nginx-1.28.0 stable version has been released, incorporating new features and bug fixes from the 1.27.x mainline branch — including memory usage and CPU usage optimizations in complex SSL configurations, automatic re‑resolution of hostnames in upstream groups, performance enhancements in QUIC, OCSP validation of client SSL certificates and OCSP stapling support in the stream module, variables support in the proxy_limit_rate, fastcgi_limit_rate, scgi_limit_rate, and uwsgi_limit_rate directives, the proxy_pass_trailers directive, and more.

Below is a release summary generated by GitHub.

What's Changed

• Hg to git transition by @arut in #112
• Added Code of Conduct by @Maryna-f5 in #105
• Added security policy by @Maryna-f5 in #108
• Added contributing guidelines by @Maryna-f5 in #107
• Added templates by @Maryna-f5 in #117
• Added CI based on GitHub Actions. by @thresheek in #114
• Update Typo in win-utf by @shaikhyaser in #123
• Proxy: proxy_pass_trailers directive. by @pluknet in #153
• SSL: optional ssl_client_certificate for ssl_verify_client. by @praveen-li in #143
• Added new primary README.md file. by @mtbChef in #165
• fix typo of bpf makefile debug option by @tzssangglass in #141
• SSL object cache by @pluknet in #140
• release-1.27.2 by @pluknet in #235
• Version bump. by @pluknet in #242
• Quic: prevent invalid stream frame retransmissions by @nandsky in #230
• Adding missing files from recent pcre2 library by @thierryba in #248
• Security: Update SECURITY.md by @jzebor-at-f5 in #254
• SSL: disabled TLSv1 and TLSv1.1 by default. by @pluknet in #252
• Upstream: re-resolvable servers by @bavshin-f5 in #208
• SSL: fixed MSVC compilation after ebd18ec. by @arut in #312
• "set by ngx_pcalloc" comments update by @pluknet in #247
• GitHub: Fix link to Contributing Guidelines by @callahad in #129
• Core: change TCP keepalive from ms to seconds on DragonFly BSD by @panjf2000 in #258
• SSL: error message default in object caching API. by @pluknet in #333
• Issue #330 missing double quote. by @nmentz in #339
• Mp4 stsc atom fixes by @arut in #345
• TLS default protocol versions fixup. by @pluknet in #327
• QUIC: prevented BIO leak in case of error. by @arut in #348
• Upstream: disallow empty path in proxy_store and friends. by @pluknet in #344
• QUIC: constant initialization by @pluknet in #243
• Allowed square brackets with portless IPv6 address. by @arut in #318
• Mail: handling of CAPABILITY in the LOGIN IMAP command. by @pluknet in #276
• nginx-1.27.3-RELEASE by @pluknet in #356
• Version bump. by @arut in #361
• QUIC: fixed client request timeout in 0-RTT scenarios. by @nandsky in #353
• Updated security policy to clarify experimental features by @jzebor-at-f5 in #404
• QUIC: ignore version negotiation packets. by @arut in #411
• QUIC: fixed accessing a released stream. by @arut in #413
• Year 2025. by @arut in #433
• Gzip: compatibility with recent zlib-ng 2.2.x versions. by @pluknet in #403
• On range failure, log expected range. by @aractnido in #346
• SSL cache part 2 by @pluknet in #287
• Upstream: fix NGX_COMPAT build without NGX_HTTP_SSL after 454ad0e. by @p-pautov in #463
• QUIC: added missing casts in iov_base assignments. by @bavshin-f5 in #479
• Configure: fixed --with-libatomic=DIR with recent libatomic_ops. by @pluknet in #460
• Misc: moved documentation in release tarballs. by @pluknet in #377
• Added "keepalive_min_timeout" directive. by @arut in #456
• SNI: added restriction for TLSv1.3 cross-SNI session resumption. by @pluknet in #493
• nginx-1.27.4-RELEASE by @pluknet in #494
• Version bump. by @pluknet in #530
• Core: fix build without libcrypt by @orgads in #514
• Configure: MSVC compatibility with PCRE2 10.45. by @thierryba in #527
• Add gitignore file. by @orgads in #518
• Fixed request counting with subrequests in case of error. by @pluknet in #515
• SSL: workaround for saving big sessions from upstream servers by @pluknet in #536
• Slice filter: improved memory allocation error handling. by @pluknet in #552
• Charset filter: improved validation of charset_map with utf-8. by @pluknet in #553
• Upstream: fixed passwords support for dynamic certificates. by @pluknet in #528
• SSL: external groups support in $ssl_curve and $ssl_curves. by @pluknet in #609
• CUBIC congestion control in QUIC by @arut in #443
• nginx-1.27.5-RELEASE by @pluknet in #625
• stable-1.28 by @pluknet in #647

New Contributors

• @Maryna-f5 made their first contribution in #105
• @thresheek made their first contribution in #114
• @shaikhyaser made their first contribution in #123
• @praveen-li made their first contribution in #143
• @tzssangglass made their first contribution in #141
• @thierryba made their first contribution in #248
• @jzebor-at-f5 made their first contribution in #254
• @callahad made their first contribution in #129
• @panjf2000 made their first contribution in #258
• @nmentz made their first contribution in #339
• @aractnido made their first contribution in #346
• @p-pautov made their first contribution in #463
• @orgads made their first contribution in #514

Full Changelog: release-1.26.3...release-1.28.0