Skip to content

LiteSpeed Web Server changelog

Note

We do our best to update this changelog in a timely manner. However, if a build is missing, you can always find the release announcement in our LiteSpeed Edge Google Group.

Check the currently installed build number:

cat lsws/BUILD

Update to the latest build:

/usr/local/lsws/admin/misc/lsup.sh -f -v 6.3.6

Version 6.4 Release Candidates

RC1

Build 1

Released: August 3, 2026

  • [Bug fix] Allow \ in query string for HTTP/2 and HTTP/3 request headers.
  • [Bug fix] Address another HTTP/2 request body length corner case that caused 400 status codes from proxy backends.
  • [Improvement] Support for multiple remote ACL URLs.

Build 0

Released: July 28, 2026

  • [Feature] Add Anubis proof-of-work support.
  • [Feature] Add ALTCHA CAPTCHA support.
  • [Feature] Add Zstandard compression support.
  • [Feature] Add background cache refresh support.
  • [Feature] Add new UI for WebAdmin management console.
  • [Feature] Strengthen HTTP/2 and HTTP/3 resource abuse protection.
  • [Bug fix] Include all bug fixes applied to 6.3.x releases.

Version 6.3.6

Build 6

Released: August 3, 2026

  • [Bug fix] Allow \ in query string for HTTP/2 and HTTP/3 request headers.
  • [Improvement] Support for multiple remote ACL URLs.

Build 5

Released: July 30, 2026

  • [Bug fix] Address another HTTP/2 request body length corner case that caused 400 status codes from proxy backends.

Build 4

Released: July 28, 2026

  • [Bug fix] Address a corner case in internal URL cache handling.
  • [Improvement] Add support for the MKCALENDAR request method.

Build 3

Released: July 27, 2026

  • [Bug fix] Update lsquic to v4.9.2 for the latest bug fixes.
  • [Bug fix] Address a corner case in offloading static file compression to a helper thread.
  • [Bug fix] Address a namespaces malfunctioning regression introduced in build 2.

Build 2

Released: July 24, 2026

  • [Feature] Enable post-quantum cryptography key exchange.
  • [Bug fix] Address an HTTP/2 request body length regression that caused 400 status codes from proxy backends.
  • [Misc] Tweak install script to avoid dangling symlinks.

Build 1

Released: July 14, 2026

  • [Bug fix] Address a 503 error serving static files via Python application.
  • [Bug fix] Address a ModSecurity regression blocking JSON POST body.
  • [Bug fix] Address a cache purge regression.

Build 0

Released: July 10, 2026

  • [Security] Extensive general code hardening.
  • [Feature] Protect against HTTP/2/HTTP/3 stream flood abuse.
  • [Feature] Add Bun support for Node.js applications.
  • [Improvement] Strengthen HTTP/2/HTTP/3 header validation.
  • [Improvement] Automatically block access to URLs containing /.env*.
  • [Improvement] Auto-remount stale MySQL socket file in namespace.
  • [Improvement] Disable SHA-1 signing algorithm for TLSv1.2 handshake.
  • [Improvement] Add CAPTCHA page status code customization via Apache-style directive LsRecaptcha status_code ... at server level.
  • [Bug fix] Properly handle quoted target URL in Apache ErrorDocument configuration directive.
  • [Bug fix] Address a corner case for Apache ProxyPass configuration handling.
  • [Bug fix] Address a corner case that blocks PROXY protocol.
  • [Tuning] Update QUIC Alt-Svc to advertise h3 and h3-29 only by default.

Older versions