Dear Maintainer, * What led up to the situation? Debian backported a fix for CVE-2026-42533 and released 1.26.3-3+deb13u8. * What exactly did you do (or not do) that was effective (or ineffective)? I tried to build my nginx-dynamic-module package against the new nginx-dev package version. * What was the outcome of this action? Make throws the error: make[2]: *** No rule to make target 'src/http/ngx_http_script.hh', needed by 'objs/addon/nginx_module/ngx_http_passenger_module.o'. Stop. * What outcome did you expect instead? Make succeeds. * Investigation # on debian 13: apt update && apt install -y nginx-dev # snipped output from apt dpkg -L nginx-dev | grep -F 'ngx_http_script.hh' find /usr/share/nginx/src -name 'ngx_http_script.hh' -o -name 'ngx_stream_script.hh' ls -l /usr/share/nginx/src/src/http/ngx_http_script.hh ls: cannot access '/usr/share/nginx/src/src/http/ngx_http_script.hh': No such file or directory auto/modules was patched to include src/http/ngx_http_script.hh and that file is added to the source tree: https://mail-archive.com/debian-bugs-dist%40lists.debian.org/msg2120411.html?utm_source=chatgpt.com but that file isn't present in the nginx-dev package.
Hi,
thank you for the report.
The 1.26.3-3+deb13u8 update took particular care to preserve ABI
compatibility while backporting the fix for CVE-2026-42533.
Unfortunately, the backport added private *.hh headers to
ngx_module_deps in auto/modules. These dependencies are propagated to
third-party module builds, but the headers are not shipped in
nginx-dev. This mismatch caused the reported build failure.
I am working on a fix. It should remove the private headers from
auto/modules while keeping them available for the internal nginx
build. Here: "https://salsa.debian.org/nginx-team/nginx/-/work_items/47"
As a temporary workaround, the incorrect private-header dependencies
can be removed from the installed auto/modules file:
sed -i \
-e '/src\/http\/ngx_http_script\.hh/d' \
-e '/src\/stream\/ngx_stream_script\.hh/d' \
/usr/share/nginx/src/auto/modules
Thanks
Jan
Hi, We can release an incremental update to the existing DSA to address this regression whenever you are ready with a fix. Regards, Aron
Fixed in 1.26.3-3+deb13u9 Jan
Hello, Bug #1147527 in nginx reported by you has been fixed in the Git repository. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/nginx-team/nginx/-/commit/540580b6fe456a2033602e85f2bb631a4bd4f7f2------------------------------------------------------------------------ Import Debian changes 1.26.3-3+deb13u9 nginx (1.26.3-3+deb13u9) trixie-security; urgency=medium . * d/p/CVE-2026-42533.patch update: keep private script headers out of auto/modules' ngx_module_deps so third-party modules can be built against nginx-dev. (Closes: #1147527) * d/t/nginx-dev-test.sh add, verify that nginx-dev can build and load a minimal third-party dynamic HTTP module. ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1147527
Oh sorry, I dunno the etiquette around these things, everything’s perfect now. Cheers, Camden On Sep 17, 2026, at 11:13 PM, Debian Bug Tracking System <owner@bugs.debian.org> wrote: This is an automatic notification regarding your Bug report which was filed against the nginx-dev package: #1147527: nginx-dev: Missing header file in nginx-dev after backport It has been closed by Jan Mojžíš <noreply@salsa.debian.org> (reply to 1147527@bugs.debian.org, Jan Mojžíš <janmojzis@debian.org>). Their explanation is attached below along with your original report. If this explanation is unsatisfactory and you have not received a better one in a separate message then please contact Jan Mojžíš <noreply@salsa.debian.org> (reply to 1147527@bugs.debian.org, Jan Mojžíš <janmojzis@debian.org>) by replying to this email.------------------------------------------------------------------------ Import Debian changes 1.26.3-3+deb13u9 nginx (1.26.3-3+deb13u9) trixie-security; urgency=medium . * d/p/CVE-2026-42533.patch update: keep private script headers out of auto/modules' ngx_module_deps so third-party modules can be built against nginx-dev. (Closes: #1147527) * d/t/nginx-dev-test.sh add, verify that nginx-dev can build and load a minimal third-party dynamic HTTP module. ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1147527 From: Camden Narzt <camden.narzt@hotmail.com> Subject: nginx-dev: Missing header file in nginx-dev after backport Date: September 12, 2026 at 11:26:47 AM MDT To: Debian Bug Tracking System <submit@bugs.debian.org> Package: nginx-dev Version: 1.26.3-3+deb13u8 Severity: important X-Debbugs-Cc: camden.narzt@hotmail.com, team@security.debian.org Dear Maintainer, * What led up to the situation? Debian backported a fix for CVE-2026-42533 and released 1.26.3-3+deb13u8. * What exactly did you do (or not do) that was effective (or ineffective)? I tried to build my nginx-dynamic-module package against the new nginx-dev package version. * What was the outcome of this action? Make throws the error: make[2]: *** No rule to make target 'src/http/ngx_http_script.hh', needed by 'objs/addon/nginx_module/ngx_http_passenger_module.o'. Stop. * What outcome did you expect instead? Make succeeds. * Investigation # on debian 13: apt update && apt install -y nginx-dev # snipped output from apt dpkg -L nginx-dev | grep -F 'ngx_http_script.hh' find /usr/share/nginx/src -name 'ngx_http_script.hh' -o -name 'ngx_stream_script.hh' ls -l /usr/share/nginx/src/src/http/ngx_http_script.hh ls: cannot access '/usr/share/nginx/src/src/http/ngx_http_script.hh': No such file or directory auto/modules was patched to include src/http/ngx_http_script.hh and that file is added to the source tree: https://mail-archive.com/debian-bugs-dist%40lists.debian.org/msg2120411.html?utm_source=chatgpt.com but that file isn't present in the nginx-dev package.
