Skip to main content

Release notes

Each release is a signed set of packages, bundles, images and installers. Verify a release against its signed SHA256SUMS before you install it. See Verifying a release.

Release 8.1.0+3647.gafc556ab​

The Linux packages carry version 8.1.0+3647.gafc556ab. The Windows MSIs carry product version 8.1.3647. The REST Gateway API is version 1.7.0.

Security​

  • Node.js 24.22.2. The Console and the REST Gateway now run on Node.js 24.22.2. It carries every fix in Node.js's security release of October 21, 2026, among them CVE-2026-111497, an out-of-bounds write in the Brotli decoder, and two TLS certificate host name validation bypasses. The runtime moved in the tricryption-node package, in the tricryption-console-gateway MSI and in the Gateway and Console container images. See Security advisory: the Node.js runtime.
  • Kerberos. The Kerberos library the key server and the SDKs link carries the upstream fixes for CVE-2026-107778 and CVE-2026-107708. A Kerberos credential whose ticket count does not match its ticket information is now refused instead of being read.

Changed answers​

  • A ciphertext that does not decrypt answers 422 DECRYPT_FAILED. POST /api/v1/crypto/decrypt answered 403 ACCESS_DENIED when the ciphertext was encrypted under another key, or was damaged or cut short. It now answers 422 DECRYPT_FAILED, which is not retryable. A real refusal by the key's access list still answers 403 ACL_DENIED. The key server's audit trail records such a request with the reason Decrypt failed (decryptFailed in the audit API). See Reading a failure.
  • POST /api/v1/keys/get names why it refused. A session that did not sign in with a certificate the key server has enrolled answers 403 TRANSPORT_PRINCIPAL_REQUIRED. A request that names another principal answers 403 PRINCIPAL_MISMATCH.
  • A request body that is not valid JSON answers 400 BAD_REQUEST. Earlier releases answered 500 OP_FAILED.

Upgrading​

Upgrade in the order the Upgrading page gives. On Linux, install the new tricryption-node package together with the new tricryption-console-gateway package: the tier package depends on the exact runtime version. At code-signing level 2, register the new Console and Gateway release with the key server before you install it.

A client written against REST Gateway API 1.6.0 keeps working. It sees 422 where it saw 403 for a ciphertext that does not decrypt.