What hashicorp/consul shipped

This week: fixed an XSS issue in the max_stale error response, updated security-related dependencies, and made the security scan workflow fail on detected CVEs while honoring suppressed vulnerabilities in config. The fixes were backported to 2.1.x.

This week in Consul: an XSS issue was fixed where an invalid max_stale value was echoed back in a 400 error and could be rendered by the browser when a Content-Type was set through http_config.response_headers. Security-related dependencies including follow-redirects, markdown-it, body-parser, fast-uri and qs were updated. The security scan workflow now fails when CVEs are detected, honors suppressed vulnerabilities from security-scan.hcl, and lists CVEs in a readable format. The XSS fix, dependency updates and workflow change were all backported to the 2.1.x release branch.

Consul 2.1.0 is out. Catalog writes are serialized with node write locks, every leaf cert request is authorized, and patch coverage of 90 percent is now required to merge PRs. Max supported Envoy is back to 1.39.1.

Consul 2.1.0 shipped this week. Catalog writes on the leader are now serialized with node write locks so authorization and Raft apply stay atomic, and every leaf certificate request is authorized to block unauthenticated cached requests. Pull request merges are now gated on at least 90 percent patch coverage for new or changed Go code. The maximum supported Envoy version was reverted to 1.39.1 to match consul-dataplane 2.1.0, and the envoyextensions and troubleshoot submodules were updated. Test modules no longer depend on the root module, addressing CVE-2026-15972.

Consul 2.1.0-rc2 is out: Go 1.26.9 for security fixes, raft-wal v0.5.0 drops the etcd dependency. Also this week: CVE-2026-15972 fixed by removing the root module from test modules, go-discover v1.5.0, and OIDC RP-Initiated logout plumbing.

Consul 2.1.0-rc2 is available. It upgrades Go to 1.26.9 to address standard library vulnerabilities and moves raft-wal to v0.5.0 with raft, serf, memberlist and go-metrics updates, removing the dependency on github.com/coreos/etcd. Other work this week: test modules no longer depend on the root hashicorp/consul module, closing CVE-2026-15972, an unauthenticated denial of service on external gRPC listeners; go-discover moves to v1.5.0 so go.mod no longer requires the archived hashicorp/vic; and OIDC RP-Initiated logout plumbing lets logging out of Consul also end the identity provider session. A WatchSet concurrency issue in the API gateway reconciler was also fixed, and the UI now renders tab content inside tab panels.

This week: fixed proxycfg watch leaks that grew memory, four API Gateway correctness bugs in DNS and routing, added a CSP header to UI responses, and addressed dependency security vulnerabilities.

This week in Consul: we fixed two independent watch leaks in agent/proxycfg that left goroutines and blocking queries running with nothing consuming their updates, which caused server goroutine count and memory to grow over time. Four API Gateway correctness bugs found during end-to-end DNS auto-registration testing were fixed, covering DNS lookups, routing, and upstream limits on both agentless and agentful deployments. Consul UI responses now include a Content-Security-Policy header to mitigate XSS and data injection attacks. Several dependency security vulnerabilities were addressed, feature gate RPCs were added, and the active versions manifest now includes 2.1 so backports to release/2.1.x can proceed.

Consul v2.1.0-rc1 is available. Connect certificates now rotate without dropping connections, and the redirect-traffic command uses nftables for better atomic rule application.

Consul v2.1.0-rc1 brings hitless Connect certificate rotation for sidecar proxies and terminating gateways, so your services stay connected during certificate updates. The consul connect redirect-traffic command now uses nftables for atomic IPv4/IPv6 rule application. Test the RC and share feedback.

Consul updates: nftables migration, SDK v0.19.0-rc1, API v1.35.0-rc1, and inference gateway type backports for CE.

This week's Consul updates include a major infrastructure shift from iptables to nftables, RC releases for SDK, API, and troubleshoot components, and backports of inference gateway and terminating gateway credential injection type surfaces to Community Edition for consul-k8s compatibility.

Consul now features a modernized UI with Helios Design System, post-quantum cryptography support for Connect sidecars, and improved release hygiene workflows.

This week's Consul updates bring significant improvements: the UI migrates to Helios Design System for a modernized interface, post-quantum cryptography hybrid key exchange is enabled across Connect Envoy sidecars and TLS communication, and new release hygiene workflows prevent internal metadata from entering the community repository.