Starstruk Logo MarkStarstruk

v25.9.5

XTLS/Xray-corev25.9.5Sep 5, 2025by RPRX

AI Summary

Major update featuring VLESS Post-Quantum Encryption and VLESS Route capabilities.

Key Highlights

  • VLESS Post-Quantum Encryption (ML-KEM-768) added for 1-RTT PFS and 0-RTT anti-replay.
  • VLESS Route allows using UUID's 7th and 8th bytes for routing rules.
  • Inbound performance improved by removing pipe/caching in Tunnel/Socks/HTTP for iOS efficiency.
  • Added `./xray vlessenc` command for generating complete JSON pairs.

New Features

  • VLESS Post-Quantum Encryption (ML-KEM-768)
  • VLESS Route capability
  • vlessenc command
  • Inbound performance improvements

Full Release Notes

## VLESS protocol: Add lightweight, Post-Quantum ML-KEM-768-based PFS 1-RTT / anti-replay 0-RTT AEAD Encryption https://github.com/XTLS/Xray-core/pull/5067

[<img width="830" height="820" alt="compare" src="https://github.com/user-attachments/assets/5e051122-4934-4c35-a705-57a16a077770" />](https://opensea.io/collection/vless)

### Xray-core v25.9.5 未来已来，本次重点更新内容：

~~过于先进的~~ VLESS Post-Quantum Encryption：
- **抗量子的密钥交换与身份认证、前向安全、客户端配置安全、0-RTT**
- 无需对时、完美的重放防护、无需多次尝试解密以确定用户、无需额外 AEAD length 故性能更优
- **建议开 XTLS 避免二次加解密（native/xorpub 可自动 ReadV/Splice），可再叠上 XHTTP、WS 等传输层，详见 https://github.com/XTLS/Xray-core/pull/5067**

~~适合机场的~~ VLESS Route：
- 允许在分享给客户端的 UUID 中自定义第 7、8 个字节
- **服务端路由设置 `vleesRoute` 以匹配它们、分流不同出口，详见 https://xtls.github.io/config/routing.html#ruleobject**

~~利好 iOS 的~~ 客户端性能提升：
- **Tunnel/Socks/HTTP 入站去掉了 pipe 及其内置缓存，Xray-core 运行效率更高、占用内存更少，详见 https://github.com/XTLS/Xray-core/pull/5067#issuecomment-3236833240**

Xray-core v25.9.5 相较于 v25.8.31：
- 修复了延迟问题 https://github.com/XTLS/Xray-core/commit/fd54b10d976dffa184d978d37989eb5120b473f2 、用户流量统计问题 https://github.com/XTLS/Xray-core/commit/d20397c15d59eff5e991423a9550fa9abc6eeefd
- VLESS 入站也去掉了 pipe 及其内置缓存 https://github.com/XTLS/Xray-core/pull/5076
- **新增了 `./xray vlessenc` 指令 https://github.com/XTLS/Xray-core/pull/5078**
- 以及其它的一些修复与改进

## VLESS NFT

VLESS NFT 自成一个系列，每个图片都不同且只有一个，你可以选择自己喜欢的图片来收藏，先到先得

**https://opensea.io/collection/vless 首发放出了二十个不同的 VLESS NFT 图片**

本次还放出了两个稀缺的 Project X NFT，如果你有余力，请支持一下：https://opensea.io/assets/ethereum/0x5ee362866001613093361eb8569d59c4141b76d1/1