We believe that the bug you reported is fixed in the latest version of
nginx, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 1147527@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Jan Mojžíš <janmojzis@debian.org> (supplier of updated nginx package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Tue, 15 Sep 2026 09:28:28 +0000
Source: nginx
Architecture: source
Version: 1.26.3-3+deb13u9
Distribution: trixie-security
Urgency: medium
Maintainer: Debian Nginx Maintainers <pkg-nginx-maintainers@alioth-lists.debian.net>
Changed-By: Jan Mojžíš <janmojzis@debian.org>
Closes: 1147527
Changes:
nginx (1.26.3-3+deb13u9) trixie-security; urgency=medium
.
* d/p/CVE-2026-42533.patch update: keep private script headers out of
auto/modules' ngx_module_deps so third-party modules can be built
against nginx-dev. (Closes: #1147527)
* d/t/nginx-dev-test.sh add, verify that nginx-dev can build and load
a minimal third-party dynamic HTTP module.
Checksums-Sha1:
c5290c39a068ff2a152ae0617092f78a39b45e63 3473 nginx_1.26.3-3+deb13u9.dsc
fef7d98e84ad3be1af8d19c6aaacb253179d8cd2 103108 nginx_1.26.3-3+deb13u9.debian.tar.xz
1ae77149b3fc8563047837c877cf32e2c4500be2 6199 nginx_1.26.3-3+deb13u9_source.buildinfo
Checksums-Sha256:
ede21ae86c60e8be4112f871d319724d19c0f1b3b1840aa9abbcce4c1a7244b9 3473 nginx_1.26.3-3+deb13u9.dsc
860b84ea2e0b394ef2124ce118f9479eea7e63d9a6c6991e5b965e7c21a4a407 103108 nginx_1.26.3-3+deb13u9.debian.tar.xz
98cb587828fdcd4dbba10ba347cc3ab436bd87c8570d182ab2e0e2d6f8f82aed 6199 nginx_1.26.3-3+deb13u9_source.buildinfo
Files:
61dc89f8a3446939846a840cf78386d1 3473 httpd optional nginx_1.26.3-3+deb13u9.dsc
828776bdba680e0fcd08290361c38896 103108 httpd optional nginx_1.26.3-3+deb13u9.debian.tar.xz
fec4963628021b59f0570fe7071df2bc 6199 httpd optional nginx_1.26.3-3+deb13u9_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQEzBAEBCgAdFiEExq6D0hxncEPaPayX+GQ1dHE8m64FAmqph20ACgkQ+GQ1dHE8
m64+CAf+O36elG7eFqKNIbIvTAw+aknNRf3ZLO0nIIyILgw8lmqr2kYU3kIG9fIH
oXnR8V8pi6DWwITtApxLxjT0vWqnRc/ovmh+ehdgaZa/9UvGcwhY7qrL94LBopJL
axR3ryYlpK6IJaKqS8DRDnIE+dBFmvQkUf2eb1DVeKCbvvu53/bLV7+WysBijDkA
/nGJFUEyCVk3N5Z7/n4jnctuU76txIb0iGmCkwmWm/O6fJrGhbfJSs/2P+iwUgZ1
euyAPqg2YYs/lKtnAhaZaf9r1Ag0jzGDwHukjFfyIz22S5Eme88gWpK1VdQMvoyF
iLeXV932h+y3vRZTdxgngFVYg4+RRQ==
=M2ns
-----END PGP SIGNATURE-----
Hello, Bug #1147527 in nginx reported by you has been fixed in the Git repository. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/nginx-team/nginx/-/commit/540580b6fe456a2033602e85f2bb631a4bd4f7f2------------------------------------------------------------------------ Import Debian changes 1.26.3-3+deb13u9 nginx (1.26.3-3+deb13u9) trixie-security; urgency=medium . * d/p/CVE-2026-42533.patch update: keep private script headers out of auto/modules' ngx_module_deps so third-party modules can be built against nginx-dev. (Closes: #1147527) * d/t/nginx-dev-test.sh add, verify that nginx-dev can build and load a minimal third-party dynamic HTTP module. ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1147527
Hello, Bug #1147527 in nginx reported by you has been fixed in the Git repository. You can see the commit message below and you can check the diff of the fix at: https://salsa.debian.org/nginx-team/nginx/-/commit/540580b6fe456a2033602e85f2bb631a4bd4f7f2------------------------------------------------------------------------ Import Debian changes 1.26.3-3+deb13u9 nginx (1.26.3-3+deb13u9) trixie-security; urgency=medium . * d/p/CVE-2026-42533.patch update: keep private script headers out of auto/modules' ngx_module_deps so third-party modules can be built against nginx-dev. (Closes: #1147527) * d/t/nginx-dev-test.sh add, verify that nginx-dev can build and load a minimal third-party dynamic HTTP module. ------------------------------------------------------------------------ (this message was generated automatically) -- Greetings https://bugs.debian.org/1147527