Experimental browser SDK from master. Optimized and ASan browser validation passed. Validation: https://github.com/fluent/fluent-bit/actions/runs/43090831114 Download the archive, verify its checksum, and deploy the complete SDK on your application origin. HTTPS and COOP/COEP are required. This is not a production support promise.

This is a security release.

• (CVE-2026-123863) http2: release headers when a stream is removed (Matteo Collina) – High
• (CVE-2026-123864) tls,http: prevent nested parser execution from empty writes (Matteo Collina) – High
• (CVE-2026-123865) http2: detect streams abandoned by nghttp2 (Matteo Collina) – High
• (CVE-2026-123866) http2: retain buffers until socket writes finish (Matteo Collina) – High
• (CVE-2026-123872) tls: disable resumption for mTLS with no session id context (Tim Perry) – High
• (CVE-2026-123872) tls: don't allow renegotiation or HRR to change SNI (Tim Perry) – High
• (CVE-2026-123872) tls: don't allow TLS resumption to change SNI (Tim Perry) – High
• (CVE-2026-123874) http2: retain streams during pending writes (Matteo Collina) – High
• (CVE-2026-126051) tls: fix remotely reachable TLS server crash (Tim Perry) – High
• (CVE-2026-123828) http2: avoid overflowing ALTSVC buffers (Matteo Collina) – Medium
• (CVE-2026-123867) tls: apply the CA of SNI contexts without a certificate (Matteo Collina) – Medium
• (CVE-2026-123868) http2: charge inbound DATA retained by streams to maxSessionMemory (Matteo Collina) – Medium
• (CVE-2026-123871) http: redact proxy credentials in invalid proxy URL errors (Matteo Collina) – Medium
• (CVE-2026-123875) http2: guard against null write request on cancelled stream (Matteo Collina) – Medium
• (CVE-2026-123877) https: isolate Agent TLS policy keys (Matteo Collina) – Medium
• (CVE-2026-123829) permission: do not leak denied descendants in recursive fs.watch (RafaelGSS) – Low
• (CVE-2026-123862) zlib: handle params callback after destroy (Matteo Collina) – Low
• (CVE-2026-123873) permission: check heap snapshot destination (RafaelGSS) – Low
• deps: update brotli to 1.2.1 (Node.js GitHub Bot)
• deps: update llhttp to 9.4.4 (Antoine du Hamel)
• deps: update sqlite to 3.54.1 (Node.js GitHub Bot)
• deps: update undici to 8.12.4 (Node.js GitHub Bot)

• [7b777661f5] - build: respect OpenSSL's configured API level (Filip Skokan) #66953
• [4518c7501f] - crypto: fix builds with older OpenSSL 3.0 (Filip Skokan) #66931
• [94b73673b8] - deps: brotli: cherry-pick e230f474b87 (liujiahui) #61003
• [e315236158] - deps: update llhttp to 9.4.4 (Antoine du Hamel) nodejs-private/node-private#1038
• [8e714f7daa] - deps: update undici to 8.12.4 (Node.js GitHub Bot) #67272
• [af48b1a4d5] - deps: update brotli to 1.2.1 (Node.js GitHub Bot) #66990
• [60316405bb] - deps: update undici to 8.12.3 (Node.js GitHub Bot) #66993
• [89b17baef4] - deps: update sqlite to 3.54.1 (Node.js GitHub Bot) #66816
• [d14db811c7] - http: redact proxy credentials in invalid proxy URL errors (Matteo Collina) nodejs-private/node-private#1001
• [9183db64fe] - http2: retain streams during pending writes (Matteo Collina) nodejs-private/node-private#1040
• [62ae278a23] - http2: charge inbound DATA retained by streams to maxSessionMemory (Matteo Collina) nodejs-private/node-private#1000
• [7df134e2ce] - http2: retain buffers until socket writes finish (Matteo Collina) nodejs-private/node-private#1017
• [0ff0cf6749] - http2: release headers when a stream is removed (Matteo Collina) nodejs-private/node-private#1026
• [a84a01ddb8] - http2: avoid overflowing ALTSVC buffers (Matteo Collina) nodejs-private/node-private#1035
• [3fc67dc056] - http2: detect streams abandoned by nghttp2 (Matteo Collina) #66641
• [df4011dafe] - http2: guard against null write request on cancelled stream (Matteo Collina) #67252
• [fa61009dc1] - https: isolate Agent TLS policy keys (Matteo Collina) nodejs-private/node-private#1036
• [40d3d8ddca] - permission: do not leak denied descendants in recursive fs.watch (RafaelGSS) nodejs-private/node-private#967
• [6c85b8e371] - tls: fix remotely reachable TLS server crash (Tim Perry) nodejs-private/node-private#1018
• [a8d6286949] - tls: disable resumption for mTLS with no session id context (Tim Perry) nodejs-private/node-private#1030
• [e750e1fa02] - tls: don't allow renegotiation or HRR to change SNI (Tim Perry) nodejs-private/node-private#1030
• [97b1357f08] - tls: don't allow TLS resumption to change SNI (Tim Perry) nodejs-private/node-private#1030
• [66e72ec604] - tls: apply the CA of SNI contexts without a certificate (Matteo Collina) nodejs-private/node-private#1020
• [940cae5c33] - tls,http: prevent nested parser execution from empty writes (Matteo Collina) nodejs-private/node-private#1021
• [8232390dd8] - tools: use vendored trust store in shell.nix (Antoine du Hamel) #67318
• [6c223db6e2] - zlib: handle params callback after destroy (Matteo Collina) nodejs-private/node-private#1037

