NGINX 1.31.5: open-source Control API arrives, plus FastCGI, QUIC and HTTP/2 fixes

NGINX released version 1.31.5 of the mainline series on 2 September 2026, featuring a range of improvements that extends beyond the variable-based routing that had been discussed in recent days. The change that matters most to operators running NGINX in production is another: the Control API, previously exclusive to NGINX Plus, is now entering the open-source core.

Control API: reload with immediate JSON response

The feature most anticipated by infrastructure operators was the ability to inspect, validate and route API payloads directly at the network edge, but from an operational perspective the practical news is different. The Control API, first introduced in NGINX Plus R37.0, provides endpoints such as /1/control/processes and /1/control/config for runtime inspection and configuration reload with synchronous JSON feedback. To use it securely, it should be started on a UNIX socket with nginx -l unix:/tmp/nginx.sock: it is an unauthenticated interface to NGINX internals and must not be exposed on a network port. Reload is then invoked with a PATCH to /1/control/config, replacing the traditional nginx -s reload followed by manual log inspection.

Bugfixes affecting production

Beyond new features, the release corrects several defects that in some setups caused real errors. A fastcgi_param of 128 bytes or more, or a uwsgi_param of 256 bytes or more, was being truncated in the length field while the name remained fully copied: the backend would respond with a reset or connection close, and NGINX would return 502 on every request to that location. Also fixed were an overflow in memcached response validation near the maximum value, a bug in the slice filter that ignored Range requests near the upper limit, and a flaw in handling CRYPTO frames in QUIC 1-RTT packets that closed the connection due to key derivation failure.

A more serious fix concerns HTTP/2: a buffered response buffer could be recycled while the output filter was still using it, risking sending already-freed memory to the client or crashing the worker. Also corrected was a case in which a worker with a full file descriptor table could no longer shut down after receiving a shutdown signal.

Users upgrading from earlier 1.31.x versions will find the complete changelog in the release notes published on nginx.org and in the project's GitHub repository.