Skip to content

Release history

UUSEC WAF releases

Industry-leading high-performance, AI and semantic technology web application firewall and API security gateway (fork of nginx).

Back to tool Latest release

All releases

14 shown

Config change
v7.2.3 Mixed
Auth

Basic auth plugin + IP threat fix

Open
Upgrade now
v7.2.2 Security relevant
Dependencies

CVE-2026-9256 fix

Open
Upgrade now
v7.2.1 Security relevant
Dependencies

nginx vulnerability fixes

Open
v7.2.0 Breaking risk
Breaking changes
  • Direct upgrade from previous versions is unsupported; migration required.
Notable features
  • Log-only rule functionality added with constants waf.RULE_BLOCK, waf.RULE_ALLOW, and waf.RULE_LOG_ONLY
Full changelog

[!WARNING]
Attention: This version is incompatible with older versions and does not support direct upgrade from previous versions.

Feature Updates:

  • Supports log-only rule functionality, introducing three new rule constants: waf.RULE_BLOCK, waf.RULE_ALLOW, and waf.RULE_LOG_ONLY. When a rule returns these values, they represent block, allow, and log-only actions, respectively.
View release on GitHub
v7.1.2 Feature
Notable features
  • Add and modify multiple rules to defend against the latest threats
Changelog

Feature Updates:

  • Add and modify multiple rules to defend against the latest threats.
View release on GitHub
v7.1.1 Bug fix
Notable features
  • Added 4 new search engine verification capabilities
Full changelog

Feature Updates:

  • Added 4 new search engine verification capabilities.

Bug Fixes:

  • Fixed an issue where search engine verification failures occurre.
View release on GitHub
v7.1.0 New feature
Notable features
  • Plugin priority configuration and per‑filter stage return of two booleans to skip remaining plugins or exit security processing
Full changelog

Feature Updates:

  • Enhanced plugin functionality: Now supports setting plugin priority and controlling plugin behavior via return values. Each filter stage can return two boolean values:

    • If the first value is true, subsequent plugins in the current stage will not be executed.
    • If the second value is true, the system immediately returns and skips all subsequent security rules.

Bug Fixes:

  • Resolved an issue where ‌free SSL certificates failed to auto-renew.
View release on GitHub
v7.0.6 Bugfix

Fixed display issues on certain screen resolutions.

Changelog

Bug Fixes:

  • Fixed display issues on certain screen resolutions
View release on GitHub
v7.0.5 Bug fix
Notable features
  • Optimized interface display and adjusted delete icon
Full changelog

Feature Updates:

  • Optimized interface display, adjusted delete icon

Bug Fixes:

  • Fixed issue where cache acceleration cleanup didn't take effect in certain scenarios
  • Fixed inability to use underscores in domain names when adding domains
  • Fixed issue where IP threat intelligence plugin continued logging after triggering high-frequency attack rules
View release on GitHub
v7.0.4 Bugfix

Fixed free certificate renewal failures.

Changelog

Bug Fixes

  • Fixed the issue of free certificate renewal failures
View release on GitHub
v7.0.3 Bugfix

Fixed inability to view some logs when log level filter is set to 'Info'.

Full changelog

Bug Fixes

  • Resolved the problem that prevented viewing certain logs when the log level filter was set to 'Info'
View release on GitHub
v7.0.2 Bug fix

Fixed slow website access due to IP threat intelligence updates and error reporting issues with frontend UI elements.

Full changelog

Bug Fixes

  • Fixed slow website access caused by IP threat intelligence updates under poor network conditions
  • Fixed error reporting issues with some frontend UI elements

Improvements

  • Update GEO IP database to the latest version
View release on GitHub
v7.0.1 Bug fix

Fixed inability to modify DSL rules after adding them.

Full changelog

Bug Fixes

  • Fixed inability to modify DSL rules after adding them
  • Fixed issue where HTTP/2 toggle didn't take effect
  • Fixed incorrect regex pattern matching warning for cache acceleration paths
View release on GitHub
v7.0.0 Breaking risk
Breaking changes
  • Cannot update from older versions; requires full reinstallation.
Notable features
  • Redesigned main program and management interface with UI language switching (English/Chinese)
  • Rule Collections for custom rule templates
  • Whitelist rules that terminate further matching on success
Full changelog

Feature Updates

[!WARNING]
This version can't be updated from older versions, you need to reinstall UUSEC WAF!

Interface & Management

  • Redesigned main program and management interface with improved aesthetics and usability, supports UI language switching (English/Chinese)
  • Added Rule Collections functionality: Create custom rule templates for batch configuration
  • Introduced whitelist rules that terminate further rule matching upon success
  • UUSEC WAF Rules API intelligent suggestions during advanced rule editing
  • New plugin management supporting hot-reloaded plugins to extend WAF capabilities

Protocol & Optimization

  • Supports streaming responses for continuous data push (e.g., LLM stream outputs)
  • Enables Host header modification during proxying for upstream service access
  • Search engine validation: waf.searchEngineValid(dns,ip,ua) prevents high-frequency rules from affecting SEO indexing
  • Interception log report generation (HTML/PDF exports)
  • Automatic rotation of UUSEC WAF error/access logs to prevent performance issues

Security & Infrastructure

  • Expanded free SSL certificate support: HTTP-01 & DNS-01 verification across 50+ domain providers
  • Customizable advanced WAF settings: HTTP2, GZIP, HTTP Caching, SSL protocols, etc
  • Cluster configuration: Manage UUSEC WAF nodes and ML servers via web UI
View release on GitHub

Beta — feedback welcome: [email protected]