HeroDevs
Visit NES for Spring Home Page

Spring Cloud Gateway 4.2.x Release Notes

2 versions

Comprehensive release notes and changelog for Spring Cloud Gateway 4.2.x, including security patches, bug fixes, and feature updates across all supported versions.

Jun 17, 2026
Latest: 4.2.9
11 Patched Vulnerabilities
VEX Statements

June 2026

4.2.9

Released Jun 17, 2026
CVE-2026-47825
Full Version: 
4.2.7-spring-cloud-gateway-4.2.9

Bug Fixes

  • Spring Cloud Gateway Server forwards X-Forwarded-* and Forwarded headers received from untrusted proxies under certain configurations. These headers are now removed by default unless a trusted-proxy filter is explicitly configured. If your application relies on these headers, configure trusted proxies after upgrading: spring.cloud.gateway.trusted-proxies=10\.0\.0\..* (CVE-2026-47825).

Dependency Upgrades

  • Spring Cloud Build (NES) 4.2.4-spring-cloud-build-4.2.6
  • Spring Cloud CircuitBreaker (NES) 3.2.3-spring-cloud-circuitbreaker-3.2.5
  • Spring Cloud Commons (NES) 4.2.4-spring-cloud-commons-4.2.6

February 2026

4.2.8

Released Feb 4, 2026
Full Version: 
4.2.7-spring-cloud-gateway-4.2.8

Notes

  • This release originates from the open‑source Spring Cloud Gateway repository forked by HeroDevs. It encompasses modifications implemented by HeroDevs to ensure successful framework builds. This release contains no functional changes from Spring Cloud Gateway 4.2.7.

Dependency Upgrades

  • Spring Cloud Build (NES) 4.2.4-spring-cloud-build-4.2.5
  • Spring Cloud CircuitBreaker (NES) 3.2.3-spring-cloud-circuitbreaker-3.2.4
  • Spring Cloud Commons (NES) 4.2.4-spring-cloud-commons-4.2.5

Stay in the loop

~/herodevs-spring-framework-support

Open Source Support

When official support ends, we're just getting started.