[SECURITY] nginx 1.30.1 / 1.31.0 security advisories (2026-05-13): please rebuild image

[billchurch]

Is this a new feature request?

• I have searched the existing issues

Wanted change

Summary

nginx just released released 1.30.1 (stable) and 1.31.0 (mainline) on 2026-05-13 addressing six CVEs. Several are directly relevant to SWAG's role as a reverse proxy doing TLS termination, OCSP stapling, and (optionally) HTTP/2 + HTTP/3. Requesting an image rebuild against the patched nginx version.

Relevance to SWAG

• CVE-2026-42926 affects the proxy module, which is the core of every SWAG deployment.
• CVE-2026-42945 affects the rewrite module, which most SWAG site configs use.
• CVE-2026-40701 affects OCSP requests to the resolver; SWAG performs OCSP stapling against the Let's Encrypt chain by default.
• CVE-2026-40460 applies to HTTP/3, which is opt-in on SWAG but increasingly enabled by users.

References

• Advisory: https://nginx.org/en/security_advisories.html
• nginx announcement: https://nginx.org/

Environment

• Image: lscr.io/linuxserver/swag:latest
• Affected nginx versions: anything currently pinned in the build (prior to 1.30.1)

Reason for change

CVEs fixed

CVE	Module	Class
CVE-2026-42926	ngx_http_proxy_module	HTTP/2 request injection
CVE-2026-42945	ngx_http_rewrite_module	Buffer overflow
CVE-2026-42946	ngx_http_scgi_module, ngx_http_uwsgi_module	Buffer overread
CVE-2026-42934	ngx_http_charset_module	Buffer overread
CVE-2026-40460	HTTP/3	Address spoofing
CVE-2026-40701	OCSP resolver	Use-after-free

Proposed code change

Request

Rebuild the linuxserver/swag image against nginx 1.30.1 (stable) so downstream deployments can pick up the fixes. Happy to validate a :nightly or pre-release tag if it's helpful before promotion to :latest.

[github-actions]

Thanks for opening your first issue here! Be sure to follow the relevant issue templates, or risk having this issue marked as invalid.

[aptalca]

This needs to be updated first: https://pkgs.alpinelinux.org/packages?name=nginx&branch=v3.23&repo=&arch=x86_64&origin=&flagged=&maintainer=

[j0nnymoe]

As we use alpine packages for nginx/swag, once they've updated their packages, they will feed down to our images.
Though it's worth noting that at least CVE-2026-42926 doesn't seem to be a concern for the version of nginx within swag.

We have:
nginx 1.28.3-r0
Affected:

Just going through to see if the other CVE's are the same.

[PetitGreg19]

nginx's version 1.28.3-r1 has been committed for Alpine 3.22 two hours ago, with security fixes for :

• CVE-2026-40460
• CVE-2026-40701
• CVE-2026-42934
• CVE-2026-42945
• CVE-2026-42946
  (nothing for CVE-2026-42926 but nginx 1.28.3 is not affected)
  Source : https://gitlab.alpinelinux.org/alpine/aports/-/blob/3.22-stable/main/nginx/APKBUILD
  The update from 1.28.3-r0 (the one included in SWAG 5.6.0-ls456) to 1.28.3-r1 is already available with basic command "apk update && apk upgrade" through console on Portainer for exemple.

Edit : nginx 1.28.3-r1 has been included in SWAG 5.6.0-ls458

[Roxedus]

https://github.com/linuxserver/docker-swag/releases/tag/5.6.0-ls458

[billchurch]

nginx's version 1.28.3-r1 has been committed for Alpine 3.22 two hours ago, with security fixes for :

• CVE-2026-40460
• CVE-2026-40701
• CVE-2026-42934
• CVE-2026-42945
• CVE-2026-42946
  (nothing for CVE-2026-42926 but nginx 1.28.3 is not affected)
  Source : https://gitlab.alpinelinux.org/alpine/aports/-/blob/3.22-stable/main/nginx/APKBUILD
  The update from 1.28.3-r0 (the one included in SWAG 5.6.0) to 1.28.3-r1 is already available with basic command "apk update && apk upgrade" through console on Portainer for exemple.

That works for me. It wasn't clear from their initial notification if they were back porting.

[aptalca]

New image with patches pushed earlier today