Angie and Angie PRO updated to version 1.12.2#
A maintenance release of Angie and Angie PRO 1.12.2 fixes one vulnerability, which affects only configurations that enable HTTP/3 alongside server blocks without it.
Maintenance releases of Angie and its commercial version Angie PRO — 1.12.2 — have been published. They fix a single vulnerability; the fix was ported from nginx 1.31.6.
Whether you need to install the update depends on your configuration. Three conditions have to hold at the same time:
Angie is built against an OpenSSL version without native HTTP/3 support — 3.5.0 or earlier, which is what most operating systems currently ship;
the default server for the address that accepted a plain HTTPS request also enables HTTP/3, through the
quicparameter of the listen directive, possibly on a different port;that request is then handled by a
serverblock without HTTP/3, selected by domain name through SNI.
When all three hold, limited worker process memory corruption or a worker process crash could occur (CVE-2026-90439). If your configuration does not enable HTTP/3 at all, this vulnerability does not affect you.
The bundled third-party module packages were also refreshed: three new modules, and version or source updates for ten more.
More details about the changes:
Have a great day!