The Nginx CGI module has released version 0.15.1, addressing a crash in the cgi_set_var directive caused by unterminated string values that led to silent 500 errors. This fix was developed through collaboration among contributors who identified and resolved issues with the initial patch that failed to compile and introduced additional bugs. The release also emphasizes the deprecation of the REMOTE_USER variable for security reasons, ensuring that sensitive data is not inadvertently exposed in CGI scripts. Despite its performance limitations, the Nginx CGI module remains valuable for low-traffic applications, and version 0.15.1 is recommended for those utilizing CGI with Nginx

Nginx CGI v0.15.1 Fixes cgi_set_var Crash in Nginx CGI Module

A new version of the open-source Nginx CGI module is available, fixing a crash in the cgi_set_var directive caused by unterminated string values bleeding into adjacent memory. The bug produced silent 500 errors and only surfaced under AddressSanitizer, since the project's normal test harness masks the out-of-bounds read. The fix took shape across three GitHub accounts, friendlyanon reported it, and package maintainer dvershinin refined the patch against stock Nginx 1.30.0 after the initial version both failed to compile and introduced its own buffer overflow. The release also rides on the security-focused v0.15, which deprecated the REMOTE_USER variable, and it offers native CGI support across Linux, macOS, BSD, and Solaris without requiring a reverse proxy.

Nginx CGI v0.15.1 Fixes cgi_set_var Crash in Nginx CGI Module @ Linux Compatible