Starstruk Logo MarkStarstruk

app/v2.9.2

MinishLab/model2vecapp/v2.9.2May 23, 2026by github-actions[bot]

AI Summary

This release focuses on critical security updates, including a new experimental obfuscation layer and fixes for ACL bypass vulnerabilities. It also includes improvements to packet sniffing, outbound rules, and overall performance.

Key Highlights

  • Added experimental Gecko obfuscation layer for QUIC handshake fragmentation
  • Fixed security vulnerabilities allowing UDP and ACL bypasses
  • Fixed server OOM risks during HTTP request sniffing
  • Outbound rules now reject invalid port values

New Features

  • Gecko obfuscation

Full Release Notes

> This release contains important security fixes and we strongly encourage everyone to upgrade.

- Added [Gecko obfuscation](https://hysteria.network/docs/advanced/Full-Server-Config/#__tabbed_2_2): a new experimental obfuscation layer that fragments QUIC handshake packets
- Fixed a security issue where UDP packets could bypass ACL
- Fixed a potential server OOM caused by incomplete or oversized HTTP requests during sniff
- Fixed an ACL bypass via trailing dots in domain names (e.g. `example.com.`)
- Fixed incorrect destination handling in the SOCKS5 UDP outbound
- Fixed `https://` prefix detection in the DoH resolver
- Outbound rules now reject invalid port values
- Minor performance improvements

---

> 此版本包含重要安全修复，强烈建议更新

- 新增 [Gecko](https://hysteria.network/docs/advanced/Full-Server-Config/#__tabbed_2_2)：一种实验性的新混淆实现，会对 QUIC 握手包进行分片处理
- 修复了 UDP 包可绕过 ACL 的安全问题
- 修复了启用 sniff 时，不完整或超大 HTTP 请求可能导致服务端 OOM 的问题
- 修复了通过在域名末尾添加点（如 `example.com.`）绕过 ACL 的问题
- 修复了 SOCKS5 UDP 出站中目标地址处理错误的问题
- 修复了 DoH 解析器对 `https://` 前缀的判断错误
- outbound 规则现在会拒绝无效端口号
- 小幅性能改进