Forum OpenACS Development: NaviServer 4.99.34, 5.0.6, and 5.1.1 released

Collapse
1: NaviServer 4.99.34, 5.0.6, and 5.1.1 released
Posted by Gustaf Neumann on 09/13/26 11:38 AM

Dear all,

The NaviServer 4.99.34, 5.0.6, and 5.1.1 were released, providing security and stability improvements across all three release branches. OpenACS administrators can update within their existing NaviServer series to obtain the corresponding fixes.

The maintenance releases for 4.99 and 5.0 include security backports for HTTP request framing, multipart form parsing, request-target handling, and CGI environments. All three releases fix cross-site scripting in generated directory listings and improve socket-error handling. The accompanying modules archives also contain security fixes for nsdbpg and nsconf, which should be updated alongside NaviServer where used.

NaviServer 5.1.1 offers additional benefits for installations upgrading from the older branches: built-in JSON support, HTTP/3, and more detailed operational diagnostics. This release strengthens JSON validation and nesting-depth enforcement; built-in JSON support is available only in the 5.1 series and newer.

HTTP/3 handling has been substantially improved for concurrent requests, slow downloads, aborted transfers, and connection shutdown. Writer-fed response queues are now bounded, avoiding memory growth proportional to the sizes of concurrent downloads. Following extensive testing and production use, HTTP/3 is no longer considered experimental. It remains optional and requires OpenSSL 4.0.2 or newer together with nghttp3 (a library providing HTTP/3 framing and QPACK header compression).

NaviServer 5.1.1 also reduces system-log noise while improving diagnostics. OpenSSL error stacks are consolidated into single log entries; TLS messages include the requested SNI hostname, and connection-thread creation messages identify the server, pool, and reason for replenishment. Misleading or duplicate messages have been reduced while retaining information useful for investigating security events and capacity bottlenecks.

For administrators, the updated nsstats utilization page requires NaviServer 5.1.1, since it relies on server introspection available in that release. It covers operating-system limits, driver and networking limits, and request-processing limits per connection pool, helping identify capacity bottlenecks and the configuration settings that deserve attention. The threads page also displays per-thread user and system CPU times, with CPU accounting now supported on macOS as well.

These diagnostics provide a reason to upgrade to 5.1.1 even when HTTP/3 is not needed yet. Upgrading does not require enabling HTTP/3.

The releases have been tested across multiple Tcl versions and platforms. Many thanks to Georg Lehner, Héctor Romojaro, John Buckman, Oleg Oleinick, Rolf Ade, and Wolfgang Winkler for their contributions, suggestions, reports, and testing.

Downloads are available from SourceForge and GitHub. The SourceForge archives include generated configuration files and documentation and are ready to configure and build; the GitHub tags provide the repository sources.

Detailed release notes:

Openacs.org is already running NaviServer 5.1.1 with HTTP/3 enabled. I will describe our production experience, the recent request storm, and the new utilization diagnostics in a separate posting.

All the best!

-gustaf neumann