Nginx 1.29.8 and FreeNginx Patch Critical Vulnerabilities

Key Takeaways

• Nginx and FreeNginx have released urgent security updates, version 1.29.8, to address critical vulnerabilities and enhance server resilience.
• The updates introduce support for OpenSSL 4.0, new security directives like “max_headers,” and improve the “include” directive for geolocation management.
• The patches also resolve bugs related to HTTP 103 responses and internal routing issues, contributing to server stability and accurate logging.
• Web server administrators using either Nginx or FreeNginx are strongly advised to implement these updates immediately to mitigate potential cyber threats.

Nginx and its parallel project, FreeNginx, have rolled out critical security updates, urging web server administrators to prioritize immediate infrastructure patching. The new versions, both designated 1.29.8, were released on April 7, 2026, and introduce vital security enhancements, improved cryptographic compatibility, and crucial bug fixes aimed at bolstering server performance and defending against contemporary cyber threats.

FreeNginx, a fork spearheaded by core developer Maxim Dounin, consistently integrates these essential updates, guaranteeing that users across both web server ecosystems maintain robust protection.

Enhanced Cryptographic Security with OpenSSL 4.0

A significant advancement in the 1.29.8 release is the integration of support for OpenSSL 4.0. As cryptographic standards rapidly evolve to counteract sophisticated threat actors, maintaining compatibility with the latest OpenSSL frameworks is paramount for securing data in transit. This integration empowers administrators to leverage advanced encryption protocols, thereby safeguarding sensitive web traffic against modern interception techniques and newly identified cryptographic vulnerabilities.

New Security Controls and Directives

To further harden web servers against HTTP-based attacks, Nginx 1.29.8 introduces the new “max_headers” directive. Developed with contributions from Maxim Dounin, this feature enables administrators to impose strict limits on the maximum number of HTTP headers accepted in a client request. By restricting header counts, servers can effectively mitigate resource exhaustion attacks and prevent buffer overflow vulnerabilities, which are frequently exploited by denial-of-service threat actors.

Furthermore, the “include” directive within the “geo” block now supports wildcards. This quality-of-life improvement allows administrators to manage complex geolocation-based access control lists more efficiently, streamlining security configurations and IP blocking across large-scale server deployments.

Stability Improvements and Bug Fixes

Beyond the security enhancements, the update resolves specific processing errors that could negatively impact server stability. Developers addressed a bug related to the processing of HTTP 103 (Early Hints) responses when routed from a proxied backend. Fixing this ensures that browsers receive pre-load instructions smoothly without disrupting connection handling.

The release also addresses an internal routing issue where the request_port and is_request_port variables were previously unavailable in subrequests. Resolving this ensures that internal server routing and logging mechanisms function accurately, a critical component for incident response teams monitoring server traffic. For a complete list of changes, administrators can consult the official Nginx changelog.

What You Should Do

• Immediately apply the Nginx 1.29.8 or FreeNginx 1.29.8 updates to all affected web servers.
• Configure the new “max_headers” directive to limit the number of HTTP headers accepted, mitigating potential DoS and buffer overflow attacks.
• Leverage the updated OpenSSL 4.0 compatibility to ensure the use of the latest cryptographic protocols for secure data transmission.
• Review and update geolocation-based access control lists, utilizing the enhanced wildcard support in the “include” directive for streamlined management.
• Monitor server logs closely after applying updates to ensure all systems are functioning correctly and to identify any anomalies.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.