HeroDevs
Visit NES for Project Reactor Home Page

NES for Reactor Netty 1.0.x Release Notes

3 versions

Comprehensive release notes and changelog for NES for Reactor Netty 1.0.x, including security patches, bug fixes, and feature updates across all supported versions.

Oct 21, 2026
Latest: 1.0.51
7 Patched Vulnerabilities
VEX Statements

October 2026

1.0.51

Released Oct 21, 2026
CVE-2026-47874
CVE-2026-47844
CVE-2026-47843
CVE-2026-47845
Full Version: 
1.0.48-reactor-netty-1.0.51

Security Fixes

  • An HTTP/1.1 client can no longer make the server hold an unlimited number of pipelined requests on one connection; the server now stops reading from a connection while 32 requests are queued (CVE-2026-47874).
  • An error raised while handling one HTTP request can no longer be reported on the Brave spans of later, unrelated requests to an HttpServer decorated with ReactorNettyHttpTracing (medium severity, CVE-2026-47844).
  • Clients configured with different hostsFileEntriesResolver values no longer share a DNS resolver, which could route requests to an unintended host (CVE-2026-47843).
  • On an HttpServer with PROXY protocol enabled, HTTP/2 requests after the first on a connection now report the client address from the PROXY header instead of the proxy's address (CVE-2026-47845).

September 2026

1.0.50

Released Sep 21, 2026
CVE-2025-22227
CVE-2026-47848
CVE-2026-41715
Full Version: 
1.0.48-reactor-netty-1.0.50

Security Fixes

  • Credential leak on chained redirects in the HTTP client, where the sensitive header stripping guard compared each redirect target against the preceding hop rather than the original request URI, so a redirect within the same authority restored the original credentials (CVE-2025-22227, Medium).
  • HttpClientConnect no longer forwards sensitive headers to a different origin when a WebSocket handshake is redirected (CVE-2026-47848).
  • Credential leak on protocol downgrade redirects in the HTTP client, where the same guard compared targets by remote address only and ignored the scheme, so an https to http downgrade on the same host and port left the credentials in place and sent them unencrypted (CVE-2026-41715, Medium).

1.0.49

Released Sep 16, 2026
Full Version: 
1.0.48-reactor-netty-1.0.49

Notes

  • This release originates from the open-source Reactor Netty repository forked by HeroDevs. It encompasses modifications implemented by HeroDevs to ensure successful framework builds.

Stay in the loop

~/herodevs-spring-framework-support

Open Source Support

When official support ends, we're just getting started.