diff --git a/.hgtags b/.hgtags
index 2fb896b..8127beb 100644
--- a/.hgtags
+++ b/.hgtags
@@ -419,3 +419,4 @@
 bbc642c813c829963ce8197c0ca237ab7601f3d4 release-1.13.4
 0d45b4cf7c2e4e626a5a16e1fe604402ace1cea5 release-1.13.5
 f87da7d9ca02b8ced4caa6c5eb9013ccd47b0117 release-1.13.6
+47cca243d0ed39bf5dcb9859184affc958b79b6f release-1.13.7
diff --git a/BUILD b/BUILD
index e755c70..326d3a4 100644
--- a/BUILD
+++ b/BUILD
@@ -1485,5 +1485,5 @@
     preinst = "@nginx_pkgoss//:debian_preinst",
     prerm = "@nginx_pkgoss//:debian_prerm",
     section = "httpd",
-    version = "1.13.6",
+    version = "1.13.7",
 )
diff --git a/build.bzl b/build.bzl
index 0cd4e49..d04e7c0 100644
--- a/build.bzl
+++ b/build.bzl
@@ -663,7 +663,7 @@
         name = "nginx_pkgoss",
         build_file_content = _PKGOSS_BUILD_FILE.format(nginx = nginx) +
                              _PKGOSS_BUILD_FILE_TAIL,
-        commit = "dbf0142dca592d4ba0c47c7837bbc473a043f19b",  # nginx-1.13.6
+        commit = "3f500f26ea239edfdd992040107872b88bac875d",  # nginx-1.13.7
         remote = "https://nginx.googlesource.com/nginx-pkgoss",
     )
 
diff --git a/docs/xml/nginx/changes.xml b/docs/xml/nginx/changes.xml
index 3058462..ec871d8 100644
--- a/docs/xml/nginx/changes.xml
+++ b/docs/xml/nginx/changes.xml
@@ -5,6 +5,89 @@
 <change_log title="nginx">
 
 
+<changes ver="1.13.7" date="2017-11-21">
+
+<change type="bugfix">
+<para lang="ru">
+в переменной $upstream_status.
+</para>
+<para lang="en">
+in the $upstream_status variable.
+</para>
+</change>
+
+<change type="bugfix">
+<para lang="ru">
+в рабочем процессе мог произойти segmentation fault,
+если бэкенд возвращал ответ "101 Switching Protocols" на подзапрос.
+</para>
+<para lang="en">
+a segmentation fault might occur in a worker process
+if a backend returned a "101 Switching Protocols" response to a subrequest.
+</para>
+</change>
+
+<change type="bugfix">
+<para lang="ru">
+если при переконфигурации изменялся размер зоны разделяемой памяти
+и переконфигурация завершалась неудачно,
+то в главном процессе происходил segmentation fault.
+</para>
+<para lang="en">
+a segmentation fault occurred in a master process
+if a shared memory zone size was changed during a reconfiguration
+and the reconfiguration failed.
+</para>
+</change>
+
+<change type="bugfix">
+<para lang="ru">
+в модуле ngx_http_fastcgi_module.
+</para>
+<para lang="en">
+in the ngx_http_fastcgi_module.
+</para>
+</change>
+
+<change type="bugfix">
+<para lang="ru">
+nginx возвращал ошибку 500,
+если в директиве xslt_stylesheet
+были заданы параметры без использования переменных.
+</para>
+<para lang="en">
+nginx returned the 500 error
+if parameters without variables were specified
+in the "xslt_stylesheet" directive.
+</para>
+</change>
+
+<change type="workaround">
+<para lang="ru">
+при использовании варианта библиотеки zlib от Intel
+в лог писались сообщения "gzip filter failed to use preallocated memory".
+</para>
+<para lang="en">
+"gzip filter failed to use preallocated memory" alerts appeared in logs
+when using a zlib library variant from Intel.
+</para>
+</change>
+
+<change type="bugfix">
+<para lang="ru">
+директива worker_shutdown_timeout не работала
+при использовании почтового прокси-сервера
+и при проксировании WebSocket-соединений.
+</para>
+<para lang="en">
+the "worker_shutdown_timeout" directive did not work
+when using mail proxy and when proxying WebSocket connections.
+</para>
+</change>
+
+</changes>
+
+
 <changes ver="1.13.6" date="2017-10-10">
 
 <change type="bugfix">
diff --git a/misc/GNUmakefile b/misc/GNUmakefile
index 074a47b..19a70e0 100644
--- a/misc/GNUmakefile
+++ b/misc/GNUmakefile
@@ -6,7 +6,7 @@
 
