v26.3.27

XTLS/Xray-corev26.3.27Mar 27, 2026by RPRX
AI Summary

A major update featuring Finalmask enhancements, Hysteria 2 support, and protocol improvements across REALITY, TLS ECH, WireGuard, and VLESS Reverse Proxy.
Key Highlights

Finalmask added header-custom, Sudoku, fragment, and noise modes; supports dialer-proxy and XHTTP/3; fixes XDNS/XICMP panics.
Hysteria 2 inbound and transport fully supported, with unified QUIC parameters via Finalmask.
REALITY auto-detects and applies maxUselessRecords to target certificates to prevent detection.
WireGuard implemented UDP FullCone NAT for enhanced masquerading capabilities.
New Features

Finalmask modes (header-custom, Sudoku, fragment, noise)
Hysteria 2 inbound and transport
REALITY auto-detection of maxUselessRecords
WireGuard UDP FullCone NAT
VLESS Reverse Proxy sniffing support
Routing webhook support
Full Release Notes

## Finalmask, mKCP, Hysteria, XHTTP, REALITY, TLS ECH, WireGuard, VLESS Reverse Proxy, Global HTTP headers' browser masquerading, API, Others

### ~~本次重点更新内容过多~~
- **[从双重标准到“大新闻”：浅谈代理协议设计与实现上的一些本质问题与优先级区别](https://github.com/XTLS/BBS/issues/19)**
- https://github.com/XTLS/BBS/issues/21#issuecomment-4103308607
- [BlancVPN](https://blanc.link/0SIDK7Z) 正式成为赞助方之一，~~依旧面向俄罗斯人~~，这家默默赞助几个月了，还赞助了些其它开源项目

### Finalmask https://github.com/XTLS/Xray-core/pull/5657 https://github.com/XTLS/Xray-core/pull/5685 https://github.com/XTLS/Xray-core/pull/5812 https://github.com/XTLS/Xray-core/pull/5850
- **新增 header-custom (TCP & UDP)、Sudoku (TCP & UDP)，移植了 Direct/Freedom 出站的 fragment (TCP)、noise (UDP)，最终的自定义流量外观拥有了更多可能，且均支持通过 `fm` 参数分享，基于 Xray-core 的 GUI 应尽快更新 Finalmask（类似 XHTTP extra）**
- 支持了 dialer-proxy，补上了 XHTTP/3，加上一众 TCP 协议/传输层，至此 Xray 产生的所有代理流量均能被 Finalmask
- 修复了 XICMP、XDNS 可能的 panic，**XDNS 相较于 DNSTT/Slipstream 可以通过更多 DNS，且支持代理 UDP**

### mKCP https://github.com/XTLS/Xray-core/pull/5773 https://github.com/XTLS/Xray-core/pull/5755
- **修复了 ACKs 可能超出 MTU 限制的问题，使 XDNS 更加稳定**
- 将 TTI 限制由 10\~100 毫秒改为了 10\~5000 毫秒
- https://github.com/XTLS/Xray-core/discussions/716 分享链接标准新增 `mtu`、`tti` 两项，~~还是为了 XDNS~~

### Hysteria https://github.com/XTLS/Xray-core/pull/5679 https://github.com/XTLS/Xray-core/pull/5782 https://github.com/XTLS/Xray-core/pull/5772
- **新增 Hysteria 2 入站与传输层，~~至此 Xray 支持了完整的 Hysteria 2，甚至 Finalmask 不只有 Salamander~~**
- 注意若要使用端口跳跃，入站应当只监听一个端口，并使用 iptables 转发其它端口的流量
- 将 `congestion`、`brutalUp`、`brutalDown`、`udpHop` 等 QUIC 参数移到了 Finalmask 的 `quicParams`

### XHTTP https://github.com/XTLS/Xray-core/pull/5711 https://github.com/XTLS/Xray-core/pull/5720 https://github.com/XTLS/Xray-core/pull/5803
- **XHTTP/3 拥塞控制改为默认 BBR ，同样支持通过 Finalmask 的 `quicParams` 设置 "force-brutal"、`udpHop` 等**
- 修复了上个版本新增 obfuscations 所引入的一些问题，比如 broken Browser Dialer，顺带一些增强
- 优化了一些代码与内存占用，~~快去测测 iOS~~

