Skip to content

LiteSpeed Web Server changelog

Note

We do our best to update this changelog in a timely manner. However, if a build is missing, you can always find the release announcement in our LiteSpeed Edge Google Group.

Check the currently installed build number:

cat lsws/BUILD

Update to the latest build:

/usr/local/lsws/admin/misc/lsup.sh -f -v 6.3.6

Version 6.3.6

Build 1

Released: July 14, 2026

  • [Bug fix] Address a 503 error serving static files via Python application.
  • [Bug fix] Address a ModSecurity regression blocking JSON POST body.
  • [Bug fix] Address a cache purge regression.

Build 0

Released: July 10, 2026

  • [Security] Extensive general code hardening.
  • [Feature] Protect against HTTP/2/HTTP/3 stream flood abuse.
  • [Feature] Add Bun support for Node.js applications.
  • [Improvement] Strengthen HTTP/2/HTTP/3 header validation.
  • [Improvement] Automatically block access to URLs containing /.env*.
  • [Improvement] Auto-remount stale MySQL socket file in namespace.
  • [Improvement] Disable SHA-1 signing algorithm for TLSv1.2 handshake.
  • [Improvement] Add CAPTCHA page status code customization via Apache-style directive LsRecaptcha status_code ... at server level.
  • [Bug fix] Properly handle quoted target URL in Apache ErrorDocument configuration directive.
  • [Bug fix] Address a corner case for Apache ProxyPass configuration handling.
  • [Bug fix] Address a corner case that blocks PROXY protocol.
  • [Tuning] Update QUIC Alt-Svc to advertise h3 and h3-29 only by default.

Older versions