netbird

v0.74.7 Security

This release includes 4 security fixes for security teams reviewing exposed deployments.

Published 9d VPN & Tunnels

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 4 known CVEs

Topics

go mesh mesh-networks nat-traversal netbird vpn

+3 more

wireguard-vpn wiretrustee zero-trust-network-access

Affected surfaces

auth rbac rce_ssrf

ReleasePort's take

Moderate signal

editorial:auto 9d

Netbird v0.74.7 renames the client authentication API function isValidAccessToken to accurately indicate its audience‑only validation scope.

Why it matters: The breaking change requires developers updating Netbird clients to rename calls; failure will cause compilation errors after upgrade.

Summary

AI summary

Rename isValidAccessToken to reflect its audience‑only scope.

Changes in this release

Type	Severity	Summary	CVE
Security	High	Reject leading hyphen in getent input to prevent flag injection Reject leading hyphen in getent input to prevent flag injection Source: llm_adapter@2026-07-17 Confidence: high	—
Breaking	High	Rename isValidAccessToken to reflect audience-only check Rename isValidAccessToken to reflect audience-only check Source: llm_adapter@2026-07-17 Confidence: high	—
Feature	Medium	Evaluate IP fragments against firewall ACLs Evaluate IP fragments against firewall ACLs Source: llm_adapter@2026-07-17 Confidence: high	—
Performance	Medium	Handle QUIC connections concurrently to prevent handshake head-of-line blocking Handle QUIC connections concurrently to prevent handshake head-of-line blocking Source: llm_adapter@2026-07-17 Confidence: high	—
Bugfix
Bugfix	Medium	Sanitize peer FQDN/hostname in generated SSH config Sanitize peer FQDN/hostname in generated SSH config Source: llm_adapter@2026-07-17 Confidence: high	—
Bugfix	Medium	Disable gVisor TCP RACK loss detection on Windows Disable gVisor TCP RACK loss detection on Windows Source: llm_adapter@2026-07-17 Confidence: high	—
Bugfix	Medium	Bind netstack SOCKS5 proxy to 127.0.0.1 by default Bind netstack SOCKS5 proxy to 127.0.0.1 by default Source: llm_adapter@2026-07-17 Confidence: high	—

Full changelog

What's Changed

[relay] Handle QUIC connections concurrently to prevent handshake head-of-line blocking by @lixmal in https://github.com/netbirdio/netbird/pull/6784
[client] Reject leading hyphen in getent input to prevent flag injection by @lixmal in https://github.com/netbirdio/netbird/pull/6787
[client] Sanitize peer FQDN/hostname in generated SSH config by @riccardomanfrin in https://github.com/netbirdio/netbird/pull/6805
[client] Disable gVisor TCP RACK loss detection on Windows by @lixmal in https://github.com/netbirdio/netbird/pull/6808
[client] Rename isValidAccessToken to reflect audience-only check by @riccardomanfrin in https://github.com/netbirdio/netbird/pull/6806
[client] Bind netstack SOCKS5 proxy to 127.0.0.1 by default by @riccardomanfrin in https://github.com/netbirdio/netbird/pull/6812
[client] Evaluate IP fragments against firewall ACLs by @lixmal in https://github.com/netbirdio/netbird/pull/6781

Full Changelog: https://github.com/netbirdio/netbird/compare/v0.74.6...v0.74.7

Breaking Changes

Renamed client function isValidAccessToken → indicates audience‑only check

Security Fixes

[client] Reject leading hyphen in getent input to prevent flag injection
[client] Sanitize peer FQDN/hostname in generated SSH config
[relay] Handle QUIC connections concurrently to prevent handshake head‑of‑line blocking
[client] Evaluate IP fragments against firewall ACLs

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track netbird

Get notified when new releases ship.

About netbird

Connect your devices into a secure WireGuard®-based overlay network with SSO, MFA and granular access controls.