Nginx 1.31.4 Lands with PROXY Protocol v2 Support and gRPC Hardening
The latest mainline release focuses on feature completion and stability after a volatile security season.
Nginx 1.31.4 is out, and it's bringing native PROXY Protocol v2 to the stream and mail modules. If you're running a reverse proxy behind AWS NLB, GCP, or Azure load balancers, you can finally drop the third-party workarounds and use the built-in proxy_protocol directive. The binary-encoded TLVs and IPv6 support in v2 were already the cloud standard, but nginx kept treating it as an afterthought until now.
Tagged by @pluknet on August 19, 2026, this release rounds out the 1.31.x mainline cycle with a heavy focus on protocol correctness. The other headline change is how nginx handles HTTP/2 and gRPC headers. Backends will now consistently receive the :authority pseudo-header for HTTP/2 traffic and the standard Host header for HTTP/1.1. That should quiet a few annoying routing ambiguities in strict microservices setups.
The 1.31.x branch has had a rough patch. We're looking at over a dozen CVEs fixed between versions 1.31.0 and 1.31.3, mostly uncovered by Mufeed VH of Winfunc Research. Seven of those landed in the initial 1.31.0 release. This fourth patch is the team's way of saying the dust has finally settled. Zero new CVEs this time around. Instead, it's all about tightening up regressions and polishing the edges.
It's unusual to see one independent researcher accountable for more than a dozen CVEs against a single project in a single year. Either the codebase has genuine quality issues or Mufeed VH has become extraordinarily specialized in nginx internals. Either way, the maintainers have clearly finished wrangling the teething problems from the HTTP/2 and QUIC overhauls.
What else is in the box
You'll find a fix for a segmentation fault that could take down worker processes when the select() event method is active on legacy systems. There's also a hardening change for incomplete gRPC responses. Instead of silently passing truncated payloads downstream, nginx now flags them as malformed and rejects them. If you're running third-party modules like lua-nginx-module or njs, this release is particularly important. A binary compatibility regression introduced in 1.31.3 has been reversed, restoring the expected ABI contract for script-based extensions.
Embedded Perl got a memory and signal handling tweak from Debian maintainer David Carlier. The changelog doesn't spell out the exact flaw, but fixes in that module are notable because Embedded Perl has historically had subtle issues with memory management. Plus there are unspecified tweaks to HTTP/2, HTTP/3/QUIC, the image filter, and the gRPC module.
The 1.31.x branch remains the development track. Operators who prefer the long-term stable line should stick with 1.28.x, though you'll want to verify whether all the recent security patches have actually made it into your stable build. If they haven't, upgrading to the latest stable release is probably your safest bet until the next mainline drop.
Head here to grab the source if you want to build it yourself.
