AdGuard Home

Changes compared to the previous beta, v0.108.0-b.89. See CHANGELOG.md for all changes.

Acknowledgements

A special thanks to @ATinyShoe for reporting the vulnerability, our community moderators team, as well as to everyone who filed and inspected issues, added translations, and helped us test this release!

Full changelog

Security

• AdGuard Home is now more resistant to resource exhaustion attacks when using DNS-over-QUIC.

  This is GHSA-w6v6-f44j-3rj2. We thank @ATinyShoe for reporting this security issue.

Added

• Bootstrap servers configuration now supports comments.

• The user is able to remove the static lease's hostname via the HTTP API.

Changed

• The edge channel has been switched to the new UI and versioning scheme.

Deprecated

• strict_sni_check is now deprecated.

Fixed

• Blocked requests without an EDNS(0) OPT record (#8183).

Changes compared to the previous beta, v0.108.0-b.88. See CHANGELOG.md for all changes.

Acknowledgements

A special thanks to @Nora-Qiu, @wallace0409, @Evelynkaz, and @N0zoM1z0 for reporting the vulnerabilities, our community moderators team, as well as to everyone who filed and inspected issues, added translations, and helped us test this release!

Full changelog

Security

• AdGuard Home is now more resistant to JIGGLE attacks.

  This is GHSA-p5f5-3p5g-rfjw. We thank @Nora-Qiu for reporting this security issue.

• AdGuard Home now validates responses from DoH upstreams more strictly.

  This is GHSA-4qjf-2hgm-92q6. We thank @wallace0409 for reporting this security issue.

• QUIC connections are now protected from unbounded reads.

  This is GHSA-qr92-rwvw-mhgh and GHSA-cccx-2r6r-m9r4. We thank @wallace0409 for reporting this security issue.

• AdGuard Home now validates responses from DNSCrypt upstreams more strictly.

• The H2C connection establishment via HTTP/1.1 request upgrade is no longer supported. See RFC 9113.

• Go version has been updated to prevent the possibility of exploiting the Go vulnerabilities fixed in 1.26.5.

• The size of rulelists is limited. This is necessary to prevent a user's machine from becoming overloaded if the filter source misbehaves.

  We thank Damir (@Evelynkaz) for reporting this security issue.

• QUIC connections now observe timeouts more strictly.

  This is GHSA-73vv-3434-p64c. We thank @N0zoM1z0 for reporting this security issue.

Added

• Improved updater logging to give users more insight into the problem with version updating (#8410).

Changed

• The interval of filter updates can now be set to any number of hours between 0 and 8760 (365 days) in the configuration file.

Configuration changes

• The filtering object of the YAML configuration now includes a new property, max_http_size, which defines the maximum size of the HTTP request for rulelists. To disable the limitation, set a large size, such as 1 TB.

Fixed

• Validation of the answer field in DNS rewrite rules in case it is represented as CNAME.

• Invalid AA flag in DNS responses (#7955).

• The parsing of the ech parameter in DNS rewrite rules for the HTTPS record type (#8276).

• Blocked services check on the Custom filtering rules page does not work properly without specifying of a client.

Security, security, security, security, security!

No, we do not have Steve Ballmer for CEO, but we took a page out of his playbook to draw attention to what we think is one of the most important aspects of developing AdGuard Home — security. This update is a good illustration of that: security-related changes take up over half of the changelog, and it’s not a small one.

We thank our awesome community members who helped us immensely by reporting some of the vulnerabilities, so that we could stay on top of our game and deliver timely fixes.

Full changelog

See also the v0.107.78 GitHub milestone.

Security

• AdGuard Home is now more resistant to JIGGLE attacks.

  This is GHSA-p5f5-3p5g-rfjw. We thank @Nora-Qiu for reporting this security issue.

• AdGuard Home now validates responses from DoH upstreams more strictly.

  This is GHSA-4qjf-2hgm-92q6. We thank @wallace0409 for reporting this security issue.

• QUIC connections are now protected from unbounded reads.

  This is GHSA-qr92-rwvw-mhgh and GHSA-cccx-2r6r-m9r4. We thank @wallace0409 for reporting this security issue.

