HeroDevs
Visit NES for Quarkus Home Page

NES for Quarkus 3.20.x Release Notes

4 versions

Comprehensive release notes and changelog for NES for Quarkus 3.20.x, including security patches, bug fixes, and feature updates across all supported versions.

Oct 9, 2026
Latest: 3.20.10
14 Patched Vulnerabilities
VEX Statements

October 2026

3.20.10

Released Oct 9, 2026
CVE-2026-87743
CVE-2026-87742
Full Version: 
3.20.6-quarkus-3.20.10

Security Fixes

  • AbstractPathMatchingHttpSecurityPolicy no longer allows an aggressively normalized permit path to bypass the policy for the router path (CVE-2026-87743).
  • Endpoints and BasicWebSocketConnectorImpl now bound inbound messages per connection when peers send them faster than handlers process them (CVE-2026-87742).

3.20.9

Released Oct 1, 2026
CVE-2026-93432
Full Version: 
3.20.6-quarkus-3.20.9

Security Fixes

  • Qute's EvalSectionHelper and StrEvalNamespaceResolver can no longer emit evaluated data without the parent template's content-type protections (CVE-2026-93432).
    • Qute no longer registers the str:eval namespace resolver by default, so a template that uses str:eval fails at render time unless the application registers StrEvalNamespaceResolver, from an @Observes EngineBuilder method or as a CDI bean.

September 2026

3.20.8

Released Sep 17, 2026
CVE-2026-19625
CVE-2026-12894
CVE-2026-19651
Full Version: 
3.20.6-quarkus-3.20.8

Security Fixes

  • DefaultTokenIntrospectionUserInfoCache can no longer reuse token introspection or UserInfo entries across OIDC tenants that present the same access token (CVE-2026-19625).
  • ReflectionValueResolver can no longer reach unsafe Class, ClassLoader, or java.lang.reflect methods from template expressions (CVE-2026-12894).
    • Qute no longer registers the {#eval} section helper by default; build-time template validation does not flag it, so a template that uses {#eval} fails at render time unless the application registers EvalSectionHelper.Factory from an @Observes EngineBuilder method.
  • SpringWebResteasyReactiveProcessor can no longer bind Spring @RequestHeader parameters from URL query-string values (CVE-2026-19651).

July 2026

3.20.7

Released Jul 16, 2026
Full Version: 
3.20.6-quarkus-3.20.7

Notes

  • This release originates from the open‑source Quarkus repository forked by HeroDevs. It encompasses modifications implemented by HeroDevs to ensure successful framework builds. This release contains no functional changes from Quarkus 3.20.6.2.

Stay in the loop

~/herodevs-spring-framework-support

Open Source Support

When official support ends, we're just getting started.