 CC =		cl
 OBJS =		objs.msvc8
-OPENSSL =	openssl-1.0.2l
+OPENSSL =	openssl-1.0.2m
 ZLIB =		zlib-1.2.11
 PCRE =		pcre-8.41
 
diff --git a/src/core/nginx.h b/src/core/nginx.h
index a53f5a8..0cc4623 100644
--- a/src/core/nginx.h
+++ b/src/core/nginx.h
@@ -13,8 +13,8 @@
 #define NGINX_NAME         "nginx"
 #endif
 
-#define nginx_version      1013006
-#define NGINX_VERSION      "1.13.6"
+#define nginx_version      1013007
+#define NGINX_VERSION      "1.13.7"
 #define NGINX_VER          NGINX_NAME "/" NGINX_VERSION
 
 #ifdef NGX_BUILD
diff --git a/src/core/ngx_conf_file.h b/src/core/ngx_conf_file.h
index 213611f..9cd5806 100644
--- a/src/core/ngx_conf_file.h
+++ b/src/core/ngx_conf_file.h
@@ -128,7 +128,7 @@
     ngx_uint_t            cmd_type;
 
     ngx_conf_handler_pt   handler;
-    char                 *handler_conf;
+    void                 *handler_conf;
 };
 
 
diff --git a/src/core/ngx_cycle.c b/src/core/ngx_cycle.c
index 675a506..f3ac24d 100644
--- a/src/core/ngx_cycle.c
+++ b/src/core/ngx_cycle.c
@@ -470,8 +470,6 @@
                 goto shm_zone_found;
             }
 
-            ngx_shm_free(&oshm_zone[n].shm);
-
             break;
         }
 
@@ -662,14 +660,26 @@
                 n = 0;
             }
 
-            if (oshm_zone[i].shm.name.len == shm_zone[n].shm.name.len
-                && ngx_strncmp(oshm_zone[i].shm.name.data,
-                               shm_zone[n].shm.name.data,
-                               oshm_zone[i].shm.name.len)
-                == 0)
+            if (oshm_zone[i].shm.name.len != shm_zone[n].shm.name.len) {
+                continue;
+            }
+
+            if (ngx_strncmp(oshm_zone[i].shm.name.data,
+                            shm_zone[n].shm.name.data,
+                            oshm_zone[i].shm.name.len)
+                != 0)
+            {
+                continue;
+            }
+
+            if (oshm_zone[i].tag == shm_zone[n].tag
+                && oshm_zone[i].shm.size == shm_zone[n].shm.size
+                && !oshm_zone[i].noreuse)
             {
                 goto live_shm_zone;
             }
+
+            break;
         }
 
         ngx_shm_free(&oshm_zone[i].shm);
diff --git a/src/http/modules/ngx_http_fastcgi_module.c b/src/http/modules/ngx_http_fastcgi_module.c
index 2696119..7ee515f 100644
--- a/src/http/modules/ngx_http_fastcgi_module.c
+++ b/src/http/modules/ngx_http_fastcgi_module.c
@@ -2646,6 +2646,7 @@
         }
     }
 
+    f->pos = p;
     f->state = state;
 
     return NGX_AGAIN;
diff --git a/src/http/modules/ngx_http_gzip_filter_module.c b/src/http/modules/ngx_http_gzip_filter_module.c
index 73b6d89..e4c343c 100644
--- a/src/http/modules/ngx_http_gzip_filter_module.c
+++ b/src/http/modules/ngx_http_gzip_filter_module.c
@@ -57,6 +57,7 @@
     unsigned             nomem:1;
     unsigned             gzheader:1;
     unsigned             buffering:1;
+    unsigned             intel:1;
 
     size_t               zin;
     size_t               zout;
@@ -233,6 +234,8 @@
 static ngx_http_output_header_filter_pt  ngx_http_next_header_filter;
 static ngx_http_output_body_filter_pt    ngx_http_next_body_filter;
 
+static ngx_uint_t  ngx_http_gzip_assume_intel;
+
 
 static ngx_int_t
 ngx_http_gzip_header_filter(ngx_http_request_t *r)
@@ -527,7 +530,27 @@
      *  *) 5920 bytes on amd64 and sparc64
      */
 
-    ctx->allocated = 8192 + (1 << (wbits + 2)) + (1 << (memlevel + 9));
+    if (!ngx_http_gzip_assume_intel) {
+        ctx->allocated = 8192 + (1 << (wbits + 2)) + (1 << (memlevel + 9));
+
+    } else {
+        /*
+         * A zlib variant from Intel, https://github.com/jtkukunas/zlib.
+         * It can force window bits to 13 for fast compression level,
+         * on processors with SSE 4.2 it uses 64K hash instead of scaling
+         * it from the specified memory level, and also introduces
+         * 16-byte padding in one out of the two window-sized buffers.
+         */
+
+        if (conf->level == 1) {
+            wbits = ngx_max(wbits, 13);
+        }
+
+        ctx->allocated = 8192 + 16 + (1 << (wbits + 2))
+                         + (1 << (ngx_max(memlevel, 8) + 8))
+                         + (1 << (memlevel + 8));
+        ctx->intel = 1;
+    }
 }
 
