The OpenResty network platform based on NGINX and LuaJIT, version 1.31.8.1, has been officially released. The complete release notes are available online.

This release provides the portable source code distribution and pre-built binary packages for Ubuntu, Debian, Fedora, CentOS, RHEL, OpenSUSE, and Amazon Linux. You can download the packages from this link.

Special thanks to all our developers and contributors! Thanks to OpenResty Inc. for sponsoring much of the OpenResty core development work.

Key Changes

Highlights of this release include:

  • Nginx Core: Upgraded from nginx 1.31.1 to 1.31.8
  • OpenSSL: Upgraded from 3.5.6 to 3.5.9
  • PCRE2: Upgraded from 10.47 to 10.49
  • lua-nginx-module (upgraded to v0.10.32rc7)
    • Added compression for certificates set from ssl_certificate_by_lua*
    • Fixed unbounded retries in balancer_by_lua* caused by a wrapped try count
    • Fixed balancer keepalive connections never being reused with proxy_bind
    • Fixed the ngx.flush() buffer being recycled while still queued
    • Fixed server_rewrite_by_lua* using the global VM when lua_code_cache is off
    • Fixed sslhandshake losing the verify error when the handshake completes immediately
    • Fixed wakeup of Lua subrequests on HTTP/2 errors
    • Fixed multiple memory-safety issues involving the receiveuntil iterator, the client CA name list, and worker threads
  • stream-lua-nginx-module (upgraded to v0.0.20rc3)
    • Fixed a use-after-free after the receiveuntil iterator is garbage-collected
    • Fixed child coroutine operations not being cleaned up when killing uthreads
    • Fixed buffered output not being drained before error finalization
  • lua-resty-core (upgraded to v0.1.35rc2)
    • Added ngx.ssl.compress_certs()
    • Fixed the stream cosocket getsslctx() being bound to the wrong FFI symbol
    • Fixed sslhandshake error handling and several FFI correctness issues
  • LuaJIT (upgraded to v2.1-20261023)
    • Backported some v3.0 syntax extensions, including empty statements (semicolons) anywhere
    • Added JIT compilation of unpack() and optimized the common 1-char case of string.sub/string.byte
    • Numerous fixes and optimizations across x64, ARM64, PPC, s390x, macOS, iOS, Windows, and more
    • Fixed a race condition and lock issues related to the profiler
    • Various FFI ABI and calling convention fixes
  • lua-resty-redis (upgraded to v0.34)
    • Added db, password, username, and tcp_keepalive options to connect()
    • Allowed hmget() to take a table
    • Fixed issues with transaction state and module command arguments
  • lua-resty-openssl (upgraded to v1.9.0)
    • Added support for OpenSSL 4.0
    • Added support for post-quantum key operations
  • Other component upgrades
    • lua-cjson upgraded to v2.1.0.20, with an added option to sort encoded object keys
    • lua-resty-string upgraded to v0.19, with an added md5.final_hex() method
    • resty-cli upgraded to v0.36, with a new --no-clean option for resty to keep the temporary nginx prefix directory on exit
    • lua-resty-websocket upgraded to v0.16, with hardened handshake validation and frame parsing, plus support for resuming partial frames
    • encrypted-session-nginx-module upgraded to v0.10, with constant-time MAC comparison
    • lua-resty-dns upgraded to v0.24, now rejecting incomplete DNS resource records
    • lua-resty-mysql upgraded to v0.31, with a fix for password scramble indexing in caching_sha2 auth
    • ngx_devel_kit upgraded to v0.3.6, with support for complex values in nginx 1.31.3
    • opm upgraded to v0.0.12
    • set-misc-nginx-module upgraded to v0.34
    • lua-resty-upstream-healthcheck upgraded to v0.10
    • drizzle-nginx-module upgraded to v0.1.14
    • lua-resty-memcached upgraded to v0.18
    • ngx_postgres upgraded to v1.1
    • headers-more-nginx-module upgraded to v0.40
    • lua-resty-signal upgraded to v0.05
    • echo-nginx-module upgraded to v0.65
    • srcache-nginx-module upgraded to v0.34
    • memc-nginx-module upgraded to v0.21

Security Fixes

This release includes the 12 CVE fixes from Nginx 1.31.2 through 1.31.8, listed by the Nginx version that first fixed them:

  • 1.31.2
    • Use-after-free in HTTP/3 (CVE-2026-42530)
    • Buffer overflow when proxying to HTTP/2/gRPC upstreams (CVE-2026-42055)
    • Out-of-bounds read in charset conversion (CVE-2026-48142)
  • 1.31.3
    • Buffer overflow related to map with regex matching (CVE-2026-42533)
    • Uninitialized memory access related to slice and background cache update, which may lead to memory disclosure (CVE-2026-60005)
    • Use-after-free in SSI (CVE-2026-56434)
  • 1.31.6
    • Heap buffer overflow in HTTP/3 under certain configurations when using OpenSSL 3.5.0 and earlier (CVE-2026-90439)
  • 1.31.7
    • Buffer overflow with alias/rewrite (CVE-2026-15176)
    • Buffer overflow when evaluating variable expressions (CVE-2026-93479)
    • Request body injection in HTTP/3 (CVE-2026-95101)
    • Session forgery related to TLS session tickets (CVE-2026-97629)
    • Use-after-free with AIO/SSI (CVE-2026-97205)

For details on each vulnerability, please see the official Nginx security advisories.

Full Changelog

For the complete list of changes, the HTML changelog, and other related links, please see the complete release notes.

Website

OpenResty is an open-source web platform that integrates an enhanced Nginx core with LuaJIT, maintained by OpenResty Inc. It also bundles numerous third-party Nginx modules and Lua libraries, as well as most of their external dependencies, making it a complete and powerful networking solution. For more information, please visit the OpenResty homepage:

https://openresty.org/

Quality Assurance

We have conducted extensive testing on Amazon EC2 test clusters and ensured that all components, including the Nginx core, work well together. The latest test reports can be found here:

https://qa.openresty.org/

Commercial Version

We run OpenResty based on the latest open-source version in our own global CDN network (known as “Mini CDN”). This network supports our openresty.org and openresty.com websites and is also used for our commercial software. For more information, please visit https://openresty.com/.

Feedback

We welcome feedback on this release. You may create a new GitHub issue or send us an email.