This is a security release.

• (CVE-2026-123863) http2: release headers when a stream is removed (Matteo Collina) – High
• (CVE-2026-123864) tls,http: prevent nested parser execution from empty writes (Matteo Collina) – High
• (CVE-2026-123865) http2: detect streams abandoned by nghttp2 (Matteo Collina) – High
• (CVE-2026-123866) http2: retain buffers until socket writes finish (Matteo Collina) – High
• (CVE-2026-123872) tls: disable resumption for mTLS with no session id context (Tim Perry) – High
• (CVE-2026-123872) tls: don't allow renegotiation or HRR to change SNI (Tim Perry) – High
• (CVE-2026-123872) tls: don't allow TLS resumption to change SNI (Tim Perry) – High
• (CVE-2026-123874) http2: retain streams during pending writes (Matteo Collina) – High
• (CVE-2026-126051) tls: fix remotely reachable TLS server crash (Tim Perry) – High
• (CVE-2026-123828) http2: avoid overflowing ALTSVC buffers (Matteo Collina) – Medium
• (CVE-2026-123867) tls: apply the CA of SNI contexts without a certificate (Matteo Collina) – Medium
• (CVE-2026-123868) http2: charge inbound DATA retained by streams to maxSessionMemory (Matteo Collina) – Medium
• (CVE-2026-123871) http: redact proxy credentials in invalid proxy URL errors (Matteo Collina) – Medium
• (CVE-2026-123875) http2: guard against null write request on cancelled stream (Matteo Collina) – Medium
• (CVE-2026-123877) https: isolate Agent TLS policy keys (Matteo Collina) – Medium
• (CVE-2026-123829) permission: do not leak denied descendants in recursive fs.watch (RafaelGSS) – Low
• (CVE-2026-123862) zlib: handle params callback after destroy (Matteo Collina) – Low
• (CVE-2026-123873) permission: check heap snapshot destination (RafaelGSS) – Low
• deps: update brotli to 1.2.1 (Node.js GitHub Bot)
• deps: update llhttp to 9.4.4 (Antoine du Hamel)
• deps: update sqlite to 3.54.1 (Node.js GitHub Bot)
• deps: update undici to 7.30.2 (Node.js GitHub Bot)

