Stable Branch fix brotli CVE-2026-111497 in ngx_brotli build and add version guard …

fix brotli CVE-2026-111497 in ngx_brotli build and add version guard in 132.00stable

Brotli 1.0.3 to 1.2.0 have a decoder out-of-bounds write (CVE-2026-111497),
fixed in 1.0.10, 1.1.1 and 1.2.1. The ngx_brotli modules only use the encoder,
but the build also installs the brotli decoder library and CLI into
/usr/local/nginx-dep. The old build method (NGINX_BROTLI_NEW_METHOD='n', always
used on CentOS 6) built a vulnerable 2022 brotli snapshot.

Changes:
- old ngx_brotli build method checks out brotli v1.0.10 in the pinned
ngx_brotli 6e975bcb deps/brotli submodule
- new brotli_version_check(): ngxbrotli_download() fails the nginx build unless
/usr/local/nginx-dep brotli is 1.0.10, 1.1.1 or 1.2.1+ (also covers the
GitLab mirror fallback and NGINX_BROTLIDEP_UPDATE tag selection)
- tools/test-nginx-dependency-gcc15.sh: fake brotli for the mock build, guard
accept/reject cases and a failing build on brotli 1.2.0

---

Continue reading...

132.00stable branch

• Branch: https://github.com/centminmod/centminmod/tree/132.00stable
• Commit History: https://github.com/centminmod/centminmod/commits/132.00stable