nginx End of Life

nginx publishes no end-of-life dates at all. The blank date columns on this page are not missing data — no such dates exist. There is no official answer to "when does nginx x.y reach end of life?".

The only classification the project provides is on the download page: a mainline version (new features and fixes), a stable version (critical fixes only), and legacy versions with no stated position.

Security advisories are the usable signal. Recent advisories list the fixed versions, for example "Not vulnerable: 1.31.3+, 1.30.4+". Only the current mainline and stable branches appear there; legacy branches are not listed as fixed, which indicates that security fixes are not backported to legacy branches. Because this is an inference rather than an official declaration, this site does not mark those branches as end of life.

In practice, distribution packages are easier to manage. nginx packages from RHEL, Ubuntu and Debian receive backported fixes under the OS life cycle. Running nginx.org builds means keeping up with the current branch yourself; running distribution packages means your deadline is the operating system's.

Note that NGINX Plus, F5's commercial edition, has its own support policy and is not covered on this page.