 
@@ -1003,7 +1026,7 @@
 
     alloc = items * size;
 
-    if (alloc % 512 != 0 && alloc < 8192) {
+    if (items == 1 && alloc % 512 != 0 && alloc < 8192) {
 
         /*
          * The zlib deflate_state allocation, it takes about 6K,
@@ -1025,9 +1048,14 @@
         return p;
     }
 
-    ngx_log_error(NGX_LOG_ALERT, ctx->request->connection->log, 0,
-                  "gzip filter failed to use preallocated memory: %ud of %ui",
-                  items * size, ctx->allocated);
+    if (ctx->intel) {
+        ngx_log_error(NGX_LOG_ALERT, ctx->request->connection->log, 0,
+                      "gzip filter failed to use preallocated memory: "
+                      "%ud of %ui", items * size, ctx->allocated);
+
+    } else {
+        ngx_http_gzip_assume_intel = 1;
+    }
 
     p = ngx_palloc(ctx->request->pool, items * size);
 
diff --git a/src/http/modules/ngx_http_ssi_filter_module.c b/src/http/modules/ngx_http_ssi_filter_module.c
index e2f507f..c05a5d6 100644
--- a/src/http/modules/ngx_http_ssi_filter_module.c
+++ b/src/http/modules/ngx_http_ssi_filter_module.c
@@ -1631,8 +1631,7 @@
     u_char                      ch, *p, **value, *data, *part_data;
     size_t                     *size, len, prefix, part_len;
     ngx_str_t                   var, *val;
-    ngx_int_t                   key;
-    ngx_uint_t                  i, n, bracket, quoted;
+    ngx_uint_t                  i, n, bracket, quoted, key;
     ngx_array_t                 lengths, values;
     ngx_http_variable_value_t  *vv;
 
@@ -1884,9 +1883,8 @@
     int                   rc, *captures;
     u_char               *p, errstr[NGX_MAX_CONF_ERRSTR];
     size_t                size;
-    ngx_int_t             key;
     ngx_str_t            *vv, name, value;
-    ngx_uint_t            i, n;
+    ngx_uint_t            i, n, key;
     ngx_http_ssi_ctx_t   *ctx;
     ngx_http_ssi_var_t   *var;
     ngx_regex_compile_t   rgc;
@@ -1989,10 +1987,10 @@
 ngx_http_ssi_include(ngx_http_request_t *r, ngx_http_ssi_ctx_t *ctx,
     ngx_str_t **params)
 {
-    ngx_int_t                    rc, key;
+    ngx_int_t                    rc;
     ngx_str_t                   *uri, *file, *wait, *set, *stub, args;
     ngx_buf_t                   *b;
-    ngx_uint_t                   flags, i;
+    ngx_uint_t                   flags, i, key;
     ngx_chain_t                 *cl, *tl, **ll, *out;
     ngx_http_request_t          *sr;
     ngx_http_ssi_var_t          *var;
@@ -2249,9 +2247,9 @@
 {
     u_char                     *p;
     uintptr_t                   len;
-    ngx_int_t                   key;
     ngx_buf_t                  *b;
     ngx_str_t                  *var, *value, *enc, text;
+    ngx_uint_t                  key;
     ngx_chain_t                *cl;
     ngx_http_variable_value_t  *vv;
 
@@ -2411,8 +2409,9 @@
 ngx_http_ssi_set(ngx_http_request_t *r, ngx_http_ssi_ctx_t *ctx,
     ngx_str_t **params)
 {
-    ngx_int_t            key, rc;
+    ngx_int_t            rc;
     ngx_str_t           *name, *value, *vv;
+    ngx_uint_t           key;
     ngx_http_ssi_var_t  *var;
     ngx_http_ssi_ctx_t  *mctx;
 
diff --git a/src/http/modules/ngx_http_xslt_filter_module.c b/src/http/modules/ngx_http_xslt_filter_module.c
index fae5895..ea7ce2a 100644
--- a/src/http/modules/ngx_http_xslt_filter_module.c
+++ b/src/http/modules/ngx_http_xslt_filter_module.c
@@ -686,8 +686,19 @@
          * specified in xslt_stylesheet directives
          */
 