### REALITY https://github.com/XTLS/Xray-core/commit/157e65b34d32363528088c592d4e415d84f01a63 https://github.com/XTLS/Xray-core/commit/2320416ca3869d7818b9d86b749259a75fd3e103 https://github.com/XTLS/Xray-core/pull/5738 https://github.com/XTLS/Xray-core/pull/5759
- **基于前段时间的经验，非 443 端口、“偷苹果”极易导致服务器 IP 被封锁，故对这两个行为输出警告信息**
- 服务端启动时自动对 target 的 maxUselessRecords 进行四档探测并应用于自身，默认值 32
- 其它一些修复，比如修复了服务端进入双向拷贝状态后，服务端与 target 间可能未及时关闭连接的问题

### TLS ECH https://github.com/XTLS/Xray-core/pull/5725
- 避免了 WSS & HUS 的 outer ALPN 仍为 http/1.1，~~虽然这一行为与浏览器不同但 ALPN http/1.1 会被重点关照所以~~
- **修改了 `echForceQuery` 的默认值为 "full"，即默认只允许以 ECH 发起连接**
- 顺便升级了 uTLS 库更新了新版 Firefox、Safari 指纹，支持 X25519MLKEM768，like Chrome

### WireGuard https://github.com/XTLS/Xray-core/pull/5833 https://github.com/XTLS/Xray-core/pull/5554 https://github.com/XTLS/Xray-core/pull/5843
- **出入站 UDP 均实现了 FullCone，提醒一下结合 Finalmask 后它拥有比其它 WireGuard 变种更强大的伪装能力**
- 修复了出站 multi-peer 不可用的问题
- 修复了入站可能的路由问题

### VLESS Reverse Proxy https://github.com/XTLS/Xray-core/pull/5837 https://github.com/XTLS/Xray-core/pull/5752
- **VLESS 出站的 `reverse`（实际上是一个入站）添加了完整的 `sniffing` 配置项与功能支持**
- VLESS 入站建立新的反向 mux 连接（可能同时新建出站）后立即检查 burstObservatory

### Global HTTP headers' browser masquerading https://github.com/XTLS/Xray-core/pull/5802 https://github.com/XTLS/Xray-core/pull/5689
- 上个版本改的“Xray-core HTTP 请求的 User-Agent 均由 Go 改为动态 Chrome”扩展到了更多 headers
- **XHTTP、WS、HU、gRPC 传输层可设置 `headers` `User-Agent` 来指定 "firefox"/"edge"/"golang"**

### API https://github.com/XTLS/Xray-core/pull/5722 https://github.com/XTLS/Xray-core/pull/5732
- **为 `routing` 的 `rules` 添加了 `webhook` 支持**
- 修复了 Online Map

### Others https://github.com/XTLS/Xray-core/pull/5680 https://github.com/XTLS/Xray-core/pull/4584
- 该版本升级了一些依赖，并使用 Go 1.26.1 拉满 inline 编译，已 tag v1.260327.0
- **其它一些改进与修复，感谢所有贡献者，详见下方完整 change log**

## Sponsors

[![Remnawave](https://github.com/user-attachments/assets/a22d34ae-01ee-441c-843a-85356748ed1e)](https://docs.rw)

[![Happ](https://github.com/user-attachments/assets/14055dab-e8bb-48bd-89e8-962709e4098e)](https://happ.su)

[![BlancVPN](https://github.com/user-attachments/assets/9145ea7d-5da3-446e-8143-710dba4292c3)](https://blanc.link/0SIDK7Z)

[**Sponsor Xray-core**](https://github.com/XTLS/Xray-core/issues/3668)

## Donation & NFTs

### [Collect a Project X NFT to support the development of Project X!](https://opensea.io/item/ethereum/0x5ee362866001613093361eb8569d59c4141b76d1/1)

[<img alt="Project X NFT" width="150px" src="https://raw2.seadn.io/ethereum/0x5ee362866001613093361eb8569d59c4141b76d1/7fa9ce900fb39b44226348db330e32/8b7fa9ce900fb39b44226348db330e32.svg" />](https://opensea.io/item/ethereum/0x5ee362866001613093361eb8569d59c4141b76d1/1)

