nginx 1.26

nginx 1.26 is the stable line that incorporated functionality developed during the preceding mainline series. Its notable protocol change was the availability of the experimental HTTP/3 and QUIC implementation through ngx_http_v3_module, including QUIC listener configuration and related variables and directives. HTTP/3 was not enabled by default: it required an appropriate build, a compatible TLS library, and UDP exposure in the network path. The line also reflects HTTP/2 configuration changes made in that development series: the http2 parameter on listen was deprecated in favor of the separate http2 directive, while HTTP/2 server push and its associated directives were removed. Configurations relying on the removed push directives need to be changed before adopting this line.

This nginx cycle has reached end of life, so upstream no longer provides further maintenance releases for it. Remaining on it means newly identified security issues, HTTP and TLS interoperability defects, and operational bugs will not receive fixes in the 1.26 line. The risk is greater for internet-facing reverse proxies and for deployments using HTTP/3, where browser, TLS-library, kernel, and network behavior can expose compatibility problems outside the scope of the retired line. Staying also increases the eventual migration gap, including configuration deprecations and incompatibilities with newer third-party dynamic modules.

Plan an upgrade to a currently maintained nginx line and test it first in a representative non-production environment. Inventory the nginx build, included modules, dynamic modules, TLS library, operating-system packages, and configuration fragments; dynamic modules should be rebuilt or replaced for the target nginx version. Run nginx -t against the migrated configuration, replace any legacy HTTP/2 server-push directives, and move HTTP/2 enablement away from the deprecated listen parameter where practical. If HTTP/3 is in use, test both TCP/TLS fallback and QUIC over UDP through the real load balancer, firewall, and CDN path. Roll out gradually with monitoring for startup failures, upstream connection errors, handshake failures, response-status changes, and latency regressions, while retaining a tested rollback path.