nginx

How nginx versioning, EOL & security support work

nginx does not run a single sequential release line; it maintains two parallel branches at once. Mainline is where new features and all bug fixes land first, identified by an odd second version digit. Stable is forked periodically from mainline and carries forward only the fixes accumulated up to that fork point, identified by an even second version digit. Mainline gets new releases every few weeks; stable is updated far less often, only when a fix, especially a security fix, needs to be backported.

nginx discloses vulnerabilities through its official security advisories page, with the reporting process documented in its GitHub repository. Each advisory states exactly which mainline and stable version ranges are vulnerable and which are fixed, and that fixed-version list only ever covers branches still receiving updates. Running an older version than the current fixed line means an already-public, already-patched vulnerability can be sitting unaddressed in that install.

Sources: nginx: NGINX Versioning Explained, nginx Security Advisories

Data sourced from endoflife.date.