Skip to content

Release history

ferron releases

A fast, memory-safe web server written in Rust.

Back to tool Latest release

All releases

17 shown

Config change
3.0.0-beta.5 Mixed
Auth RCE / SSRF

Symlink protection + TLS metrics + load balancing

Open
No immediate action
2.8.1 Bug fix

Routing bug fix

Open
Review required
2.8.0 Bug fix
Auth Breaking upgrade

Directory listing escaping

Open
3.0.0-beta.1 New feature
Notable features
  • CLI utility for hashing passwords
  • CLI utility for pre‑compressing static files
  • CLI utility for translating Ferron 2 configurations into Ferron 3 ones
Full changelog

Added

  • CLI utility for hashing passwords.
  • CLI utility for pre-compressing static files.
  • CLI utility for translating Ferron 2 configurations into Ferron 3 ones.
  • CLI utility for zero-configuration serving.

Changed

  • Non-existent webroots now lead to 404 Not Found errors instead of 500 Internal Server Error errors.

Fixed

  • Partial hostname resolution match in HTTP server could lead to incorrect routing.
  • Redirects configured with status directive didn't have some placeholder locations (such as $1) replaced when using a regex match.
  • Redirects configured with status directive didn't lead to any destination.
  • Reverse proxy was sometimes routed to wrong backend server.
  • Some default cache paths were unwritable in some cases.
  • Unknown directives in global blocks for status directive (even though they're known in host blocks) caused the web server to fail to start.
  • When using OTLP, access logs were emitted with "access_log" body, not actual access logs.
View release on GitHub
2.7.0 Security relevant
Security fixes
  • Path traversal when URL sanitizer disabled and path canonicalization failed
  • Proxy header leak in CGI/FastCGI/SCGI (httpoxy)
Notable features
  • DNSimple DNS provider support
  • IP-based TLS certificate support
  • JSON-format access logs
View release on GitHub
2.6.0 New feature
Breaking changes
  • Rego-based subconditions deprecated and will be removed in future release
Notable features
  • Dynamic SRV-based backend discovery
  • File size-based log rotation
  • Reusable KDL configuration snippets
View release on GitHub
2.5.4 Bugfix

- Fixed high CPU usage after configuration reloads caused by the OCSP stapler.

View release on GitHub
2.5.0 New feature
Notable features
  • Logging to standard I/O
  • TLS certificate and key persistence
  • Forwarded HTTP header support
View release on GitHub
2.4.1 Bugfix

- Fixed a rarely occurring crash when upgrading backend server's HTTP connection as a reverse proxy.

View release on GitHub
2.4.0 Bug fix
Notable features
  • Bunny.net, DigitalOcean, OVH DNS providers
  • HTTP Basic authentication for forward proxying
View release on GitHub
2.3.2 Maintenance

- The server now gracefully handles canceled I/O operations that could previously cause 502 Bad Gateway errors (when io_uring is disabled). - The server now gracefully handles canceled I/O operations that could previously cause a crash under rare conditions (when io_uring is enab

View release on GitHub
2.3.1 Maintenance

- The server now gracefully handles canceled I/O operations that could previously cause a crash under rare conditions (when io_uring is disabled).

View release on GitHub
2.3.0 New feature
Breaking changes
  • Removed configuration directive for maximum idle kept-alive connection pool in reverse proxy
Security fixes
  • Fixed XSS in server administrator email configuration
  • Fixed ACME EAB Base64 HMAC parsing
Notable features
  • Reverse proxy connection metrics
  • URL sanitizer disable option
  • TCP concurrency limits
View release on GitHub

Beta — feedback welcome: [email protected]