3
- Bump PORTREVISION in www/angie-module-*.
- Fix using of ANGIE_PORTREVISION in RUN_DEPENDS for modules.
- Replace INSTALL_MAN with INSTALL_DATA for documentation.
- Unroll "for" loops with 1-2 items - simplify Makefile and call
"INSTALL_*" 1 time instead of several.
PR: 293034
Security: CVE-2026-1642
MFH: 2026Q1
www/angie*: Bump PORTREVISION after www/angie update
pkg does not honor RUN_DEPENDS versions, hence it fails to re-install
module packages after updates to www/angie. The only workaround is
bumping PORTREVISION for *all* modules.
PR: 292648
www/angie: Use upstream version numbers for modules
Angie modules currently inherit the version number of the angie version
they are built against. This makes it hard and opaque to track their
actual version.
The mechanism used in the Makefile also had the unwanted side-effect of
PORTREVISION propagating from modules to the master port, which broke
the build (we found out the hard way...)
While here reduce number of of MKDIR calls.
PR: 291490
Co-authored-by: Vladimir Druzenko <vvd@FreeBSD.org>