• AdGuard Home now validates responses from DNSCrypt upstreams more strictly.

• The H2C connection establishment via HTTP/1.1 request upgrade is no longer supported. See RFC 9113.

• Go version has been updated to prevent the possibility of exploiting the Go vulnerabilities fixed in 1.26.5.

• The size of rulelists is limited. This is necessary to prevent a user's machine from becoming overloaded if the filter source misbehaves.

  We thank Damir (@Evelynkaz) for reporting this security issue.

Added

• Improved updater logging to give users more insight into the problem with version updating (#8410).

Changed

• The interval of filter updates can now be set to any number of hours between 0 and 8760 (365 days) in the configuration file.

Configuration changes

• The filtering object of the YAML configuration now includes a new property, max_http_size, which defines the maximum size of the HTTP request for rulelists. To disable the limitation, set a large size, such as 1 TB.

Fixed

• Invalid AA flag in DNS responses (#7955).

• The parsing of the ech parameter in DNS rewrite rules for the HTTPS record type (#8276).

• Blocked services check on the Custom filtering rules page does not work properly without specifying of a client.

Changes compared to the previous beta, v0.108.0-b.87. See CHANGELOG.md for all changes.

Acknowledgements

A special thanks to @djnnvx for reporting the vulnerability, our community moderators team, as well as to everyone who filed and inspected issues, added translations, and helped us test this release!

Full changelog

Security

• Authorization in GLiNET mode is no longer vulnerable to path traversal attacks.

  NOTE: This is CVE-2026-41448. We thank @djnnvx for reporting this security issue.

Fixed

• Blocked services check on the Custom filtering rules page does not work properly without specifying of a client.

The quality of a product is not defined solely by code or developers’ technical prowess. A strong community—or the lack of one—can often make or break how successful a piece of software will be. We are very lucky to have such a devoted and passionate community around AdGuard Home. This update has once again demonstrated this, as we were able to quickly address a vulnerability reported by one of our community members.

Acknowledgments

A special thanks to @djnnvx for reporting the vulnerability, our community moderators team and to everyone who filed and inspected issues, added translations, and helped us test this release!

Full changelog

See also the v0.107.77 GitHub milestone.

Security

• Authorization in GLiNET mode is no longer vulnerable to path traversal attacks.

  NOTE: This is CVE-2026-41448. We thank @djnnvx for reporting this security issue.

Added

• New reason query parameter in GET /control/querylog. See openapi/openapi.yaml for the full description.

Deprecated

• Query parameter response_status in GET /control/querylog is now deprecated. Use new reason query parameter instead.

Changes compared to the previous beta, v0.108.0-b.86. See CHANGELOG.md for all changes.

Full changelog

Changed

• Duration values in YAML configuration file now support d (days) units and has been updated.

  NOTE: Any rollback to version below the v0.107.76 should convert the values back to hours.

Fixed

• DNS caching with disabled DNSSEC (#8384).

They say: don’t fix it if it’s not broken. But what if it is, in fact, broken? Like the cache we may have accidentally messed up during the last update?  For such cases, there are hotfixes!  Make sure to install the today’s update in order to fix the cache on your AdGuard Home.

Acknowledgments

A special thanks to our community moderators team and to everyone who filed and inspected issues, added translations, and helped us test this release!

Full changelog

See also the v0.107.76 GitHub milestone.

Changed

• Duration values in YAML configuration file now support d (days) units and has been updated.

  NOTE: Any rollback to version below the v0.107.76 should convert the values back to hours.

Fixed

• DNS caching with disabled DNSSEC (#8384).

Changes compared to the previous beta, v0.108.0-b.85. See CHANGELOG.md for all changes.

Acknowledgements

A special thanks to @N0zoM1z0 for reporting the vulnerability, our community moderators team, as well as to everyone who filed and inspected issues, added translations, and helped us test this release!

Full changelog

Security

• Go version has been updated to prevent the possibility of exploiting the Go vulnerabilities fixed in 1.26.3.

