Skip to content

nurkert/ja4-spoofer

v1.4.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 2mo Offensive & Pentesting
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Affected surfaces

crypto_tls

ReleasePort's take

Light signal
editorial:auto 2mo

TLS ClientHello parsing now rejects invalid TLS version ordering and truncated data; profile IDs are sanitized before file writes.

Why it matters: Patch to v1.4.0 immediately to mitigate potential TLS parsing vulnerabilities and prevent unsafe profile path creation.

Summary

AI summary

TLS ClientHello parsing now rejects invalid TLS version ordering and truncated data.

Changes in this release

Security Medium

TLS ClientHello parsing now rejects invalid TLS version ordering and truncated data.

TLS ClientHello parsing now rejects invalid TLS version ordering and truncated data.

Source: llm_adapter@2026-05-21

Confidence: high

 —
Feature Medium

New upstream drift check workflow validates BoringSSL, NSS, and OpenSSL patches.

New upstream drift check workflow validates BoringSSL, NSS, and OpenSSL patches.

Source: llm_adapter@2026-05-21

Confidence: high

 —
Feature Medium

`scripts/apply_patches.sh` supports dry-run/check mode for detecting patch drift.

`scripts/apply_patches.sh` supports dry-run/check mode for detecting patch drift.

Source: llm_adapter@2026-05-21

Confidence: high

 —
Feature Medium

App caches IANA registry CSVs locally for offline use after initial fetch.

App caches IANA registry CSVs locally for offline use after initial fetch.

Source: llm_adapter@2026-05-21

Confidence: high

 —
Feature Medium

App settings now include `schema_version` and use atomic file helper to avoid partial writes.

App settings now include `schema_version` and use atomic file helper to avoid partial writes.

Source: llm_adapter@2026-05-21

Confidence: high

 —
Dependency Medium

`shadcn_ui` was bumped to version 0.54.0.

`shadcn_ui` was bumped to version 0.54.0.

Source: llm_adapter@2026-05-21

Confidence: low

 —
Bugfix Medium

Launcher output is fully drained before process exit handling, preventing lost logs.

Launcher output is fully drained before process exit handling, preventing lost logs.

Source: llm_adapter@2026-05-21

Confidence: high

 —
Bugfix Medium

App-shell initialization is serialized; capture throttle timer cancelled cleanly during disposal.

App-shell initialization is serialized; capture throttle timer cancelled cleanly during disposal.

Source: llm_adapter@2026-05-21

Confidence: high

 —
Bugfix Medium

Bundled script extraction logs chmod failures instead of silently ignoring permission problems.

Bundled script extraction logs chmod failures instead of silently ignoring permission problems.

Source: llm_adapter@2026-05-21

Confidence: high

 —
Bugfix Medium

Profile IDs are sanitized before file writes to prevent invalid or unsafe profile paths.

Profile IDs are sanitized before file writes to prevent invalid or unsafe profile paths.

Source: llm_adapter@2026-05-21

Confidence: high

 —
Full changelog

Added

  • New upstream drift check workflow validates BoringSSL, NSS, and OpenSSL
    patches against their pinned base refs.
  • scripts/apply_patches.sh supports a dry-run/check mode so patch drift can
    be detected without mutating the local source tree.
  • The app now caches IANA registry CSVs locally, making registry-backed screens
    usable when the network is unavailable after an initial fetch.
  • App settings now carry a schema_version, and writes use the new atomic file
    helper to avoid partially-written profile/settings files.

Changed

  • Release notes now come directly from the matching CHANGELOG.md section.
  • CI covers formatting, analysis, Flutter tests, shell linting, coverage
    generation, and golden-test scaffolding.
  • shadcn_ui was bumped to 0.54.0.

Fixed

  • Launcher output is fully drained before process exit handling, avoiding lost
    logs in the app console.
  • App-shell initialization is serialized, and the capture throttle timer is
    cancelled cleanly during disposal.
  • TLS ClientHello parsing now rejects invalid TLS version ordering and
    truncated ClientHello data.
  • Bundled script extraction logs chmod failures instead of silently ignoring
    permission problems.
  • Profile IDs are sanitized before file writes to prevent invalid or unsafe
    profile paths.

Install

APT (recommended):

sudo apt update && sudo apt install ja4-spoofer

Direct download:

sudo dpkg -i ja4-spoofer_*.deb
sudo apt-get install -f   # resolves any missing deps

Verify the artifact:

sha256sum -c SHA256SUMS
gpg --verify ja4-spoofer_*.deb.asc ja4-spoofer_*.deb   # if signed

On first launch the app extracts its scripts, configs and patches to
~/.ja4-spoofer/runtime/<version>/. No repository checkout needed.

Security Fixes

  • TLS ClientHello parsing rejects invalid TLS version ordering and truncated data – mitigates potential malformed‑handshake attacks
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track nurkert/ja4-spoofer

Get notified when new releases ship.

Sign up free

About nurkert/ja4-spoofer

All releases →

Related context

Beta — feedback welcome: [email protected]