Web server moves to a maintained nginx

Severity

Low

Affected

Atelier < 0.19.2

Fixed in

Atelier 0.19.2

References

CVE-2026-15176, CVE-2026-93479, CVE-2026-95101, CVE-2026-97205, CVE-2026-97629, CVE-2026-42533

Every Atelier install runs a small nginx web server in front of the site, called edge. It is the only part of the appliance that is reachable from the network. Until now it ran nginx 1.28.

nginx publishes security fixes only for its current versions. The fixes released in October 2026 shipped in nginx 1.30.6 and 1.31.7, and none of them for 1.28. We know of no way to exploit these flaws through Atelier's default web server setup: it uses none of the features the October flaws need, and the regular-expression rules it does use don't take the form that CVE-2026-42533 needs. A site's only public entry point should still run a version that gets fixes, so 0.19.2 moves it to nginx 1.30.

What changes

• The edge container runs nginx:1.30-alpine instead of nginx:1.28-alpine.
• How your site behaves does not change. The web server rules (edge.conf) are the same.

What to do

• With the Atelier manager: update the manager to 0.12.1 or newer, then run atelier app update. It changes the one line in compose.yaml, keeps any edits you made to the file, and restarts only the web server. This works even if your site is already on the latest version. atelier doctor shows "Web server receives security fixes" once it's done.
• Installed with the install script: re-run the installer as described in Upgrade. It rewrites compose.yaml with the new web server.
• If you edited edge.conf yourself: check that you don't use alias together with rewrite, AIO together with SSI, HTTP/3, or map blocks with regular-expression captures. If you do, update right away.