A release with breaking configuration and flag changes, many new extension and protocol capabilities, and fixes for security, correctness, and observability. The recorded additions include module and filter extension APIs, MCP and A2A protocol support, OpenSSL builds, new formatters and metrics, and expanded streaming and TLS capabilities.
Action needed (1)
securityhighnghttp2 **CVE-2026-27135** patch
The nghttp2 **CVE-2026-27135** patch is included.
Check if affected (6)
securityURL encoding for
query_parameter_mutationsvaluesApplies if you configure
query_parameter_mutations.Query-parameter values added through
query_parameter_mutationsare now URL-encoded to prevent injection.securityRBAC concatenation-based bypass prevention
Applies if RBAC runs.
RBAC handling was corrected to prevent concatenation-based bypasses.
breakingExplicit
max_early_data_bytesconfigurationApplies if you configure
upstream_connect_modewith a value other thanIMMEDIATEand do not configuremax_early_data_bytes.max_early_data_bytesmust now be set explicitly whenupstream_connect_modehas a value other thanIMMEDIATE. Missing configuration causes validation to fail at startup.- + 3 more on the release page
Plan ahead (1)
deprecatedThe
enforce_rsa_key_usageoption, deprecatedremoval date not announcedApplies if you configure
enforce_rsa_key_usage.The
enforce_rsa_key_usageoption is deprecated and will be removed in the next release.