vllm

v0.25.1 Bugfix

This release fixes issues for SREs watching stability and regressions.

Published 12d Model Serving & MLOps

✓ No known CVEs patched

✓ No known CVEs patched in this version

Topics

amd blackwell cuda deepseek deepseek-v3 llm

+13 more

gpt-oss inference kimi llama llm-serving model-serving moe openai pytorch qwen qwen3 tpu transformer

Summary

AI summary

Fixed runtime error when FFmpeg is missing for TorchCodec and prevented corrupted output from mixed‑dtype RMSNorm quantization fusions.

Type	Severity	Summary	CVE
Bugfix	High	Adds dtype-match guard for mixed-dtype allreduce RMSNorm quant fusions, avoiding corrupted outputs. Adds dtype-match guard for mixed-dtype allreduce RMSNorm quant fusions, avoiding corrupted outputs. Source: llm_adapter@2026-07-14 Confidence: high	—
Bugfix	Medium	Defers FFmpeg import error to runtime, preventing startup block when TorchCodec unused. Defers FFmpeg import error to runtime, preventing startup block when TorchCodec unused. Source: llm_adapter@2026-07-14 Confidence: high	—

Full changelog

This release features 2 commits from 2 contributors (1 new)!

v0.25.1 is a patch release containing two targeted bug fixes on top of v0.25.0.

Avoid blocking model launching when no system FFmpeg is available for TorchCodec (#47888). Previously import torchcodec raised a RuntimeError at import time when system FFmpeg was missing, which blocked startup (e.g. vllm serve Qwen/Qwen3-VL-2B-Instruct) even when TorchCodec was not in use. The error is now deferred to runtime so it only surfaces if TorchCodec is actually needed.
Guard mixed-dtype allreduce RMSNorm quant fusions (#48330). The fused FlashInfer allreduce + RMSNorm + static-quantization patterns could match graphs where the activation and RMSNorm weight dtypes differ (e.g. a BF16 residual stream with an FP32 Gemma/Qwen-style RMSNorm weight in NVFP4 models), corrupting the hidden state and producing garbage output such as repeated !!!!! tokens. A dtype-match guard now routes incompatible mixed-dtype graphs to the safe path, while same-dtype models retain the full allreduce + RMSNorm + quant fusion.

@Isotr0py, @hugo-cen

@hugo-cen made their first contribution in https://github.com/vllm-project/vllm/pull/48330

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track vllm

Get notified when new releases ship.

About vllm

A high-throughput and memory-efficient inference and serving engine for LLMs