Installing NES for NGINX

Download, verify and install the NES for NGINX RPM packages on RHEL 8, 9 and 10.

NES for NGINX 1.31.2, release v1.31.7-nes-1.31.2, is NGINX 1.31.7 with HeroDevs security fixes. Each release is a set of signed RPM packages for every supported platform.

Supported platforms

Platform	Architectures	Package file names
RHEL 8 (and UBI 8)	x86_64, aarch64	`<package>-v1.31.7-nes-1.31.2.el8.<architecture>.rpm`
RHEL 9 (and UBI 9)	x86_64, aarch64	`<package>-v1.31.7-nes-1.31.2.el9.<architecture>.rpm`
RHEL 10 (and UBI 10)	x86_64, aarch64	`<package>-v1.31.7-nes-1.31.2.el10.<architecture>.rpm`

Each platform has the packages nginx.org builds:

nginx: the server (nginx and nginx-debug), its systemd unit and the default configuration
nginx-module-njs: the njs scripting module, njs 1.0.2 with QuickJS 2026.06.04
nginx-module-xslt: the XSLT filter module
nginx-module-image-filter: the image filter module
a -debuginfo package for each of them, with debug symbols only

Each file name carries the release: <package>-v1.31.7-nes-1.31.2.el<RHEL version>.<architecture>.rpm, for example nginx-v1.31.7-nes-1.31.2.el9.x86_64.rpm. The packages themselves keep nginx.org's versioning: once installed, rpm -q nginx shows nginx-1.31.7-2.nes.el9.x86_64 on RHEL 9.

Each release also has one source RPM per RHEL version, such as nginx-v1.31.7-nes-1.31.2.el9.src.rpm, the signing key RPM-GPG-KEY-nginx-nes, and SHASUMS256.txt, the SHA-256 checksums of every file, with its signatures SHASUMS256.txt.asc (armored) and SHASUMS256.txt.sig (binary).

Access

NES for NGINX is distributed through the NES registry at registry.nes.herodevs.com and requires a HeroDevs access token. If you do not have an access token, contact support@herodevs.com. For more information see Access Tokens.

The files of a release are at https://registry.nes.herodevs.com/bin/nes/nginx/<release>/<file>, for example https://registry.nes.herodevs.com/bin/nes/nginx/v1.31.7-nes-1.31.2/SHASUMS256.txt. Authenticate with your contact e-mail and your access token (HTTP basic authentication).

Installation

Download the packages

Download the signing key, the checksums and the packages for your RHEL version and architecture. Leave out the modules you do not use.

RHEL 8 x86_64

RHEL 8 aarch64

RHEL 9 x86_64

RHEL 9 aarch64

RHEL 10 x86_64

RHEL 10 aarch64

base=https://registry.nes.herodevs.com/bin/nes/nginx/v1.31.7-nes-1.31.2
for f in \
    RPM-GPG-KEY-nginx-nes \
    SHASUMS256.txt \
    SHASUMS256.txt.asc \
    nginx-v1.31.7-nes-1.31.2.el8.x86_64.rpm \
    nginx-module-njs-v1.31.7-nes-1.31.2.el8.x86_64.rpm \
    nginx-module-xslt-v1.31.7-nes-1.31.2.el8.x86_64.rpm \
    nginx-module-image-filter-v1.31.7-nes-1.31.2.el8.x86_64.rpm; do
  curl -fSLO -u "<your-contact-email>:<your-nes-access-token>" "$base/$f"
done

Verify the downloads

The release is signed with the HeroDevs release signing key, HeroDevs Releases (HeroDevs release signing key) <releases@herodevs.com>, fingerprint CA44E935A3995EB733AF292B18DD1E9212F3C6A2. Check the key, then the signature of SHASUMS256.txt, then the checksums of the files you downloaded:

gpg --show-keys RPM-GPG-KEY-nginx-nes    # must show CA44E935A3995EB733AF292B18DD1E9212F3C6A2
gpg --import RPM-GPG-KEY-nginx-nes
gpg --verify SHASUMS256.txt.asc SHASUMS256.txt
sha256sum -c --ignore-missing SHASUMS256.txt

Install the packages

Import the signing key into the RPM database once, then install the packages. dnf does not check the signature of a local file unless told to, hence localpkg_gpgcheck:

sudo rpm --import RPM-GPG-KEY-nginx-nes
rpm -K ./nginx-*.rpm    # each must say "digests signatures OK"
sudo dnf install --setopt=localpkg_gpgcheck=1 ./nginx-*.rpm

Load the modules you installed as with nginx.org's packages, for example load_module modules/ngx_http_js_module.so; at the top of /etc/nginx/nginx.conf.

Check the installation

nginx -v shows the NES build, for example nginx version: nginx/1.31.7-nes. The Server response header and error pages say nginx/1.31.7-nes too, unless server_tokens is off.

Upgrading

Installing a newer NES for NGINX release, or NES for NGINX over nginx.org's packages of the same NGINX version, upgrades the packages in place, the same way: download the new release's files, verify them, and dnf install them. As with nginx.org's packages, the upgrade keeps the configuration files you changed and, when nginx is running, replaces the running binary without dropping connections (service nginx upgrade).