- **TRX(Tron)/USDT/USDC: `TNrDh5VSfwd4RPrwsohr6poyNTfFefNYan`**
- **TON: `UQApeV-u2gm43aC1uP76xAC1m6vCylstaN1gpfBmre_5IyTH`**
- **BTC: `1JpqcziZZuqv3QQJhZGNGBVdCBrGgkL6cT`**
- **XMR: `4ABHQZ3yJZkBnLoqiKvb3f8eqUnX4iMPb6wdant5ZLGQELctcerceSGEfJnoCk6nnyRZm73wrwSgvZ2WmjYLng6R7sR67nq`**
- **SOL/USDT/USDC: `3x5NuXHzB5APG6vRinPZcsUv5ukWUY1tBGRSJiEJWtZa`**
- **ETH/USDT/USDC: `0xDc3Fe44F0f25D13CACb1C4896CD0D321df3146Ee`**
- **Project X NFT: https://opensea.io/item/ethereum/0x5ee362866001613093361eb8569d59c4141b76d1/1**
- **VLESS NFT: https://opensea.io/collection/vless**
- **REALITY NFT: https://opensea.io/item/ethereum/0x5ee362866001613093361eb8569d59c4141b76d1/2**
- **Related links: [VLESS Post-Quantum Encryption](https://github.com/XTLS/Xray-core/pull/5067), [XHTTP: Beyond REALITY](https://github.com/XTLS/Xray-core/discussions/4113), [Announcement of NFTs by Project X](https://github.com/XTLS/Xray-core/discussions/3633)**

## What's Changed
* Build: Remove Windows ARM 32-bit build by @KobeArthurScofield in https://github.com/XTLS/Xray-core/pull/4584
* Chore: Migrate to Go 1.26 by @Fangliding in https://github.com/XTLS/Xray-core/pull/5680
* core/core.go: Replace "Custom" with vcs info if available by @Fangliding in https://github.com/XTLS/Xray-core/pull/5665
* HTTPUpgrade server: Fix certain stuck in Handle() by @Fangliding in https://github.com/XTLS/Xray-core/pull/5661
* Proxy: Add Hysteria 2 inbound & transport (supports listening port range, Salamander finalmask) by @LjhAUMEM in https://github.com/XTLS/Xray-core/pull/5679
* gRPC client: Strip "grpc-go/version" suffix from User-Agent header by @RPRX in https://github.com/XTLS/Xray-core/pull/5689
* README.md: Add NetProxy-Magisk to Magisk & Android Clients by @Fanju6 @RPRX in https://github.com/XTLS/Xray-core/pull/5708
* README.md: Add GenyConnect to Windows & Linux & Android Clients by @thecompez in https://github.com/XTLS/Xray-core/pull/5713
* README.md: Add XrayFA to Android Clients by @Q7DF1 in https://github.com/XTLS/Xray-core/pull/5715
* VLESS config: Remove "with no flow" warning for now by @M03ED in https://github.com/XTLS/Xray-core/pull/5671
* VLESS Encryption: Check 17~17000 -> Check 17~16640 by @OneMiny in https://github.com/XTLS/Xray-core/pull/5698
* Routing: Add `webhook` to `rules` by @kastov in https://github.com/XTLS/Xray-core/pull/5722
* API: Fix Online Map by @kastov in https://github.com/XTLS/Xray-core/pull/5732
* XHTTP transport: Bugfixes for obfuscations by @26X23 in https://github.com/XTLS/Xray-core/pull/5720
* XHTTP transport: Add "bbr" (default) and "force-brutal" congestion control for H3 by @Katze-942 in https://github.com/XTLS/Xray-core/pull/5711
* mKCP config: Check TTI 10~100 -> Check TTI 10~5000 by @patterniha @Fangliding in https://github.com/XTLS/Xray-core/pull/5755
* mKCP transport: Make sure ACKs are limited within MTU by @LjhAUMEM in https://github.com/XTLS/Xray-core/pull/5773
* Finalmask: Add header-custom (TCP & UDP), fragment (TCP), noise (UDP); Support dialer-proxy, XHTTP/3; Fix XDNS, XICMP potential panic by @LjhAUMEM in https://github.com/XTLS/Xray-core/pull/5657
* Finalmask: Add Sudoku (TCP & UDP) by @saba-futai in https://github.com/XTLS/Xray-core/pull/5685
* Update github.com/apernet/quic-go to 20260217092621 by @LjhAUMEM in https://github.com/XTLS/Xray-core/pull/5782
* Hysteria & XHTTP/3: Unified Finalmask's `quicParams` to set `congestion`, `brutalUp`, `brutalDown`, `udpHop` (`ports` & `interval`), etc. by @LjhAUMEM in https://github.com/XTLS/Xray-core/pull/5772
* TLS ECH: Avoid outer ALPN http/1.1 for WSS & HUS; Change `echForceQuery`'s default value to "full"; Update github.com/refraction-networking/utls to 20260301010127; Add irrelevant tests for uTLS-REALITY by @Fangliding in https://github.com/XTLS/Xray-core/pull/5725
* TUN inbound: Generate deterministic GUID on Windows by @Fangliding in https://github.com/XTLS/Xray-core/pull/5811
* Commands: Fix potential nil pointer dereference in executeAddRules() by @WASDetchan @Fangliding in https://github.com/XTLS/Xray-core/pull/5749
* REALITY config: Fix client's ·shortId· length check by @OfficialKatana in https://github.com/XTLS/Xray-core/pull/5738
* Commands: `x25519` outputs "Password" -> "Password (PublicKey)" by @matthew-abg @RPRX in https://github.com/XTLS/Xray-core/pull/5759
* Finalmask: Refactor header conns to avoid multiple-copy; Add `randRange` to "header-custom" (TCP & UDP) by @LjhAUMEM in https://github.com/XTLS/Xray-core/pull/5812
* VLESS Reverse Proxy: Check burstObservatory immediately after inbound adds new reverse-mux to reverse-outbound by @Fangliding @RPRX in https://github.com/XTLS/Xray-core/pull/5752
* Xray-core: More robust browser header masquerading (chrome, firefox, edge) by @PoneyClairDeLune in https://github.com/XTLS/Xray-core/pull/5802
* XHTTP transport: Some optimizations by @Fangliding @ozeranskii @rufsieus in https://github.com/XTLS/Xray-core/pull/5803
* REALITY config: Print Warning when user is choosing apple/icloud as the target or listening on non-443 ports by @RPRX in https://github.com/XTLS/Xray-core/commit/157e65b34d32363528088c592d4e415d84f01a63
* README.md: Add BlancVPN to Sponsors by @RPRX in https://github.com/XTLS/Xray-core/commit/e0ab00f6a883ab204b2202341cca77c83e36ed4d
* Update github.com/xtls/reality to 20260322125925 by @RPRX in https://github.com/XTLS/Xray-core/commit/2320416ca3869d7818b9d86b749259a75fd3e103
* README.md: Add INCY to iOS & macOS Clients by @JustYay in https://github.com/XTLS/Xray-core/pull/5832
* README.md: Add CELERITY to Web Panel by @ClickDevTech in https://github.com/XTLS/Xray-core/pull/5834
* WireGuard: Implement UDP FullCone NAT by @LjhAUMEM @RPRX in https://github.com/XTLS/Xray-core/pull/5833
* XTLS Vision: Defer Splice handoff until write completes by @HeXis-YS in https://github.com/XTLS/Xray-core/pull/5737
* OpenBSD: Disable readV by @Fangliding in https://github.com/XTLS/Xray-core/pull/5786
* WireGuard outbound: Fix multi-peer's readQueue issue by @RPRX in https://github.com/XTLS/Xray-core/pull/5554
* VLESS Reverse Proxy: Add `sniffing` to outbound's `reverse` (which is actually an inbound) by @RPRX in https://github.com/XTLS/Xray-core/pull/5837
* Loopback outbound: Fix potential nil InboundFromContext by @Fangliding in https://github.com/XTLS/Xray-core/pull/5836
* Finalmask: Add `randRange` to "noise" (UDP), as the same as "header-custom"'s (TCP & UDP) by @LjhAUMEM in https://github.com/XTLS/Xray-core/pull/5850
* WireGuard inbound: Fix multi-peer; Fix potential routing issue by @LjhAUMEM in https://github.com/XTLS/Xray-core/pull/5843