• [4c12b8a775] - build: respect OpenSSL's configured API level (Filip Skokan) #66953
• [5654932a7d] - crypto: fix builds with older OpenSSL 3.0 (Filip Skokan) #66931
• [e88009c61c] - deps: brotli: cherry-pick e230f474b87 (liujiahui) #61003
• [92e8d82e0e] - deps: update llhttp to 9.4.4 (Antoine du Hamel) nodejs-private/node-private#1038
• [4164b5c2b4] - deps: update brotli to 1.2.1 (Node.js GitHub Bot) #66990
• [4fec855b1d] - deps: update sqlite to 3.54.1 (Node.js GitHub Bot) #66816
• [17c9eb75f3] - deps: update sqlite to 3.54.0 (Node.js GitHub Bot) #66663
• [57ebbdc275] - deps: update undici to 7.30.2 (Node.js GitHub Bot) #67273
• [8749030ae5] - http: redact proxy credentials in invalid proxy URL errors (Matteo Collina) nodejs-private/node-private#1001
• [8e100ac90a] - http2: retain streams during pending writes (Matteo Collina) nodejs-private/node-private#1040
• [03f040685b] - http2: charge inbound DATA retained by streams to maxSessionMemory (Matteo Collina) nodejs-private/node-private#1000
• [7be19aa614] - http2: retain buffers until socket writes finish (Matteo Collina) nodejs-private/node-private#1017
• [ff8938913b] - http2: release headers when a stream is removed (Matteo Collina) nodejs-private/node-private#1026
• [ae9ab37d62] - http2: avoid overflowing ALTSVC buffers (Matteo Collina) nodejs-private/node-private#1035
• [a081fd3a3e] - http2: detect streams abandoned by nghttp2 (Matteo Collina) #66641
• [22f4367981] - http2: guard against null write request on cancelled stream (Matteo Collina) #67252
• [4f60230182] - https: isolate Agent TLS policy keys (Matteo Collina) nodejs-private/node-private#1036
• [fdbc6ab7ac] - permission: do not leak denied descendants in recursive fs.watch (RafaelGSS) nodejs-private/node-private#967
• [d13a284de6] - src: fix the fs permission tree node on wildcard nodes (James M Snell) nodejs-private/node-private#986
• [c3485f2417] - tls: fix remotely reachable TLS server crash (Tim Perry) nodejs-private/node-private#1018
• [599ca08e28] - tls: disable resumption for mTLS with no session id context (Tim Perry) nodejs-private/node-private#1030
• [981d2defc6] - tls: don't allow renegotiation or HRR to change SNI (Tim Perry) nodejs-private/node-private#1030
• [799abe55cb] - tls: don't allow TLS resumption to change SNI (Tim Perry) nodejs-private/node-private#1030
• [45e3b1637a] - tls: apply the CA of SNI contexts without a certificate (Matteo Collina) nodejs-private/node-private#1020
• [25d487e3da] - tls,http: prevent nested parser execution from empty writes (Matteo Collina) nodejs-private/node-private#1021
• [e14e27b8d3] - zlib: handle params callback after destroy (Matteo Collina) nodejs-private/node-private#1037

This is a security release.

• (CVE-2026-123863) http2: release headers when a stream is removed (Matteo Collina) – High
• (CVE-2026-123864) tls,http: prevent nested parser execution from empty writes (Matteo Collina) – High
• (CVE-2026-123865) http2: detect streams abandoned by nghttp2 (Matteo Collina) – High
• (CVE-2026-123866) http2: retain buffers until socket writes finish (Matteo Collina) – High
• (CVE-2026-123872) tls: disable resumption for mTLS with no session id context (Tim Perry) – High
• (CVE-2026-123872) tls: don't allow renegotiation or HRR to change SNI (Tim Perry) – High
• (CVE-2026-123872) tls: don't allow TLS resumption to change SNI (Tim Perry) – High
• (CVE-2026-123874) http2: retain streams during pending writes (Matteo Collina) – High
• (CVE-2026-123828) http2: avoid overflowing ALTSVC buffers (Matteo Collina) – Medium
• (CVE-2026-123867) tls: apply the CA of SNI contexts without a certificate (Matteo Collina) – Medium
• (CVE-2026-123868) http2: charge inbound DATA retained by streams to maxSessionMemory (Matteo Collina) – Medium
• (CVE-2026-123871) http: redact proxy credentials in invalid proxy URL errors (Matteo Collina) – Medium
• (CVE-2026-123875) http2: guard against null write request on cancelled stream (Matteo Collina) – Medium
• (CVE-2026-123877) https: isolate Agent TLS policy keys (Matteo Collina) – Medium
• (CVE-2026-123829) permission: do not leak denied descendants in recursive fs.watch (RafaelGSS) – Low
• (CVE-2026-123862) zlib: handle params callback after destroy (Matteo Collina) – Low
• (CVE-2026-123873) permission: check heap snapshot destination (RafaelGSS) – Low
• deps: update llhttp to 9.4.4 (Antoine du Hamel)
• deps: update sqlite to 3.54.1 (Node.js GitHub Bot)

