Nginx 1.27.0 Released: QUIC Security Fixes and Rate-Limit Variables

What happened

Nginx 1.27.0 was released on May 29, 2024, according to the official Nginx CHANGES log. As an odd-numbered second version, it opened a new mainline development branch, succeeding the 1.25.x series that had introduced experimental HTTP/3 support.

QUIC security fixes

The release addressed several security issues in HTTP/3. The CHANGES log records that processing a specially crafted QUIC session might cause a worker-process crash, worker-process memory disclosure on systems with an MTU larger than 4096 bytes, or potential other impact, covering CVE-2024-32760, CVE-2024-31079, CVE-2024-35200 and CVE-2024-34161. These fixes hardened Nginx's still-maturing QUIC and HTTP/3 implementation.

Rate-limit variables

Nginx 1.27.0 added variables support to the proxy_limit_rate, fastcgi_limit_rate, scgi_limit_rate and uwsgi_limit_rate directives. This let operators set upstream rate limits dynamically based on request variables rather than fixed values, giving finer control over bandwidth to backends for different clients or routes.

Performance fixes

The release reduced memory consumption for long-lived requests when the gzip, gunzip, ssi, sub_filter or grpc_pass directives were used, fixed a build failure with GCC 14 when the with-libatomic option was set, and included further bug fixes and improvements in HTTP/3.

Why it mattered

Nginx 1.27.0 balanced security hardening with practical flexibility. Patching multiple QUIC vulnerabilities kept early HTTP/3 adopters safe, while dynamic rate-limit variables and memory-usage reductions gave operators more control and efficiency, continuing Nginx's steady mainline evolution.

Related on Skillo

See also: Nginx 1.25.0 and experimental HTTP/3, Nginx 1.29.0's Early Hints support.

Sources

• nginx CHANGES log (nginx.org)

Published date reflects the original event date (2024-05-29). This article is original Skillo editorial written from the sources above; facts were verified in September 2026.