nginx 1.16

NGINX 1.16 is the stable line that consolidated functionality developed during the preceding mainline cycle, compared with the earlier 1.14 stable line. Notable additions available in this line include gRPC proxying, HTTP/2 server push controls, TLS 1.3 support when NGINX is built with a compatible OpenSSL version, and expanded stream-module protocol inspection capabilities such as ALPN detection. It also carries the intervening HTTP, proxying, caching, TLS, and bug-fix changes from the 1.15 development series. The final 1.16 maintenance update included fixes for defects found after the initial stable release, but the line did not receive fixes beyond that point.

NGINX 1.16 has reached end of life, so upstream no longer produces security, reliability, protocol, or compatibility fixes for it. A deployment on this line cannot receive later upstream corrections for issues in NGINX itself, including defects that may be exposed by hostile traffic or modern client behavior. Compatibility risk also increases as operating systems, OpenSSL builds, HTTP/2 and TLS expectations, and third-party dynamic modules move forward. Distribution maintainers may independently backport selected fixes, so the actual exposure depends on the package source and its patch set; however, a locally maintained 1.16 deployment requires the team to identify, assess, and carry any needed fixes itself. Remaining on the line also preserves older operational limitations and delays access to improvements in later supported NGINX releases.

Select a currently supported NGINX target line and confirm whether the deployment uses the upstream packages, an operating-system vendor package, a custom build, or NGINX Plus; those choices affect module compatibility and available backports. Inventory the current NGINX version, compile-time options, loaded dynamic modules, OpenSSL linkage, included configuration files, certificates, upstream definitions, cache settings, stream configuration, and automation that parses NGINX output. Build the target in a staging environment, run nginx -t against the complete rendered configuration, and test representative HTTP, HTTPS, HTTP/2, gRPC, WebSocket, proxy-cache, rate-limit, and TCP or UDP stream traffic where applicable. Validate TLS protocol and cipher behavior with the target OpenSSL and test reload, rollback, logging, metrics, and health-check procedures. Roll out through a canary or phased deployment with configuration and package rollback prepared, then retire the 1.16 packages and any custom patches that are no longer required.