Web servers and proxies
NGINX has 2 supported release lines and HAProxy has 6. HAProxy 3.3 reaches end of life on Jan 1, 2027, and NGINX 1.29 reached end of life on May 13, 2026. Both are open source: NGINX under BSD-2-Clause, HAProxy under GPL-2.0.
Last checked against endoflife.date and deps.dev.
Every value links to its source. Where a row doesn’t apply to one of them, the cell says why.
| Compared on |  NGINX |  HAProxy |
|---|---|---|
| Support and releases | ||
| Supported release lines | 6 lines: 3.4 LTS, 3.3, 3.2 LTS, 3.0 LTS, 2.8 LTS and 1 more Next to end: 3.3 on Jan 1, 2027 | |
| Latest release | ||
| Releases in the last 12 months | ||
| Security | ||
| Advisories published in the last 12 months | Not tracked as a package on OSV.dev | Not tracked as a package on OSV.dev |
| OpenSSF Scorecard | ||
| Licence and hosting | ||
| Licence | GPL-2.0 Open source (copyleft) The exportable include files are LGPL, so external modules can be non-GPL. | |
| How you run it | Self-hosted; NGINX Plus is the commercial edition | Self-hosted; HAProxy Enterprise is the commercial edition |
| Adoption | ||
| GitHub stars | ||
| NGINX | HAProxy |
|---|---|
| Supported release lines | |
6 lines: 3.4 LTS, 3.3, 3.2 LTS, 3.0 LTS, 2.8 LTS and 1 more Next to end: 3.3 on Jan 1, 2027 | |
| Latest release | |
| Releases in the last 12 months | |
| NGINX | HAProxy |
|---|---|
| Advisories published in the last 12 months | |
Not tracked as a package on OSV.dev | Not tracked as a package on OSV.dev |
| OpenSSF Scorecard | |
| NGINX | HAProxy |
|---|---|
| Licence | |
GPL-2.0 Open source (copyleft) The exportable include files are LGPL, so external modules can be non-GPL. | |
| How you run it | |
Self-hosted; NGINX Plus is the commercial edition | Self-hosted; HAProxy Enterprise is the commercial edition |
| NGINX | HAProxy |
|---|---|
| GitHub stars | |
Read across for what matters to you. Each answer comes from the data above or the project’s licence and hosting options.
| If you need | NGINX | HAProxy |
|---|---|---|
| An open-source licence | Yes: BSD-2-Clause | Yes: GPL-2.0 |
| Someone else runs it for you | No: You run it yourself | No: You run it yourself |
| You can run it on your own servers | Yes: Yes, it’s software you install | Yes: Yes, it’s software you install |
| A long support window | No end dates published | 3.4 LTS is supported until Apr 1, 2031 |
| NGINX | HAProxy |
|---|---|
| An open-source licence | |
Yes: BSD-2-Clause | Yes: GPL-2.0 |
| Someone else runs it for you | |
No: You run it yourself | No: You run it yourself |
| You can run it on your own servers | |
Yes: Yes, it’s software you install | Yes: Yes, it’s software you install |
| A long support window | |
No end dates published | 3.4 LTS is supported until Apr 1, 2031 |
High-performance web server and reverse proxy
Reliable, high-performance TCP/HTTP load balancer
From StackPrism’s curated notes. Pricing isn’t covered here: it changes often, so check each vendor’s pricing page.
Both sit in front of your application servers, but they started from different jobs: NGINX as a web server that also proxies and load-balances, HAProxy as a dedicated TCP and HTTP load balancer with detailed health checks and statistics. HAProxy publishes long-term support branches, which shows in the support data below.
Release lines and end-of-life dates come from endoflife.date, release counts from deps.dev’s publish dates, and advisories from OSV.dev, counted once per flaw even when it’s listed under several ids, and checked against CISA’s list of vulnerabilities known to be exploited. Status and incident history come from each vendor’s public status feed; licences from each project’s licence file or the vendor’s licensing page, linked in the table.
The data refreshes every few hours and the time it was checked is shown above. There’s no pricing and no overall winner: which one fits depends on your constraints. To see how the versions you actually run hold up, check your repo.
Paste a public GitHub repo and see what’s vulnerable, end of life or deprecated in it today. Free, no sign-up.