该版本升级了一些依赖，并使用 Go 1.25.1 拉满 inline 编译，已 tag v1.250905.0，感谢所有贡献者，详见下方 change log

## What's Changed
* API: Fix user online map remain 1 after connection dropped by @LjhAUMEM in https://github.com/XTLS/Xray-core/pull/4982
* feat(api): update timestamp for existing IPs in AddIP instead of skipping by @LjhAUMEM in https://github.com/XTLS/Xray-core/pull/4989
* Router: Add `localIP` and `localPort`; Add `sourceIP` as an alias of `source` by @patterniha in https://github.com/XTLS/Xray-core/pull/4992
* Freedom: Add `maxSplit` fragment option; Add `applyTo` noises option by @patterniha in https://github.com/XTLS/Xray-core/pull/4998
* Refine must2 and apply NewAesGcm() to all usage by @Fangliding in https://github.com/XTLS/Xray-core/pull/5011
* Chore: Migrate to Go 1.25 by @Fangliding in https://github.com/XTLS/Xray-core/pull/5024
* common/buf/multi_buffer.go: Fix Compact() by @Fangliding @patterniha in https://github.com/XTLS/Xray-core/pull/5015
* XHTTP client: Fix edge-case issue for `packet-up` mode by @Fangliding in https://github.com/XTLS/Xray-core/pull/5020
* Outbound: Add `targetStrategy`; Fix mux does not close `link.Reader`; Fix `origin` does not work on UDP; Add logs by @patterniha in https://github.com/XTLS/Xray-core/pull/5006
* VLESS inbound: Add option to set default `flow` by @Jolymmiles in https://github.com/XTLS/Xray-core/pull/5023
* Build: Use more aggressive inlining for higher efficiency by @KobeArthurScofield in https://github.com/XTLS/Xray-core/pull/5026
* Direct/Freedom config: Add `targetStrategy` as an alias of `domainStrategy`; Routing config: Remove `domainMatcher`, "linear" and `type` by @patterniha in https://github.com/XTLS/Xray-core/pull/5027
* DNS outbound: Set "reject" as the default value for `nonIPQuery` by @RPRX in https://github.com/XTLS/Xray-core/commit/de23e51077d34937229c3997586aaa99634df409
* VLESS practice: Use user-sent VLESS UUID's last byte as `vlessRoute` for `routing` `rules` by @RPRX in https://github.com/XTLS/Xray-core/commit/105b306d07de292ca4807e443bb050b9719e691d
* Wireguard inbound: Fix context sharing problem by @yuhan6665 in https://github.com/XTLS/Xray-core/pull/4988
* XTLS Vision inbound: Use user-sent VLESS UUID for NewTrafficState() by @RPRX in https://github.com/XTLS/Xray-core/commit/5464862ee6ba7a994e2d2a2d227387c8ad084822
* VLESS practice: Use user-sent VLESS UUID's 7th<<8 | 8th bytes as `vlessRoute` instead by @RPRX in https://github.com/XTLS/Xray-core/commit/7f300dbf0c1d520cb6e03c6e88b9b727f6777fd4
* Issues template: Refine requirements by @Fangliding in https://github.com/XTLS/Xray-core/commit/573300bc22f23da91a9cd49a2699e11380af40a9
* Chore: Optimize .gitignore by @Skh-web6982 in https://github.com/XTLS/Xray-core/pull/5029
* Some refines related to direct/freedom and `targetStrategy`; More intelligent "useIP"/"ForceIP", enhance "origin" functionality by @patterniha in https://github.com/XTLS/Xray-core/pull/5030
* Commands: Add `-outpbfile` for `convert pb` by @KobeArthurScofield in https://github.com/XTLS/Xray-core/pull/5048
* common/signal/timer.go: Refator to use sync.Once by @Fangliding in https://github.com/XTLS/Xray-core/pull/5052
* WireGuard outbound: Fix close closed by @Fangliding in https://github.com/XTLS/Xray-core/pull/5054
* checkSystemNetwork(): Use c.root-servers.net by @xqzr in https://github.com/XTLS/Xray-core/pull/5059
* Test_parseResponse(t *testing.T): Use dns.google for IPv6 by @xqzr in https://github.com/XTLS/Xray-core/pull/5060
* VLESS protocol: Add lightweight, Post-Quantum ML-KEM-768-based PFS 1-RTT / anti-replay 0-RTT AEAD Encryption by @RPRX in https://github.com/XTLS/Xray-core/pull/5067
