Starstruk Logo MarkStarstruk

v26.1.23

XTLS/Xray-corev26.1.23Jan 23, 2026by RPRX

AI Summary

Xray-core v26.1.23 brings major new features including TUN inbound for Windows/Linux/Android/macOS, process-based routing rules, and Hysteria 2 support with Salamander obfuscation. Introduces the new 'finalmask' concept for enhanced traffic obfuscation.

Key Highlights

  • TUN inbound for Windows, Linux, Android, and macOS with UDP FullCone support
  • New process routing rules matching process name/absolute path/folder
  • Hysteria 2 outbound and transport (version 2, udphop) with Salamander obfuscation
  • New 'finalmask' concept - a layer below TLS/QUIC for traffic obfuscation
  • TLS pinnedPeerCertSha256 replaces old parameters, share links updated to use 'pcs'

Breaking Changes

  • TLS pinnedPeerCertSha256 replaces pinnedPeerCertificateChainSha256 and pinnedPeerCertificatePublicKeySha256
  • Routing config: processName replaced with process (full-name/abs-path/abs-folder)

New Features

  • TUN inbound for Windows, Linux, Android, macOS
  • UDP FullCone NAT with XUDP UoT Migration
  • Process routing rules (process name/path/folder matching)
  • Hysteria 2 outbound and transport
  • Hysteria 2 port hopping (udphop)
  • Salamander udpmask obfuscation
  • New finalmask concept
  • pinnedPeerCertSha256 for TLS certificate pinning
  • REALITY client improvement - clearer log when receiving real certificate (potential MITM)
  • Deprecated features/old protocols migration warnings
  • SECURITY.md created for vulnerability reporting
  • Geofiles mmap implementation to reduce RAM usage
  • Routing peak memory usage reduction

Full Release Notes

## Proxy: Add TUN inbound for Windows & Linux, including Android https://github.com/XTLS/Xray-core/pull/5464 https://github.com/XTLS/Xray-core/pull/5509 & Proxy: Add Hysteria outbound & transport (version 2, udphop) and Salamander udpmask https://github.com/XTLS/Xray-core/pull/5508

### 新年好！2026 第一版 Xray-core 重点更新内容：

1. **新增 TUN 入站（Windows、Linux、Android、macOS）https://github.com/XTLS/Xray-core/pull/5464 ，默认 UDP FullCone 与 XUDP UoT Migration https://github.com/XTLS/Xray-core/pull/5509**
2. **新增 `process` 路由规则（Windows、Linux），匹配进程名/绝对路径/文件夹，支持任何入站 https://github.com/XTLS/Xray-core/pull/5496**
3. **新增 Hysteria 2 出站、Hysteria 2 传输层（支持端口跳跃）、Salamander 伪装层，完整配置示例详见 https://github.com/XTLS/Xray-core/pull/5508**
4. **新增“最终伪装层”概念 https://t.me/projectXtls/1354 ，比 TLS/QUIC 更底层，下一步计划 https://github.com/XTLS/Xray-core/pull/5508#issuecomment-3743864399**
5. TLS 客户端使用 `pinnedPeerCertSha256` 取代原有两项参数 https://github.com/XTLS/Xray-core/pull/5154 https://github.com/XTLS/Xray-core/pull/5532 https://github.com/XTLS/Xray-core/commit/760223ad70f822fcb859a217e60e038a970610f9 ，分享链接标准 https://github.com/XTLS/Xray-core/discussions/716 已更新 `pcs`
6. REALITY 客户端收到目标网站的真证书时打印出更加明确的警报（potential MITM or redirection）https://github.com/XTLS/Xray-core/pull/5427
7. 为废弃特性/过时协议提醒迁移 https://github.com/XTLS/Xray-core/commit/cd8aab9544bc35fbc9990f61cb3613d0abbbe775 ，创建了 SECURITY.md https://github.com/XTLS/Xray-core/commit/1cf5662949aa32cebeb0f3ae79564819374ced7a 以明确安全漏洞/协议识别问题提交途径