• [554fff40f0] - deps: update llhttp to 9.4.4 (Antoine du Hamel) nodejs-private/node-private#1038
• [6577cbf231] - deps: update sqlite to 3.54.1 (Node.js GitHub Bot) #66816
• [61d93c6086] - deps: update sqlite to 3.54.0 (Node.js GitHub Bot) #66663
• [cd18f6bdff] - http: redact proxy credentials in invalid proxy URL errors (Matteo Collina) nodejs-private/node-private#1001
• [6cd7e80d68] - http2: retain buffers until socket writes finish (Matteo Collina) nodejs-private/node-private#1017
• [9bce421783] - http2: release headers when a stream is removed (Matteo Collina) nodejs-private/node-private#1026
• [30fd852c0d] - http2: detect streams abandoned by nghttp2 (Matteo Collina) #66641
• [21fb5d0348] - http2: guard against null write request on cancelled stream (Matteo Collina) #67252
• [af6fbb6564] - https: isolate Agent TLS policy keys (Matteo Collina) nodejs-private/node-private#1036
• [5c9eed3b1e] - permission: do not leak denied descendants in recursive fs.watch (RafaelGSS) nodejs-private/node-private#967
• [5e497aec89] - src: fix the fs permission tree node on wildcard nodes (James M Snell) nodejs-private/node-private#986
• [06af164d09] - tls: disable resumption for mTLS with no session id context (Tim Perry) nodejs-private/node-private#1030
• [209c7e4d83] - tls: don't allow renegotiation or HRR to change SNI (Tim Perry) nodejs-private/node-private#1030
• [05e452f075] - tls: don't allow TLS resumption to change SNI (Tim Perry) nodejs-private/node-private#1030
• [67da864a89] - tls: apply the CA of SNI contexts without a certificate (Matteo Collina) nodejs-private/node-private#1020
• [c841c6c7f1] - tls,http: prevent nested parser execution from empty writes (Matteo Collina) nodejs-private/node-private#1021
• [ea159e84dd] - zlib: handle params callback after destroy (Matteo Collina) nodejs-private/node-private#1037

Download page What's new highlights

• Security: Fix CVE-2026-102589
• Security: Fix CVE-2026-107509
• Security: Fix CVE-2026-110992
• Security: Fix CVE-2026-111024
• Security: Fix CVE-2026-13721
• Security: Fix CVE-2026-14242

• DateTime: Update moment-timezone and easy-tz for 2026 time zone changes #136951, @joshhunt
• Provisioning: allow same-host URL change on connection-backed repositories #137083, @grafana-writer[bot]

Download page What's new highlights

• Security: Fix CVE-2026-102589
• Security: Fix CVE-2026-107509
• Security: Fix CVE-2026-110992
• Security: Fix CVE-2026-111024
• Security: Fix CVE-2026-13721
• Security: Fix CVE-2026-14242

• DateTime: Update moment-timezone and easy-tz for 2026 time zone changes #136950, @joshhunt
• Provisioning: Handle repository build timeouts and branch outages #135723, @ferruvich
• Provisioning: allow same-host URL change on connection-backed repositories #137091, @MissingRoberto

• Unified search: Fix empty results when all query words are under 3 chars #137309, @grafana-writer[bot]

Download page What's new highlights

• Security: Fix CVE-2026-102589
• Security: Fix CVE-2026-107365
• Security: Fix CVE-2026-107509
• Security: Fix CVE-2026-110992
• Security: Fix CVE-2026-111024
• Security: Fix CVE-2026-13721
• Security: Fix CVE-2026-14242

• Provisioning: allow same-host URL change on connection-backed repositories #137090, @MissingRoberto

Download page What's new highlights

• Security: Fix CVE-2026-102589
• Security: Fix CVE-2026-107365
• Security: Fix CVE-2026-107509
• Security: Fix CVE-2026-110992
• Security: Fix CVE-2026-111024
• Security: Fix CVE-2026-13721
• Security: Fix CVE-2026-14242
• Security: Fix CVE-2026-82014

• DateTime: Bump moment-timezone to 0.6.6 for 2026 time zone changes #136948, @joshhunt
• Provisioning: allow same-host URL change on connection-backed repositories #137092, @MissingRoberto

Download page What's new highlights

• Security: Fix CVE-2026-102589
• Security: Fix CVE-2026-106472
• Security: Fix CVE-2026-106475
• Security: Fix CVE-2026-107365
• Security: Fix CVE-2026-107509
• Security: Fix CVE-2026-111000
• Security: Fix CVE-2026-81843
• Security: Fix CVE-2026-82014

• DateTime: Bump moment-timezone to 0.6.6 for 2026 time zone changes #136947, @joshhunt