A release with breaking configuration and flag changes, many new extension and protocol capabilities, and fixes for security, correctness, and observability. The recorded additions include module and filter extension APIs, MCP and A2A protocol support, OpenSSL builds, new formatters and metrics, and expanded streaming and TLS capabilities.
Action needed (1)
securityhighnghttp2 **CVE-2026-27135** patch
The nghttp2 **CVE-2026-27135** patch is included.
Check if affected (6)
securityURL encoding for
query_parameter_mutationsvaluesApplies if you configure
query_parameter_mutations.securityRBAC concatenation-based bypass prevention
Applies if RBAC runs.
breakingExplicit
max_early_data_bytesconfigurationApplies if you configure
upstream_connect_modewith a value other thanIMMEDIATEand do not configuremax_early_data_bytes.- + 3 more on the release page
Plan ahead (1)
deprecatedThe
enforce_rsa_key_usageoption, deprecatedremoval date not announcedApplies if you configure
enforce_rsa_key_usage.