• IDs of requests received over DoH and DoQ and forwarded to plain-DNS upstreams are now set to non-zero values to improve security.

  This is GHSA-xgx4-4h9w-53pv. We thank @N0zoM1z0 for reporting this security issue.

Added

• New reason query parameter in GET /control/querylog. See openapi/openapi.yaml for the full description.

Changed

• Frontend API requests no longer depend on axios.

• Dashboard charts use Recharts instead of Nivo.

• enable_dnssec in dns configuration now defines whether the proxy should set the DO flag in the upstream requests, the default is true (#7046).

Deprecated

• Query parameter response_status in GET /control/querylog is now deprecated. Use new reason query parameter instead.

Fixed

• Statistics database deadlock (#8359).

• Translated labels on the DNS settings pages not updating after changing the UI language.

• Dashboard charts now correctly display lower query counts (#6823).

• Redundant validation warnings about DHCP when it's disabled (#8348).

• Safe Browsing and Parental Control labels on the General Settings page not updating after changing the UI language.

This update gives AdGuard Home a solid security upgrade — think of it as tightening the locks and double-checking the doors.

We’ve fixed a critical vulnerability affecting DNS-over-QUIC and DNS-over-HTTPS that could put your DNS privacy at risk. The gap is now closed, and your encrypted traffic is back to traveling through a properly armored tunnel.

We also updated Go to the latest version, sweeping out known vulnerabilities in its libraries.

Acknowledgments

A special thanks to @N0zoM1z0 for reporting the vulnerability, our community moderators team and to everyone who filed and inspected issues, added translations, and helped us test this release!

Full changelog

See also the v0.107.75 GitHub milestone.

Security

• Go version has been updated to prevent the possibility of exploiting the Go vulnerabilities fixed in 1.26.3.

• IDs of requests received over DoH and DoQ and forwarded to plain-DNS upstreams are now set to non-zero values to improve security.

  This is GHSA-xgx4-4h9w-53pv. We thank @N0zoM1z0 for reporting this security issue.

Changed

• Frontend API requests no longer depend on axios.

• Dashboard charts use Recharts instead of Nivo.

• enable_dnssec in dns configuration now defines whether the proxy should set the DO flag in the upstream requests, the default is true (#7046).

Fixed

• Statistics database deadlock (#8359).

• Translated labels on the DNS settings pages not updating after changing the UI language.

• Dashboard charts now correctly display lower query counts (#6823).

• Redundant validation warnings about DHCP when it's disabled (#8348).

• Safe Browsing and Parental Control labels on the General Settings page not updating after changing the UI language.

As with everything in life, the best things are only the best because they stand out from the mundane. Without regular there would be no exceptional.

…all these words to say that this AdGuard Home update is the ‘boring’ one, with mostly bug fixes and security updates — so that the next time we add something new, it would feel fresh and exciting!

Acknowledgments

A special thanks to our community moderators team and to everyone who filed and inspected issues, added translations, and helped us test this release!

Full changelog

See also the v0.107.74 GitHub milestone.

Security

• Frontend libraries has been updated to prevent the possibility of exploiting the vulnerability described in CVE-2026-40175.

• Go version has been updated to prevent the possibility of exploiting the Go vulnerabilities fixed in 1.26.2.

Changed

Configuration changes

In this release, the schema version has changed from 33 to 34.

• Added a new field doh in http configuration.

  # BEFORE:
  'http':
    # …
  'tls':
    # …
    'allow_unencrypted_doh': false
  
  # AFTER:
  'http':
    # …
    'doh':
      'insecure_enabled': false
      'routes':
        - 'GET /dns-query'
        - 'POST /dns-query'
        - 'GET /dns-query/{ClientID}'
        - 'POST /dns-query/{ClientID}'
  'tls':
    # …
  

  To roll back this change, set the schema_version back to 33.

Fixed

• Incorrect forwarding of root domain requests when domain-specific upstreams are configured (#7058).

• The strict SNI check setting is not persisted when the TLS configuration is changed (#8327).

• Status reported by the launchd service implementation in cases of scheduled service restart.

• Fixed clients block/unblock when moving clients between allowed and disallowed lists.