Dear Maintainer,

   * What led up to the situation?

Debian backported a fix for CVE-2026-42533 and released 1.26.3-3+deb13u8.

   * What exactly did you do (or not do) that was effective (or ineffective)?

I tried to build my nginx-dynamic-module package against the new nginx-dev package version.

   * What was the outcome of this action?

Make throws the error: make[2]: *** No rule to make target 'src/http/ngx_http_script.hh', needed by 'objs/addon/nginx_module/ngx_http_passenger_module.o'. Stop.

   * What outcome did you expect instead?

Make succeeds.


   * Investigation
# on debian 13:
apt update && apt install -y nginx-dev
# snipped output from apt
dpkg -L nginx-dev | grep -F 'ngx_http_script.hh'
find /usr/share/nginx/src -name 'ngx_http_script.hh' -o -name 'ngx_stream_script.hh'
ls -l /usr/share/nginx/src/src/http/ngx_http_script.hh
 ls: cannot access '/usr/share/nginx/src/src/http/ngx_http_script.hh': No such file or directory


auto/modules was patched to include src/http/ngx_http_script.hh and that file is added to the source tree: https://mail-archive.com/debian-bugs-dist%40lists.debian.org/msg2120411.html?utm_source=chatgpt.com

but that file isn't present in the nginx-dev package.

Hi,

thank you for the report.

The 1.26.3-3+deb13u8 update took particular care to preserve ABI
compatibility while backporting the fix for CVE-2026-42533.
Unfortunately, the backport added private *.hh headers to
ngx_module_deps in auto/modules. These dependencies are propagated to
third-party module builds, but the headers are not shipped in
nginx-dev. This mismatch caused the reported build failure.

I am working on a fix. It should remove the private headers from
auto/modules while keeping them available for the internal nginx
build.  Here: "https://salsa.debian.org/nginx-team/nginx/-/work_items/47"

As a temporary workaround, the incorrect private-header dependencies
can be removed from the installed auto/modules file:

sed -i \
    -e '/src\/http\/ngx_http_script\.hh/d' \
    -e '/src\/stream\/ngx_stream_script\.hh/d' \
    /usr/share/nginx/src/auto/modules

Thanks
Jan

Hi,

We can release an incremental update to the existing DSA to address
this regression whenever you are ready with a fix.

Regards,
Aron

Fixed in 1.26.3-3+deb13u9

Jan