v0.22.10 v2.11.57
NodePassProject/AnywhereAug 31, 2026 → Sep 4, 20264 days between releases
What's New
Addresses security vulnerabilities and introduces strict request handling changes in major version jump from v0.22.10
Breaking Changes
- Requests with opaque request targets are now denied by default.
- Recursive NSS propagation for DNS challenges is disabled by default.
- h2c upgrade headers are no longer forwarded to the backend.
New Features
- Dedicated transport per HTTP/3 client connection.
- Automatic denial of opaque request targets.
- Blocking of h2c upgrade headers to backends.
Improvements
- Improved HTTP/3 handling with dedicated transports.
- Enhanced server security by denying opaque targets.
- Fixed three security vulnerabilities (CVEs).
Bug Fixes
- Disabled recursive NSS propagation for DNS challenge.
- Implemented dedicated transport per HTTP/3 client connection.
- Added server-side validation for opaque request targets.
Upgrade Notes
Review the provided migration guide as the release addresses security vulnerabilities from the v3.x series. Be aware that DNS challenge configurations may need adjustment due to the default disabling of recursive NSS propagation. Check request handling rules as opaque targets are now denied and h2c headers are not forwarded.
The Two Releases
Release v0.22.10
Aug 31, 2026· 2 months ago
Minimal release notes: "# v0.22.10 - 2026-08-31 ## 🐛 Bugfixes - Settle a verb when the session ends instead of hanging forever 9efe447"
Full release notesv2.11.57
Sep 4, 2026· 2 months ago
Addresses specific security vulnerabilities and applies security fixes found in the v3.x series, including improved HTTP/3 handling and server-side request validation.
Full release notes