# nghttp2 1.68.1

nghttp2 - HTTP/2 C Library and tools

Snapshot of gominimal/pkgs commit `cd4b09dd2f492c47fba70eb1b8a8c724dabdc7e9` (pushed 2026-07-10T23:16:55.000Z).

## Install

```sh
min add nghttp2
```

## Direct advisories

| ID | Severity | CVSS | Fix status | Fixed version | Summary |
| --- | --- | --- | --- | --- | --- |
| CVE-2026-58055 | MEDIUM | — | fixed | — | nghttp2 nghttpx - HTTP Request/Response Smuggling via Upgrade Request with Content-Length |

## Transitive advisories

5 advisories inherited through runtime dependencies:

- CVE-2026-4046 (HIGH) via glibc
- CVE-2026-4437 (HIGH) via glibc
- CVE-2026-4438 (MEDIUM) via glibc
- CVE-2026-5450 (CRITICAL) via glibc
- CVE-2026-5928 (HIGH) via glibc

## Dependencies

- Build (7): base, cmake, make, toolchain, pkgconf, openssl, zlib
- Runtime (3): glibc, openssl, zlib

## Scorecard

| Category | Score | Band |
| --- | --- | --- |
| supply-chain | 56 | mid |
| advisories | 10 | low |
| quality | 30 | low |
| maintenance | 100 | perfect |
| licence | 90 | good |

## Links

- Homepage: https://nghttp2.org
- Package page (HTML): https://minimal.dev/pkgs/nghttp2
- JSON API (floats latest): https://minimal.dev/api/pkgs/nghttp2.json
- SBOM (CycloneDX 1.5): https://minimal.dev/api/pkgs/nghttp2/sbom.json