nginx: upgrade to v1.30.1 to fix CVE-2026-42945

[dcasota]

Summary

Upgrade nginx from 1.27.1 to 1.30.1 and njs from 0.8.4 to 0.9.8 on
Photon OS master.

nginx 1.30.1 (released 2026-05-13) fixes six vulnerabilities in one
coordinated disclosure. The prior stable lines received no further
releases after the disclosure — moving to the 1.30 stable branch is
required to pick up all fixes:

CVE-2026-42945 heap buffer overflow in ngx_http_rewrite_module (CVSS 9.2)
CVE-2026-42926 proxy_set_body data injection
CVE-2026-42946 scgi/uwsgi buffer overread
CVE-2026-42934 charset_map buffer overread
CVE-2026-40460 HTTP/3 connection migration spoofing
CVE-2026-40701 use-after-free in DNS / ssl_ocsp

Root cause of CVE-2026-42945: in ngx_http_script_regex_end_code()
(src/http/ngx_http_script.c), a rewrite replacement containing '?' sets
e->is_args = 1 on the main script engine and never clears it. A subsequent
set/if directive sizes its buffer on a fresh sub-engine (no escaping), but
copies using the main engine (NGX_ESCAPE_ARGS active), expanding '+', '%',
'&' bytes by two each and overrunning the heap. Upstream fix: commit
524977e7c534.

Two sha512 checksums updated to match the nginx 1.30.1 and njs 0.9.8
source tarballs.

Downstream: Harbor goharbor/nginx-photon installs nginx via tdnf,
making every Harbor v2.x release on Photon master affected.

Fixes: CVE-2026-42945
CVE: CVE-2026-42945
Reported-by: DepthFirstDisclosures https://github.com/DepthFirstDisclosures/Nginx-Rift
Reported-by: Yaminyam vmware#1654
Signed-off-by: Daniel Casota dcasota@gmail.com

References

• https://github.com/DepthFirstDisclosures/Nginx-Rift
• https://nginx.org/en/security_advisories.html
• nginx/nginx@524977e7c534
• https://nvd.nist.gov/vuln/detail/CVE-2026-42945
• Photon 5 nginx (1.28.3) vulnerable to CVE-2026-42945 — upstream patch only in 1.30.1+ vmware/photon#1654

Test plan

• tdnf install nginx installs 1.30.1-1
• nginx -v reports nginx/1.30.1
• nginx -t passes with default config
• Build succeeds with updated sha512 checksums
• nginx-ingress is NOT affected (Go controller only, no nginx C code)

Operator notes — behavioral changes

This version bump spans nginx 1.27.1 → 1.30.1 and njs 0.8.4 → 0.9.8.
The following silent behavioral changes may affect existing configurations.

nginx

proxy_http_version default changed to 1.1 (nginx 1.29.7)
The default proxy_http_version changed from 1.0 to 1.1, and the
Connection header is no longer forwarded to upstream. Most backends handle
this transparently; HTTP/1.0-only backends require an explicit override:

proxy_http_version 1.0;

Upstream keepalive enabled by default (nginx 1.29.7)
Keepalive connections to upstream servers are now enabled by default.
To restore the previous per-request connection behavior:

keepalive 0;

TLSv1 and TLSv1.1 removed from default ssl_protocols (nginx 1.27.3)
The default ssl_protocols value no longer includes TLSv1 and TLSv1.1.
Configurations serving legacy TLS 1.0/1.1 clients must add an explicit
ssl_protocols directive.

Chunked transfer encoding: bare \n line endings rejected (nginx 1.29.4)
Chunked requests using \n instead of \r\n as line terminators are
rejected with 400. This is RFC 7230 compliant; non-conforming upstream
clients must be fixed.

RFC 3986 Host header validation (nginx 1.29.4)
Invalid characters in the Host header now result in a 400 response.

TLSv1.3 certificate compression disabled by default (nginx 1.29.1)
To re-enable: ssl_certificate_compression on;

njs (0.8.4 → 0.9.8, dynamic module)

Binary data handling changed (njs 0.8.5)
Binary data is no longer transparently stored in JS strings. Scripts that
process binary response or request bodies must switch to r.rawVariables
or r.requestBuffer.

Removed String encoding methods (njs 0.9.0)
String.bytesFrom(), fromBytes(), fromUTF8(), toBytes(), toUTF8(),
and toString(encoding) are removed. Scripts using these methods will fail
at load time. Because njs is a dynamic module on master, nginx continues
running — only the njs module fails to load, leaving js_* directives
non-functional.

[dcasota]

Superseded. This proposed nginx 1.30.1 for CVE-2026-42945; vmware/5.0 now ships 1.30.4, and PRs vmware#1664/vmware#1665/vmware#1666 upstream are moving the remaining branches to 1.30.4 for CVE-2026-42533. Reopen or rebase onto 1.30.4 if that CVE turns out not to be covered there.