Unexpected Response Injection in ModSecurity-nginx

I am encountering unexpected behavior when using ModSecurity-nginx with a specific commit of the ModSecurity-nginx repository.

Starting from commit 62639fa2be3839e14e284d13c16516889feb8afb (dated June 18, 2024),
I noticed that ModSecurity began injecting unexpected data into the response.

This issue was not present in commit ef64996aedd4bb5fa1831631361244813d48b82f (dated May 23, 2024), which was the last working version for me.

My build script use these repositories

NGINX_REPO="https://github.com/nginx/nginx.git"

MODSECURITY_REPO="https://github.com/SpiderLabs/ModSecurity.git"

MODSECURITY_NGINX_REPO="https://github.com/SpiderLabs/ModSecurity-nginx.git"
MODSECURITY_NGINX_TARGET_COMMIT="ef64996aedd4bb5fa1831631361244813d48b82f"

CORERULESET_REPO="https://github.com/coreruleset/coreruleset.git"

Starting from commit 62639fa2be3839e14e284d13c16516889feb8afb,
I noticed that websites behind the reverse proxy began returning unexpected/random
characters in the response.

I attempted to download a file, such as example.com/test.png, through the reverse proxy.
When I compared the MD5 checksum of the file downloaded on the client versus the file on the server, the checksums did not match.

This issue does not occur with commit ef64996aedd4bb5fa1831631361244813d48b82f.
This indicates that something introduced in commit 62639fa2be3839e14e284d13c16516889feb8afb is modifying or injecting data into the responses.

I’m not very experienced with reporting issues, but I want to ensure this is as helpful as possible.
if there’s anything specific you need from me—logs,
configurations, or additional details—please let me know,
and I’ll be happy to provide them.

Compare ModSecurity-nginx commits ef64996aedd4bb5fa1831631361244813d48b82f and 62639fa2be3839e14e284d13c16516889feb8afb, then inspect the response-handling changes in the ModSecurity-nginx repository. Reproduce the issue by downloading a file through the Nginx reverse proxy and comparing client and server MD5 checksums; done means responses are unchanged from the server data.