Angie and Angie PRO updated to version 1.12.2#

17.09.2026

A maintenance release of Angie and Angie PRO 1.12.2 fixes one vulnerability, which affects only configurations that enable HTTP/3 alongside server blocks without it.

Maintenance releases of Angie and its commercial version Angie PRO — 1.12.2 — have been published. They fix a single vulnerability; the fix was ported from nginx 1.31.6.

Whether you need to install the update depends on your configuration. Three conditions have to hold at the same time:

  • Angie is built against an OpenSSL version without native HTTP/3 support — 3.5.0 or earlier, which is what most operating systems currently ship;

  • the default server for the address that accepted a plain HTTPS request also enables HTTP/3, through the quic parameter of the listen directive, possibly on a different port;

  • that request is then handled by a server block without HTTP/3, selected by domain name through SNI.

When all three hold, limited worker process memory corruption or a worker process crash could occur (CVE-2026-90439). If your configuration does not enable HTTP/3 at all, this vulnerability does not affect you.

The bundled third-party module packages were also refreshed: three new modules, and version or source updates for ten more.

More details about the changes:

Have a great day!