**为了使用 TUN，配置文件需要以下修改，以 Windows 为例：**

1. 配置文件加一个 "tun" 入站，无需 `settings`，加一个 "direct" 作为默认出站
2. 为所有出站设置 `sockopt` `"interface": "WLAN"` 或 "以太网" 防止出站回流 Xray-core
3. 设置 `routing` 比如 `"process": ["NatTypeTester.exe"]` 导向代理协议出站
4. 浏览器会有 QUIC，注意设置路由 block UDP/443，或为 `sniffing` 启用 "quic"

**TUN 尚未支持“自动修改系统路由表”，目前需要手动设置：**

5. 以管理员权限启动 Xray-core，静置数秒等 Windows 自动为 TUN 分配 IP
6. 执行 `ipconfig` 与 `route print` 查看 Xray TUN 的 IPv4 地址与 interface ID
7. 以管理员权限执行 `route add 0.0.0.0 mask 0.0.0.0 *.*.*.* if **` 新增系统路由

**[感谢 @Owersun @yuhan6665 @Fangliding @KobeArthurScofield @RPRX @osypai 为支持 TUN 所作出的贡献！](https://github.com/XTLS/Xray-core/pull/5464#issuecomment-3721244861)**

**@Meo597 将 https://xtls.github.io/ 升级至了 VitePress，本次更新内容也会陆续更新至文档中**

**由于伊朗目前完全断网，致力于内存优化的贡献者 @hossinasaadi 已有半个月没有活动，盼望他早日回归！**

## Sponsors

[![Remnawave](https://github.com/user-attachments/assets/a22d34ae-01ee-441c-843a-85356748ed1e)](https://docs.rw)

[![Happ](https://github.com/user-attachments/assets/14055dab-e8bb-48bd-89e8-962709e4098e)](https://happ.su)

[**Sponsor Xray-core**](https://github.com/XTLS/Xray-core/issues/3668)

## Donation & NFTs

### [Collect a Project X NFT to support the development of Project X!](https://opensea.io/item/ethereum/0x5ee362866001613093361eb8569d59c4141b76d1/1)

[<img alt="Project X NFT" width="150px" src="https://raw2.seadn.io/ethereum/0x5ee362866001613093361eb8569d59c4141b76d1/7fa9ce900fb39b44226348db330e32/8b7fa9ce900fb39b44226348db330e32.svg" />](https://opensea.io/item/ethereum/0x5ee362866001613093361eb8569d59c4141b76d1/1)

- **TRX(Tron)/USDT/USDC: `TNrDh5VSfwd4RPrwsohr6poyNTfFefNYan`**
- **TON: `UQApeV-u2gm43aC1uP76xAC1m6vCylstaN1gpfBmre_5IyTH`**
- **BTC: `1JpqcziZZuqv3QQJhZGNGBVdCBrGgkL6cT`**
- **XMR: `4ABHQZ3yJZkBnLoqiKvb3f8eqUnX4iMPb6wdant5ZLGQELctcerceSGEfJnoCk6nnyRZm73wrwSgvZ2WmjYLng6R7sR67nq`**
- **SOL/USDT/USDC: `3x5NuXHzB5APG6vRinPZcsUv5ukWUY1tBGRSJiEJWtZa`**
- **ETH/USDT/USDC: `0xDc3Fe44F0f25D13CACb1C4896CD0D321df3146Ee`**
- **Project X NFT: https://opensea.io/item/ethereum/0x5ee362866001613093361eb8569d59c4141b76d1/1**
- **VLESS NFT: https://opensea.io/collection/vless**
- **REALITY NFT: https://opensea.io/item/ethereum/0x5ee362866001613093361eb8569d59c4141b76d1/2**
- **Related links: [VLESS Post-Quantum Encryption](https://github.com/XTLS/Xray-core/pull/5067), [XHTTP: Beyond REALITY](https://github.com/XTLS/Xray-core/discussions/4113), [Announcement of NFTs by Project X](https://github.com/XTLS/Xray-core/discussions/3633)**

