v2.11.56 v3.7.12
high risk
alibaba/MNNAug 26, 2026 → Aug 26, 20260 days between releases
What's New
Adds new CVE fix and fasthttp bump while maintaining HTTP/3 improvements.
Improvements
- Bumped github.com/valyala/fasthttp to v1.73.0
- File provider configuration errors now include the filename
Bug Fixes
- Fixed new security vulnerability (CVE GHSA-cjr6-pf59-jq29)
- Fixed typos in documentation and OCSP log messages
- Fixed redirect www host with a non-numeric port in Kubernetes provider
- Fixed TLS option name collision across namespaces in ingress-nginx provider
Upgrade Notes
Requires following the provided migration guide for v3.7. The new CVE (GHSA-cjr6) should be prioritized. Note that fasthttp was bumped to v1.73.0.
The Two Releases
v2.11.56
v2.11.56
Aug 26, 2026· 2 months ago
A v2.11 branch update focusing on HTTP/3 timeout configurations, header aliasing support, and etcd client version bumps.
Full release notesv3.7.12
v3.7.12
Aug 26, 2026· 2 months ago
Addresses security vulnerabilities and enhances HTTP/3 handling, TCP/UDP weighted services, and documentation updates regarding security and support dates.
Full release notes