The OpenResty web platform based on NGINX and LuaJIT version 1.27.1.2 has been officially released. You can view the complete release notes at: https://openresty.org/en/ann-1027001002.html

This release provides source code distributions, Win32/Win64 binary distributions, and versions for all common Linux distributions. You can download the packages through the following link: http://openresty.org/en/download.html

Special thanks to all our developers and contributors! Thanks to OpenResty Inc. for sponsoring a large amount of OpenResty core development work.

Key Changes

Highlights of this version include:

Nginx Core

• Ported CVE-2025-23419 fix patch.

OpenResty

• Fixed nginx-1.27.1-stream_ssl_preread_no_skip.patch.
• Made HTTP3 server header also use openresty instead of nginx.

OpenSSL

• Upgraded from version 3.0.15 to 3.4.1.

PCRE

• Upgraded from version 10.42 to 10.44.

lua-nginx-module

• Bugfix: Removed http2 hardcoded limitation in ngx.location subrequest API.
• New feature: Implemented ngx_http_lua_ffi_decode_base64mime.
• New feature: Added ngx.resp.set_status(status, reason).
• Bugfix: setkeepalive failure on TLSv1.3.

stream-lua-nginx-module

• New feature: Enabled ngx.var in ssl_certificate_by_lua and ssl_client_hello_by_lua.
• Bugfix: setkeepalive failure on TLSv1.3.

lua-resty-core

• New feature: Implemented decode_base64mime.
• New feature: Added ngx.resp.set_status(status, reason).

luajit2

• Fixed recording of BC_VARG.
• Rejected negative getfenv()/setfenv() levels to prevent compiler warnings.
• Enforced fallback source name for stripped bytecode.
• Restored state when recording __concat metamethod throws OOM.
• MIPS64: Fixed pcall() error case.
• Fixed inconsistent rename detection due to sunk values.
• Always closed profiler output file.
• Fixed override of INSTALL_LJLIBD in the presence of DESTDIR.
• Fixed type cast for bit operations shifts in DUALNUM builds.

For a complete list of changes, please refer to the provided webpage.

Complete Changelog

For the complete list of changes, HTML version of the changelog, and other hyperlinks, please refer to the link below:

https://openresty.org/en/ann-1027001002.html

Note: There appears to be a truncated sentence at the end of the original document about creating issues on GitHub or sending emails or discussing on the BBS forum.

Website

OpenResty is a mature web platform that integrates the standard Nginx core, Lua/LuaJIT, numerous third-party Nginx modules and Lua libraries, as well as most of their external dependencies. This makes OpenResty a complete and powerful networking solution. For detailed information, please visit the OpenResty homepage: https://openresty.org/

Quality Assurance

We have conducted extensive testing on Amazon EC2 test clusters and ensured that all components (including the Nginx core) work well together. The latest test reports can be found here: https://qa.openresty.org/

Commercial Version

We run OpenResty based on the latest open-source version in our own global CDN network (known as “Mini CDN”). This network supports our openresty.org and openresty.com websites, and is also used for our commercial software. For more information, please visit https://openresty.com/.

Feedback

We appreciate your feedback on this release. Feel free to create new GitHub issues or send emails to one of our mailing lists.