该版本升级了一些依赖，并使用 Go 1.25.6 拉满 inline 编译，已 tag v1.260123.0，感谢所有贡献者，详见下方 change log

## What's Changed
* Chore: Remove all double gonet import by @Fangliding in https://github.com/XTLS/Xray-core/pull/5402
* Wireguard: Decouple server endpoint DNS from address option by @Meo597 in https://github.com/XTLS/Xray-core/pull/5417
* VLESS inbound: Print invalid UUID string by @xtlsee @RPRX in https://github.com/XTLS/Xray-core/pull/5426
* REALITY client: Clearer log when receiving real certificate by @ari-ahm @RPRX in https://github.com/XTLS/Xray-core/pull/5427
* TLS ECH: Increase DOH timeout by @patterniha @Fangliding in https://github.com/XTLS/Xray-core/pull/5455
* Tunnel/Dokodemo: Fix stats conn unwrap by @Fangliding in https://github.com/XTLS/Xray-core/pull/5440
* DomainMatcher: Prevent illegal rules from causing core startup failures by @Meo597 in https://github.com/XTLS/Xray-core/pull/5430
* common/uuid: fix panic when parsing 32-len invalid UUID string. by @ari-ahm in https://github.com/XTLS/Xray-core/pull/5468
* API: Add GetAllOnlineUsers RPC to StatsService for retrieving online users by @mr1cloud in https://github.com/XTLS/Xray-core/pull/5080
* Geofiles: Implement mmap in filesystem to reduce ram usage by @hossinasaadi in https://github.com/XTLS/Xray-core/pull/5480
* Remove redundant stats in mux and bridge dispatcher  by @yuhan6665 in https://github.com/XTLS/Xray-core/pull/5466
* XHTTP server: Fix ScStreamUpServerSecs' non-default value by @fanymagnet in https://github.com/XTLS/Xray-core/pull/5486
* Routing config: Add `processName` by @Fangliding in https://github.com/XTLS/Xray-core/pull/5489
* README.md: Re-add 3X-UI to Web Panels by @RPRX in https://github.com/XTLS/Xray-core/commit/b38a41249fd80c08c2a32e2dc5b06d42abc0bc9f
* Routing: Reduce peak memory usage by @hossinasaadi in https://github.com/XTLS/Xray-core/pull/5488
* DNS: Fix parse domain and geoip by @hossinasaadi in https://github.com/XTLS/Xray-core/pull/5499
* README.md: Add TX-UI to Web Panels by @Incognito-Coder in https://github.com/XTLS/Xray-core/pull/4981
* transport/pipe/impl.go: Remove runtime.Gosched() in WriteMultiBuffer() by @Fangliding in https://github.com/XTLS/Xray-core/pull/5467
* Routing config: Replace `processName` with `process` (full-name/abs-path/abs-folder) by @Fangliding in https://github.com/XTLS/Xray-core/pull/5496
* GitHub Actions: Add wintun.dll into Windows zips; Workflow refinement by @KobeArthurScofield in https://github.com/XTLS/Xray-core/pull/5501
* Proxy: Add TUN inbound for Windows & Linux, including Android by @Owersun @yuhan6665 in https://github.com/XTLS/Xray-core/pull/5464
* Tests: Improve geosite & geoip tests by @hossinasaadi in https://github.com/XTLS/Xray-core/pull/5502
* TLS config: Add `pinnedPeerCertSha256`; Remove `pinnedPeerCertificateChainSha256` and `pinnedPeerCertificatePublicKeySha256` by @Fangliding @RPRX in https://github.com/XTLS/Xray-core/pull/5154
* DNS: Check err for UDP dns.PackMessage(req.msg) by @Fangliding in https://github.com/XTLS/Xray-core/pull/5512
* TUN inbound: Implement UDP FullCone NAT by @RPRX @Fangliding @Owersun in https://github.com/XTLS/Xray-core/pull/5509
* TUN inbound: Fix log, CanSpliceCopy, tag, sniffing, and port config issues by @RPRX in https://github.com/XTLS/Xray-core/pull/5522
* TUN inbound: Make udp_fullcone pure side effect free udp connection by @Owersun @RPRX in https://github.com/XTLS/Xray-core/pull/5526
* Upgrade gVisor to latest version v0.0.0-20260109181451-4be7c433dae2 by @Owersun in https://github.com/XTLS/Xray-core/pull/5527
* Proxy: Add Hysteria outbound & transport (version 2, udphop) and Salamander udpmask by @LjhAUMEM in https://github.com/XTLS/Xray-core/pull/5508
