v0.68.1
lutzroeder/netronv0.68.1Apr 13, 2026by fatedier
AI Summary
Addresses a security vulnerability in HTTP proxies where authentication could be bypassed under specific configuration settings. The update ensures that proxy-style authentication failures now return the correct HTTP 407 status code.
Key Highlights
- Fixed configuration-dependent authentication bypass in HTTP proxies
- Ensures `407 Proxy Authentication Required` is returned on failure
- Fixes behavior when `routeByHTTPUser` is used with `httpUser` or `httpPassword`
Full Release Notes
## Fixes * Fixed a configuration-dependent authentication bypass in `type = "http"` proxies when `routeByHTTPUser` is used together with `httpUser` / `httpPassword`. This affected proxy-style requests. Proxy-style authentication failures now return `407 Proxy Authentication Required`.