Starstruk Logo MarkStarstruk

app/v2.9.2

jamiepine/voiceboxapp/v2.9.2May 23, 2026by github-actions[bot]

AI Summary

This release focuses on security and stability improvements, introducing an experimental obfuscation layer while fixing critical bugs related to ACL bypass, memory management, and protocol handling.

Key Highlights

  • Added experimental Gecko obfuscation to fragment QUIC handshake packets.
  • Fixed security vulnerabilities allowing UDP packet bypass and ACL bypass via domain trailing dots.
  • Resolved server OOM issues caused by oversized HTTP requests during sniffing.
  • Improved SOCKS5 UDP outbound handling and DoH resolver accuracy.

New Features

  • Gecko obfuscation for QUIC packets.
  • Outbound rules now reject invalid port values.

Full Release Notes

> This release contains important security fixes and we strongly encourage everyone to upgrade.

- Added [Gecko obfuscation](https://hysteria.network/docs/advanced/Full-Server-Config/#__tabbed_2_2): a new experimental obfuscation layer that fragments QUIC handshake packets
- Fixed a security issue where UDP packets could bypass ACL
- Fixed a potential server OOM caused by incomplete or oversized HTTP requests during sniff
- Fixed an ACL bypass via trailing dots in domain names (e.g. `example.com.`)
- Fixed incorrect destination handling in the SOCKS5 UDP outbound
- Fixed `https://` prefix detection in the DoH resolver
- Outbound rules now reject invalid port values
- Minor performance improvements

---

> 此版本包含重要安全修复，强烈建议更新

- 新增 [Gecko](https://hysteria.network/docs/advanced/Full-Server-Config/#__tabbed_2_2)：一种实验性的新混淆实现，会对 QUIC 握手包进行分片处理
- 修复了 UDP 包可绕过 ACL 的安全问题
- 修复了启用 sniff 时，不完整或超大 HTTP 请求可能导致服务端 OOM 的问题
- 修复了通过在域名末尾添加点（如 `example.com.`）绕过 ACL 的问题
- 修复了 SOCKS5 UDP 出站中目标地址处理错误的问题
- 修复了 DoH 解析器对 `https://` 前缀的判断错误
- outbound 规则现在会拒绝无效端口号
- 小幅性能改进