* TUN inbound: Close connection when handling is done by @Owersun in https://github.com/XTLS/Xray-core/pull/5531
* TLS client: Verify leaf cert (name, time) when pinning self-signed CA by @Fangliding in https://github.com/XTLS/Xray-core/pull/5532
* Hysteria: Fix transport's "udphop without salamander" dialing issue; Require `"version": 2` in outbound's `settings` as well by @LjhAUMEM in https://github.com/XTLS/Xray-core/pull/5537
* SS2022 outbound: Fix UDP leak by @Fangliding in https://github.com/XTLS/Xray-core/pull/5544
* README.md: Add Happ RU to iOS & macOS Clients by @mangustyura in https://github.com/XTLS/Xray-core/pull/5551
* Commands: "xray run -dump" supports reading JSON from STDIN by @vrnobody in https://github.com/XTLS/Xray-core/pull/5550
* TLS client: Skip TLS' built-in verification when using `pinnedPeerCertSha256`; Fixes by @RPRX in https://github.com/XTLS/Xray-core/commit/760223ad70f822fcb859a217e60e038a970610f9
* TLS client: Add pin_test.go for leaf and CA by @Fangliding in https://github.com/XTLS/Xray-core/pull/5553
* Geofiles: Revert related changes for now, waiting for better changes by @Fangliding in https://github.com/XTLS/Xray-core/pull/5557
* Hysteria transport: Add `congestion` config (""/"reno"/"bbr"/"brutal"/"force-brutal") by @LjhAUMEM in https://github.com/XTLS/Xray-core/pull/5549
* TUN inbound: Add macOS support by @osypai in https://github.com/XTLS/Xray-core/pull/5559
* Config: Add Warning for deprecated features (allowInsecure, Shadowsocks, VMess, Trojan, VLESS without flow) by @RPRX in https://github.com/XTLS/Xray-core/commit/5836f36f69bc4253ef96336d0c129b7f4b99ad2a
* Hysteria outbound: Fix ContextWithRequireDatagram() by @LjhAUMEM in https://github.com/XTLS/Xray-core/pull/5558
* Create SECURITY.md by @RPRX in https://github.com/XTLS/Xray-core/commit/1cf5662949aa32cebeb0f3ae79564819374ced7a
* TUN inbound: Cancel ctx when handling is done by @patterniha @RPRX in https://github.com/XTLS/Xray-core/pull/5565
* Tests: Reduce RAM usage by @Fangliding in https://github.com/XTLS/Xray-core/pull/5577
* README.md: Update links for PassWall & PassWall 2 by @gamekiller0010 in https://github.com/XTLS/Xray-core/pull/5572
* Router: Fix panic in ProcessNameMatcher when source IPs are empty by @Fangliding in https://github.com/XTLS/Xray-core/pull/5574
* README.md: Add fancyss to Asuswrt-Merlin Clients by @RPRX in https://github.com/XTLS/Xray-core/commit/262770564f108855caa52ace60c59363e798cc75
* Hysteria transport: Fix speedtest issue by @LjhAUMEM in https://github.com/XTLS/Xray-core/pull/5587
* Log config: More flexible `maskAddress` by @Fangliding in https://github.com/XTLS/Xray-core/pull/5570
* API: Add ListRule() for routing by @IAMouMeng in https://github.com/XTLS/Xray-core/pull/5569
* common/errors/feature_errors.go: Add PrintNonRemovalDeprecatedFeatureWarning() by @KobeArthurScofield @RPRX in https://github.com/XTLS/Xray-core/pull/5567

## New Contributors
* @xtlsee made their first contribution in https://github.com/XTLS/Xray-core/pull/5426
* @ari-ahm made their first contribution in https://github.com/XTLS/Xray-core/pull/5427
* @fanymagnet made their first contribution in https://github.com/XTLS/Xray-core/pull/5486
* @Incognito-Coder made their first contribution in https://github.com/XTLS/Xray-core/pull/4981
* @Owersun made their first contribution in https://github.com/XTLS/Xray-core/pull/5464
* @osypai made their first contribution in https://github.com/XTLS/Xray-core/pull/5559
* @gamekiller0010 made their first contribution in https://github.com/XTLS/Xray-core/pull/5572
* @IAMouMeng made their first contribution in https://github.com/XTLS/Xray-core/pull/5569

**Full Changelog**: https://github.com/XTLS/Xray-core/compare/v25.12.8...v26.1.23