Release Info¶

• Version: 1.4.82
• Previous version: 1.4.81
• Branch: 1.4
• Status: stable
• Release Purpose: bug fixes
• Release manager: gstrauss
• Released date: 2025-09-12

Important changes from 1.4.81¶

• restrict request trailers to configured list; bugfixes

BEHAVIOR CHANGES:¶

• trailers in request headers will be ignored unless allowed field names
  are explicitly configured in a comma-separated list containing no spaces:
  server.feature-flags += ("request.trailer-whitelist" => "...")
  This changes behavior from lighttpd 1.4.80, which added support for
  request trailers and header merging, but did not restrict request trailers.

Downloads¶

• https://download.lighttpd.net/lighttpd/releases-1.4.x/lighttpd-1.4.82.tar.gz
  • GPG signature: https://download.lighttpd.net/lighttpd/releases-1.4.x/lighttpd-1.4.82.tar.gz.asc
  • SHA256: 4f07f2d61ee8d136d105d9a62f139a46ad8216fe9e346476ee5340f87bcabd79
• https://download.lighttpd.net/lighttpd/releases-1.4.x/lighttpd-1.4.82.tar.xz
  • GPG signature: https://download.lighttpd.net/lighttpd/releases-1.4.x/lighttpd-1.4.82.tar.xz.asc
  • SHA256: abfe74391f9cbd66ab154ea07e64f194dbe7e906ef4ed47eb3b0f3b46246c962
• SHA256 checksums: https://download.lighttpd.net/lighttpd/releases-1.4.x/lighttpd-1.4.82.sha256sum
• SHA512 checksums: https://download.lighttpd.net/lighttpd/releases-1.4.x/lighttpd-1.4.82.sha512sum

Changes from 1.4.81¶

• [core] restrict request trailers to configured list
• [core] fix logic inversion in "toupper:" modifier
• [mod_redirect,mod_rewrite] ${url.authority.noport} token
• [cmake,mod_mbedtls] mbedx509 mbedcrypto order
• [mod_mbedtls] psa_crypto_init() for MBEDTLS_USE_PSA_CRYPTO (fixes #3288)
• [build] mod_mbedtls: use tfpsacrypto if found
• [ci] Bump actions/checkout from 4 to 5
• [core] avoid chunk mem reallocation on read/recv

External references¶

• https://www.lighttpd.net/2025/9/12/1.4.82