* README.md: Update Donation & NFTs by @RPRX in https://github.com/XTLS/Xray-core/commit/702d2c06cae481c78c42901cd563f20f8b6fdf24
* Update github.com/xtls/reality to 20250828044527 by @RPRX in https://github.com/XTLS/Xray-core/commit/12b077f33b766952fa6640104d93d68803b7feee
* Socks/HTTP inbound: Fix unexpected rawConn copy by @Fangliding in https://github.com/XTLS/Xray-core/pull/5041
* First step of upcoming refactor for Xray-core: Add TimeoutWrapperReader; Use DispatchLink() in Tunnel/Socks/HTTP inbounds by @RPRX in https://github.com/XTLS/Xray-core/commit/56a45ad57893919bd43d7e764ab32bc5b1fb0c1e
* VLESS Encryption: Re-add automatically ChaCha20-Poly1305 by @RPRX in https://github.com/XTLS/Xray-core/commit/82ea7a3cc5ff23280b87e3052f0f83b04f0267fa
* Trojan-UoT & UDP-nameserver: Fix forgotten release buffer; UDP dispatcher: Simplified and optimized by @patterniha in https://github.com/XTLS/Xray-core/pull/5050
* Trojan UoT: Fix memory/goroutine leak by @patterniha in https://github.com/XTLS/Xray-core/pull/5064
* common/buf/buffer.go: Replace copy zero with clear() by @Fangliding @SkrideOne in https://github.com/XTLS/Xray-core/pull/5071
* Commands/run: Try all suffixes for default config by @RPRX in https://github.com/XTLS/Xray-core/commit/a31842feaa629a96e041be71a1915e178f48d697
* Chore: Fix tests by @RPRX in https://github.com/XTLS/Xray-core/commit/fbb0ecfb833004811dfeb58997e317814efbf0da
* VLESS Encryption: Add customizable 1-RTT padding parameters; Decrease memory using; Chores by @RPRX @wwqgtxx in https://github.com/XTLS/Xray-core/commit/e8b02cd6649f14889841e8ab8ee6b2acca71dbe6
* VLESS Encryption: Switch to "probability-from-to" format for customizable 1-RTT padding parameters by @RPRX in https://github.com/XTLS/Xray-core/commit/6768a22f676c9121cfc9dc4f51181a8a07837c8d
* TimeoutWrapperReader: Fix latency issue by @RPRX in https://github.com/XTLS/Xray-core/commit/fd54b10d976dffa184d978d37989eb5120b473f2
* VLESS Encryption: Server checks one specific zero-bit in the peer-sent X25519 public key in relays by @RPRX in https://github.com/XTLS/Xray-core/commit/4c6fd94d97159f5a3e740ba6dd2d9b65e3ed320c
* Direct/Freedom outbound: Use proxy.IsRAWTransport(conn) by @yuhan6665 in https://github.com/XTLS/Xray-core/pull/5074
* XTLS Vision: Refactor code to use DispatchLink() in VLESS inbound by @yuhan6665 in https://github.com/XTLS/Xray-core/pull/5076
* proxy/proxy.go: IsRAWTransport() -> IsRAWTransportWithoutSecurity() by @RPRX in https://github.com/XTLS/Xray-core/commit/e943de5300a54677673e8ff3eca6765818552785
* VLESS Encryption: Randomize seconds in ticket and simplify expiration mechanism by @RPRX in https://github.com/XTLS/Xray-core/commit/19f890729656bc923ae3dee8426168c93b8ee9c2
* DispatchLink(): Fix user stats by @RPRX in https://github.com/XTLS/Xray-core/commit/d20397c15d59eff5e991423a9550fa9abc6eeefd
* VLESS Encryption: Improve server-side tickets' expiration mechanism by @RPRX in https://github.com/XTLS/Xray-core/commit/cbade89ab11af26ba1e480a3688a6c205fa3c3f8
* Commands: Add `vlessenc` (generate complete json pair directly) by @Fangliding @RPRX in https://github.com/XTLS/Xray-core/pull/5078
* DNS outbound: Fix some issues by @patterniha in https://github.com/XTLS/Xray-core/pull/5081

## New Contributors
* @LjhAUMEM made their first contribution in https://github.com/XTLS/Xray-core/pull/4982
* @Skh-web6982 made their first contribution in https://github.com/XTLS/Xray-core/pull/5029

**Full Changelog**: https://github.com/XTLS/Xray-core/compare/v25.8.3...v25.9.5