NGINX Versions, EOL Dates, and Latest Releases (October 2026)

NGINX sits in front of a large share of production web traffic as the web server, reverse proxy, or load balancer. Its lifecycle matters more than most, and it is shorter than many teams assume. The open source project retires a stable branch every April and gives it no further fixes.

This page is the definitive reference for NGINX open source version support, end-of-life dates, and latest releases. It is updated as new versions ship. Data here is current as of October 29, 2026.

As of October 29, 2026, NGINX 1.30 (stable, latest 1.30.6) and 1.31 (mainline, latest 1.31.8) are the two supported branches. NGINX 1.29 reached end of life on May 13, 2026, and 1.28 on April 14, 2026. Both are unpatched upstream, and both are affected by CVEs fixed in the newer branches. The next scheduled EOL is NGINX 1.30, expected around April 2027 when the next stable branch ships. No date has been published yet.

How NGINX's Support Policy Works: Stable vs Mainline

NGINX open source runs two branches at a time. The mainline branch gets new features and fixes. Every April, the current mainline is forked into the next stable branch, and the previous stable branch is retired. Retirement means no more bug fixes or security patches for that branch, even if it is widely deployed.

NGINX does not use the LTS label for its releases. The stable branch fills that role in practice, but its window is about one year, not a fixed multi-year term. Third-party trackers sometimes tag even-numbered branches as LTS. The project itself does not make that promise.

NGINX Plus, the commercial edition, follows its own F5 release and support schedule with R-numbered releases. This page covers open source only.

Complete NGINX Version Timeline

Every branch before 1.25 is also end of life. The most recent of those, 1.24, ended April 23, 2024. That includes 1.18, 1.22, and 1.24, which some Linux distributions still package; those builds get fixes only from the distribution, not from nginx.org.

Latest NGINX Patch Release per Supported Branch

1.30.6 (stable, October 14, 2026). This release fixed five CVEs disclosed that day, listed in the table below. Stable users should be on 1.30.6 or later.

1.31.8 (mainline, October 21, 2026). The newest mainline release. The October security fixes shipped in 1.31.7 and 1.30.6 on the same day, so 1.31.7 is the first October build with those fixes.

The October fixes, as listed in the nginx.org security advisories:

Versions Reaching EOL Next

NGINX 1.30: Expected Around April 2027

NGINX 1.30 is the current stable branch. By the project's policy, it will be retired when the next stable branch ships, which should be around April 2027. The project has not published a date. Plan around April 2027 and watch the nginx.org announcements for the stable release that replaces it.

NGINX 1.31: Expected After 1.30

NGINX 1.31 is mainline today. It becomes stable when the next mainline is forked, and then it follows the same April retirement pattern. Teams that want the longest runway should run stable, since it gets fixes for a fixed window while mainline moves on faster.

What Happens After NGINX End of Life

When a branch reaches EOL, three things stop. Upstream stops shipping patches for that branch. Any CVE fixed in a newer branch stays open on the old one. And your scanners keep flagging it, which turns into audit findings.

NGINX 1.28 and 1.29 show what end of life looks like. Several recent CVEs affect them, and the upstream fix exists only in newer branches.

CVE-2026-42945 is a heap-based buffer overflow in ngx_http_rewrite_module. It affects 0.6.27 through 1.30.0, and the fix shipped in 1.30.1 and 1.31.0. NVD scores it CVSS 3.1 8.1 (High) and CVSS 4.0 9.2 (Critical). Both 1.28 and 1.29 are in the affected range, and neither branch received a fix. See the vulnerability directory entry.

CVE-2026-42055 is a heap-based buffer overflow in ngx_http_proxy_v2_module and ngx_http_grpc_module. It affects 1.13.10 through 1.31.1 and was fixed in 1.30.3 and 1.31.2. NVD scores it CVSS 3.1 8.1 (High). The directory entry covers it.

CVE-2026-42533 is a heap-based buffer overflow triggered by map with regex. It affects 0.9.6 through 1.31.2 and was fixed in 1.30.4 and 1.31.3. See the directory entry.

Four of the five October CVEs also cover 1.28 and 1.29, including CVE-2026-97629 and CVE-2026-97205. Those two branches are exposed to them with no upstream patch.

The compliance angle is concrete. Scanners flag these CVEs on any host running an EOL branch. PCI DSS requirement 6.3.3 expects known vulnerabilities to be patched, and SOC 2 and ISO 27001 auditors look for the same thing. An EOL branch with open CVEs is a finding.

Options for EOL NGINX Versions

Upgrade to a supported branch. For most teams this is the right answer. Move from 1.28 or 1.29 to 1.30.6 (stable) or 1.31.8 (mainline). Config compatibility across these releases is usually smooth, but test any dynamic or third-party modules, since they must be rebuilt against the new version. Module rebuilds are where upgrades usually take time.

Pick your branch on purpose. Stable gives you a longer runway on one branch. Mainline gets features faster and moves on sooner. Either way, schedule the next move before the April retirement, not after it.

Adopt Never-Ending Support (NES). HeroDevs NES for NGINX ships patched builds of a retired NGINX branch as signed deb and rpm packages and OCI images, with an SBOM and VEX statements. Coverage starts the day the upstream branch retires. The product page lists the currently covered versions, so check it before you buy. If you are on a retired branch and need time to migrate, contact HeroDevs.

One note on scope. NGINX the web server and Ingress NGINX, the Kubernetes controller, are separate projects with separate lifecycles. The Kubernetes project has retired ingress-nginx. If that is your stack, read The October 2026 NGINX CVEs and Ingress NGINX, which covers why the October fixes do not reach a stock Ingress NGINX deployment.

To check what you are running, use nginx -v, which prints a line such as nginx version: nginx/1.29.8. Distribution packages sometimes carry a vendor suffix, so confirm against the branch number.

Frequently Asked Questions

Does NGINX have LTS releases?

Not as a formal label. NGINX uses mainline and stable branches. The stable branch is the one most teams should run, and it is retired each April when the next stable branch ships.

What is the latest NGINX version?

As of October 29, 2026, the latest mainline release is 1.31.8 (October 21, 2026), and the latest stable release is 1.30.6 (October 14, 2026).

Is NGINX 1.28 still supported?

No. NGINX 1.28 reached end of life on April 14, 2026. Its last release was 1.28.3 on March 24, 2026, and it does not receive upstream security fixes.

Is NGINX 1.29 still supported?

No. NGINX 1.29 reached end of life on May 13, 2026, with 1.29.8 as its last release.

When does NGINX 1.30 reach end of life?

No date has been published. Based on the project's April retirement pattern, expect it around April 2027, when the next stable branch ships.

Is NGINX Plus on the same schedule?

No. NGINX Plus follows F5's commercial release schedule with R-numbered releases. This page covers NGINX open source only.

Taking Action on EOL NGINX Versions

Check your fleet against the table above before the next scan. Anything on 1.28 or 1.29 has open CVEs with no upstream fix. Anything on 1.30 should be on 1.30.6 at minimum. Then pick a plan for the April 2027 retirement, whether that is an upgrade, a mainline move, or Never-Ending Support while you migrate.