-        p = string.data;
-        last = string.data + string.len;
+        if (param[i].value.lengths) {
+            p = string.data;
+
+        } else {
+            p = ngx_pnalloc(r->pool, string.len + 1);
+            if (p == NULL) {
+                return NGX_ERROR;
+            }
+
+            ngx_memcpy(p, string.data, string.len + 1);
+        }
+
+        last = p + string.len;
 
         while (p && *p) {
 
diff --git a/src/http/ngx_http_postpone_filter_module.c b/src/http/ngx_http_postpone_filter_module.c
index e893b83..55f2698 100644
--- a/src/http/ngx_http_postpone_filter_module.c
+++ b/src/http/ngx_http_postpone_filter_module.c
@@ -63,7 +63,10 @@
     if (r != c->data) {
 
         if (in) {
-            ngx_http_postpone_filter_add(r, in);
+            if (ngx_http_postpone_filter_add(r, in) != NGX_OK) {
+                return NGX_ERROR;
+            }
+
             return NGX_OK;
         }
 
@@ -86,7 +89,9 @@
     }
 
     if (in) {
-        ngx_http_postpone_filter_add(r, in);
+        if (ngx_http_postpone_filter_add(r, in) != NGX_OK) {
+            return NGX_ERROR;
+        }
     }
 
     do {
diff --git a/src/http/ngx_http_request.c b/src/http/ngx_http_request.c
index f2e7623..4f956bf 100644
--- a/src/http/ngx_http_request.c
+++ b/src/http/ngx_http_request.c
@@ -2241,6 +2241,13 @@
     ngx_log_debug2(NGX_LOG_DEBUG_HTTP, c->log, 0,
                    "http run request: \"%V?%V\"", &r->uri, &r->args);
 
+    if (c->close) {
+        r->main->count++;
+        ngx_http_terminate_request(r, 0);
+        ngx_http_run_posted_requests(c);
+        return;
+    }
+
     if (ev->delayed && ev->timedout) {
         ev->delayed = 0;
         ev->timedout = 0;
diff --git a/src/http/ngx_http_upstream.c b/src/http/ngx_http_upstream.c
index 876357d..ce3d8e9 100644
--- a/src/http/ngx_http_upstream.c
+++ b/src/http/ngx_http_upstream.c
@@ -3288,6 +3288,13 @@
 
     /* TODO: prevent upgrade if not requested or not possible */
 
+    if (r != r->main) {
+        ngx_log_error(NGX_LOG_ERR, c->log, 0,
+                      "connection upgrade in subrequest");
+        ngx_http_upstream_finalize_request(r, u, NGX_ERROR);
+        return;
+    }
+
     r->keepalive = 0;
     c->log->action = "proxying upgraded connection";
 
@@ -4197,6 +4204,7 @@
     switch (ft_type) {
 
     case NGX_HTTP_UPSTREAM_FT_TIMEOUT:
+    case NGX_HTTP_UPSTREAM_FT_HTTP_504:
         status = NGX_HTTP_GATEWAY_TIME_OUT;
         break;
 
@@ -4204,6 +4212,10 @@
         status = NGX_HTTP_INTERNAL_SERVER_ERROR;
         break;
 
+    case NGX_HTTP_UPSTREAM_FT_HTTP_503:
+        status = NGX_HTTP_SERVICE_UNAVAILABLE;
+        break;
+
     case NGX_HTTP_UPSTREAM_FT_HTTP_403:
         status = NGX_HTTP_FORBIDDEN;
         break;
diff --git a/src/mail/ngx_mail_proxy_module.c b/src/mail/ngx_mail_proxy_module.c
index 007284b..1c86e54 100644
--- a/src/mail/ngx_mail_proxy_module.c
+++ b/src/mail/ngx_mail_proxy_module.c
@@ -882,10 +882,13 @@
     c = ev->data;
     s = c->data;
 
-    if (ev->timedout) {
+    if (ev->timedout || c->close) {
         c->log->action = "proxying";
 
-        if (c == s->connection) {
+        if (c->close) {
+            ngx_log_error(NGX_LOG_INFO, c->log, 0, "shutdown timeout");
+
+        } else if (c == s->connection) {
             ngx_log_error(NGX_LOG_INFO, c->log, NGX_ETIMEDOUT,
                           "client timed out");
             c->timedout = 1;
diff --git a/src/stream/ngx_stream_proxy_module.c b/src/stream/ngx_stream_proxy_module.c
index 9d4b075..ad81cc8 100644
--- a/src/stream/ngx_stream_proxy_module.c
+++ b/src/stream/ngx_stream_proxy_module.c
@@ -1290,6 +1290,12 @@
     s = c->data;
     u = s->upstream;
 
+    if (c->close) {
+        ngx_log_error(NGX_LOG_INFO, c->log, 0, "shutdown timeout");
+        ngx_stream_proxy_finalize(s, NGX_STREAM_OK);
+        return;
+    }
+
     c = s->connection;
     pc = u->peer.connection;