diff --git a/.hgtags b/.hgtags
index c2a4b98..910104d 100644
--- a/.hgtags
+++ b/.hgtags
@@ -437,3 +437,4 @@
 d2fd76709909767fc727a5b4affcf1dc9ca488a7 release-1.15.9
 75f5c7f628411c79c7044102049f7ab4f7a246e7 release-1.15.10
 5155d0296a5ef9841f035920527ffdb771076b44 release-1.15.11
+0130ca3d58437b3c7c707cdddd813d530c68da9a release-1.15.12
diff --git a/BUILD b/BUILD
index f3473f9..aec97eb 100644
--- a/BUILD
+++ b/BUILD
@@ -1537,5 +1537,5 @@
     preinst = "@nginx_pkgoss//:debian_preinst",
     prerm = "@nginx_pkgoss//:debian_prerm",
     section = "httpd",
-    version = "1.15.11",
+    version = "1.15.12",
 )
diff --git a/build.bzl b/build.bzl
index 9625839..89b3b38 100644
--- a/build.bzl
+++ b/build.bzl
@@ -673,9 +673,9 @@
         name = "nginx_pkgoss",
         build_file_content = _PKGOSS_BUILD_FILE.format(nginx = nginx) +
                              _PKGOSS_BUILD_FILE_TAIL,
-        commit = "df8c41c48db68971d6cdff38827175717298c8a2",  # nginx-1.15.11
+        commit = "9fc4aba9d4045cb0ff71d5809508be69136d8ca1",  # nginx-1.15.12
         remote = "https://nginx.googlesource.com/nginx-pkgoss",
-        shallow_since = "1554808864 +0300",
+        shallow_since = "1555425421 +0300",
     )
 
 def nginx_repositories_zlib(bind):
diff --git a/docs/xml/nginx/changes.xml b/docs/xml/nginx/changes.xml
index 0f68f9c..9a28034 100644
--- a/docs/xml/nginx/changes.xml
+++ b/docs/xml/nginx/changes.xml
@@ -5,6 +5,26 @@
 <change_log title="nginx">
 
 
+<changes ver="1.15.12" date="2019-04-16">
+
+<change type="bugfix">
+<para lang="ru">
+в рабочем процессе мог произойти segmentation fault,
+если в директивах ssl_certificate или ssl_certificate_key
+использовались переменные
+и был включён OCSP stapling.
+</para>
+<para lang="en">
+a segmentation fault might occur in a worker process
+if variables were used
+in the "ssl_certificate" or "ssl_certificate_key" directives
+and OCSP stapling was enabled.
+</para>
+</change>
+
+</changes>
+
+
 <changes ver="1.15.11" date="2019-04-09">
 
 <change type="bugfix">
diff --git a/misc/GNUmakefile b/misc/GNUmakefile
index 2a71ce0..0391a31 100644
--- a/misc/GNUmakefile
+++ b/misc/GNUmakefile
@@ -8,7 +8,7 @@
 OBJS =		objs.msvc8
 OPENSSL =	openssl-1.1.1b
 ZLIB =		zlib-1.2.11
-PCRE =		pcre-8.42
+PCRE =		pcre-8.43
 
 
 release: export
diff --git a/src/core/nginx.h b/src/core/nginx.h
index a377b06..3883d90 100644
--- a/src/core/nginx.h
+++ b/src/core/nginx.h
@@ -13,8 +13,8 @@
 #define NGINX_NAME         "nginx"
 #endif
 
-#define nginx_version      1015011
-#define NGINX_VERSION      "1.15.11"
+#define nginx_version      1015012
+#define NGINX_VERSION      "1.15.12"
 #define NGINX_VER          NGINX_NAME "/" NGINX_VERSION
 
 #ifdef NGX_BUILD
diff --git a/src/core/ngx_string.c b/src/core/ngx_string.c
index 04980f8..468e960 100644
--- a/src/core/ngx_string.c
+++ b/src/core/ngx_string.c
@@ -1381,7 +1381,7 @@
             continue;
         }
 
-        if (ngx_utf8_decode(&p, n) > 0x10ffff) {
+        if (ngx_utf8_decode(&p, last - p) > 0x10ffff) {
             /* invalid UTF-8 */
             return n;
         }
diff --git a/src/event/ngx_event_openssl_stapling.c b/src/event/ngx_event_openssl_stapling.c
index 7d0a170..c832aa0 100644
--- a/src/event/ngx_event_openssl_stapling.c
+++ b/src/event/ngx_event_openssl_stapling.c
@@ -511,6 +511,11 @@
     rc = SSL_TLSEXT_ERR_NOACK;
 
     cert = SSL_get_certificate(ssl_conn);
+
+    if (cert == NULL) {
+        return rc;
+    }
+
     staple = X509_get_ex_data(cert, ngx_ssl_stapling_index);
 
     if (staple == NULL) {