EasyApache4 v25.28 Maintenance and Security Release

Webpros has released an update for EasyApache 4!  Take a look at some highlights below, and then join us on the cPanel Community Forums, Discord, or Reddit to talk about this update and much more. If you have additional questions, feel free to reach out on one of our social channels.

• ea-nginx
  • EA-13069: Update ea-nginx from v1.26.3 to v1.29.1
  • [CVE-2025-53859] A security issue in ngx_mail_smtp_module,which might allow an attacker to cause buffer over-read

• ea-nginx-echo
  • EA-13069: Build against ea-nginx version v1.29.1

• ea-nginx-headers-more
  • EA-13069: Build against ea-nginx version v1.29.1

• ea-nginx-njs
  • EA-13069: Build against ea-nginx version v1.29.1

• ea-nginx-passenger
  • EA-13069: Build against ea-nginx version v1.29.1

• ea-modsec30-connector-nginx
  • EA-13069: Build against ea-nginx version v1.29.1

• ea-libcurl
  • EA-13099: Update ea-libcurl from v8.15.0 to v8.16.0
  • CVE-2025-10148: predictable WebSocket mask

• ea-tomcat101
  • EA-13090: Update ea-tomcat101 from v10.1.44 to v10.1.45

• ea-nghttp2
  • EA-13085: Update ea-nghttp2 from v1.66.0 to v1.67.0

• ea-php81
  • EA4-122: map u24 libodbc for PHP extension

• ea-php82
  • EA4-122: map u24 libodbc for PHP extension

• ea-php83
  • EA4-122: map u24 libodbc for PHP extension

• ea-php84
  • EA4-122: map u24 libodbc for PHP extension

SUMMARY

WebPros International, LLC has updated packages for EasyApache 4 with updated versions of ea-nginx and ea-libcurl. This release addresses vulnerabilities related to CVE-2025-53859 and CVE-2025-10148. We strongly encourage all NGINX users to update to version 1.29.1 and all libcurl users to update to version 8.16.0.

AFFECTED VERSIONS

All versions of ea-nginx through 1.26.3.
All versions of ea-libcurl through 8.15.0.

SECURITY RATING

CVE-2025-53859 – MEDIUM
NGINX 1.29.1
Fixed vulnerability related to CVE-2025-53859.

CVE-2025-10148 – MEDIUM
libcurl v8.16.0
Fixed vulnerability related to CVE-2025-10148.

SOLUTION

WebPros International, LLC has released updated packages for EasyApache 4 on 2025 September 17, with NGINX v1.29.1 and libcurl 8.16.0. Unless you have enabled automatic package updates in your cron, update your system with either your package manager or WHM’s Run System Update interface.

REFERENCES
https://www.cve.org/CVERecord?id=CVE-2025-53859
https://www.cve.org/CVERecord?id=CVE-2025-10148
https://curl.se/changes.html
https://nginx.org/en/CHANGES

Information about all releases this year can be found in the 2025 EasyApache 4 Changelog.

You can follow our RSS feed for all our releases here: https://docs.cpanel.net/release-notes/release-notes/index.xml

GPG signed copy of this announcement: https://news.cpanel.com/wp-content/uploads/2025/09/EA4-25.28-CVE.signed.txt