www/angie-module-njs: Security update to 1.0.1
This maintenance update of njs fixes three security issues:
- Access control bypass in js_access when an asynchronous request body
continuation threw an exception or produced an unhandled rejection
(CVE-2026-18329). Previously, nginx could continue processing the
request as though the js_access check had succeeded. Affects
0.9.9-1.0.0. Thanks to Ta Duc Thien.
- Worker process crash when reading Response.statusText after an
upstream server returned a status line with an empty reason phrase
(CVE-2026-78222). Affects 0.5.1-1.0.0.
- Heap buffer overflow while parsing namespace prefix lists passed to
xml.exclusiveC14n() (CVE-2026-78689). Affects 0.7.10-1.0.0. Thanks to
Vladimir, Vulnerability Research Tech Lead @ Cyera, evilgensec.
PR: 298637
Changes: https://github.com/nginx/njs/releases/tag/1.0.1
Security: 6cf326a2-b38c-11f1-a655-3497f65b111b
Sponsored by: Netzkommune GmbH
www/angie-module-jwt: Update to 3.4.6
This bugfix release fixes the module's test suite:
test_conf forwarded an unquoted $@, so the expected message was split
on spaces and only its first word was ever grepped. Two expectations
were pointing at the wrong configuration file, unnoticed.
PR: 298635
Changes: https://github.com/max-lt/nginx-jwt-module/releases/tag/v3.4.6
Sponsored by: Netzkommune GmbH
www/angie-module-auth-jwt: Update to 0.15.0
This new release adds the nxe-phase submodule and bumps the version of
nxe-jwx from 0.2.0 to 0.4.0.
PR: 298634
Changes: https://github.com/kjdev/nginx-auth-jwt/releases
Sponsored by: Netzkommune GmbH
www/angie: Security update to 1.12.2
This maintenance release fixes CVE-2026-90439:
When using an OpenSSL version without native HTTP/3 support (3.5.0
or earlier), if the default server for the address that accepted a
regular HTTPS request also used HTTP/3 (the listen directive with the
quic parameter, possibly on a different port), while a server block
without HTTP/3 was selected by domain name (SNI), limited worker process
memory corruption or a worker process crash could occur
(CVE-2026-90439); the fix was ported from nginx 1.31.6.
PR: 298632
Changes: https://en.angie.software/angie/docs/oss_changes/#angie-1-12-2
Security: 6cf2ff4b-b38c-11f1-a655-3497f65b111b
Sponsored by: Netzkommune GmbH
www/angie-module-njs: Update 0.9.9 => 1.0.0
With this milestone release, the QuickJS engine reaches feature parity
with njs and is now the recommended engine.
Changelog:
https://github.com/nginx/njs/releases/tag/1.0.0
PR: 296796
Sponsored by: UNIS Labs
www/angie-module-vod: New upstream, update to 1.8.1
This patch changes the port to the new upstream repo, since the
original one the angie documentation still refers to in some places
has been abandoned since 2024.
BEFORE UPDATING:
Carefully read the changelogs at
https://github.com/dio-az/nginx-vod-module/releases,
especially regarding these BREAKING CHANGES in v1.0.0:
- Drop support for HDS and MSS
- Improve compliance with DASH specification
- Use last audio track assuming higher bitrate
PR: 296274
Sponsored by: UNIS Labs
Co-authored-by: Vladimir Druzenko <vvd@FreeBSD.org>
MFH: 2026Q2
www/angie: Update 1.11.2 => 1.11.3 (fix CVE-2026-1642, possible MITM attack)
Security: An attacker in a man-in-the-middle (MITM) position before a
proxied server using TLS, given conditions beyond the attacker's
control, could inject plaintext data into the response before the TLS
handshake begins (CVE-2026-1642); the fix was ported from nginx 1.29.5.
Changelog:
https://en.angie.software/angie/docs/oss_changes/#angie-1-11-3
- Bump PORTREVISION in www/angie-module-*.
- Fix using of ANGIE_PORTREVISION in RUN_DEPENDS for modules.
- Replace INSTALL_MAN with INSTALL_DATA for documentation.
- Unroll "for" loops with 1-2 items - simplify Makefile and call
"INSTALL_*" 1 time instead of several.
PR: 293034
Security: CVE-2026-1642
MFH: 2026Q1
www/angie*: Bump PORTREVISION after www/angie update
pkg does not honor RUN_DEPENDS versions, hence it fails to re-install
module packages after updates to www/angie. The only workaround is
bumping PORTREVISION for *all* modules.
PR: 292648
www/angie-module-jwt: update 3.4.3 => 3.4.4
No actual changes/updates to the code, but we keep the module version
up-to-date anyways.
Changes:
- Add GutHub Sponsors username to FUNDING.yml
- docs: add pre-buildt Ubuntu/Debian package installation instructions
- Update README.md
- Update nginx to 1.28.1-alpine3.23 (docker)
https://github.com/max-lt/nginx-jwt-module/compare/v3.4.3...v3.4.4
PR: 292925
www/angie-module-zstd: New port: zstd compression for angie
The module adds support for Zstandard compression of responses, both
dynamic (on-the-fly) and static (precompressed files). Compared to gzip,
zstd offers higher compression and decompression speeds at comparable
or better compression ratios.
Source and documentation:
https://github.com/tokers/zstd-nginx-module/
Angie-specific documentation:
https://en.angie.software/angie/docs/installation/external-modules/zstd/
PR: 291546
www/angie: Use upstream version numbers for modules
Angie modules currently inherit the version number of the angie version
they are built against. This makes it hard and opaque to track their
actual version.
The mechanism used in the Makefile also had the unwanted side-effect of
PORTREVISION propagating from modules to the master port, which broke
the build (we found out the hard way...)
While here reduce number of of MKDIR calls.
PR: 291490
Co-authored-by: Vladimir Druzenko <vvd@FreeBSD.org>
www/angie-module-auth-totp: New port: TOTP authentication for angie
The nginx-http-auth-totp module provides TOTP authentication for an
Angie server.
The Time-based One-Time Password (TOTP) algorithm, provides a secure
mechanism for short-lived one-time password values, which are desirable
for enhanced security. This algorithm can be used across a wide range of
network applications ranging from remote Virtual Private Network (VPN)
access, Wi-Fi network logon to transaction-orientated Web applications.
PR: 289369
www/angie: Update 1.10.1 => 1.10.2
This release includes the following fixes relevant for FreeBSD:
* Proxy module settings in the http block could break functionality of
modules that use the client block for outgoing requests; the bug had
appeared in 1.10.0.
* Enabling proxy_ignore_client_abort together with modules that use the
client block for outgoing requests could lead to worker process
crashes; the bug had appeared in 1.10.0.
(+ 2 docker-related fixes)
Full changelog:
https://en.angie.software/angie/docs/oss_changes/#angie-1-10-2
PR: 288996
MFH: 2025Q3
www/angie*: Transfer maintainership
Oleg A. Mamontov <oleg@mamontov.net> (former maintainer) is inactive
for almost 1 year.
Several previous updates was with "maintainer timeout".
These updates was made by Sebastian Oswald <sko@rostwald.de>.
Thanks Oleg for your contribution!
And welcome Sebastian!
PR: 288571
Approved by: Sebastian Oswald <sko@rostwald.de> (new maintainer)