OpenResty 1.25.3.2 is a security update addressing a performance issue in our OpenResty branch of LuaJIT related to hash computation optimization. We sincerely apologize for any confusion and want to clarify that this issue originates from our branch, not from upstream LuaJIT. This update disables a specific optimization in LuaJIT that could potentially lead to severe performance degradation under certain circumstances (CVE-2024-39702). We would like to express our gratitude to Zhongwei Yao from Kong Inc. for reporting this issue.

Download this version here.

The (portable) source code distribution, the Win32/Win64 binary distributions, and the pre-built binary Linux packages for Ubuntu, Debian, Fedora, CentOS, RHEL, OpenSUSE, Amazon Linux are provided on this Download page.

This is the second OpenResty release based on the nginx 1.25.3 core.

Version highlights

• Applied a patch to our OpenResty branch of LuaJIT addressing performance issues related to hash computation optimization.

Full Change logs

Complete change logs since the last (formal) release, 1.25.3.1, can be browsed in the page Change Log for 1.25.3.x.

Testing

We have run extensive testing on our Amazon EC2 test cluster and ensured that all the components (including the Nginx core) play well together. The latest test report can always be found here:

https://qa.openresty.org/

We also always run our OpenResty Edge commercial software based on the latest open source version of OpenResty in our own global CDN network (dubbed "mini CDN") powering our openresty.org and openresty.com websites. See https://openresty.com/ for more details.

Community Support

See the Community Page.

Commercial Support

Commercial technical support and real-time noninvasive online monitoring and profiling solution is provided through the official OpenResty XRay product.

Feedback

Feedback on this release is more than welcome. Feel free to create new GitHub issues or send emails to one of our mailing lists.