## New Contributors
* @Fanju6 made their first contribution in https://github.com/XTLS/Xray-core/pull/5708
* @thecompez made their first contribution in https://github.com/XTLS/Xray-core/pull/5713
* @Q7DF1 made their first contribution in https://github.com/XTLS/Xray-core/pull/5715
* @OneMiny made their first contribution in https://github.com/XTLS/Xray-core/pull/5698
* @26X23 made their first contribution in https://github.com/XTLS/Xray-core/pull/5720
* @Katze-942 made their first contribution in https://github.com/XTLS/Xray-core/pull/5711
* @saba-futai made their first contribution in https://github.com/XTLS/Xray-core/pull/5685
* @WASDetchan made their first contribution in https://github.com/XTLS/Xray-core/pull/5749
* @OfficialKatana made their first contribution in https://github.com/XTLS/Xray-core/pull/5738
* @matthew-abg made their first contribution in https://github.com/XTLS/Xray-core/pull/5759
* @JustYay made their first contribution in https://github.com/XTLS/Xray-core/pull/5832
* @ClickDevTech made their first contribution in https://github.com/XTLS/Xray-core/pull/5834
* @HeXis-YS made their first contribution in https://github.com/XTLS/Xray-core/pull/5737

**Full Changelog**: https://github.com/XTLS/Xray-core/compare/v26.2.6...v26.3.27