# AdGuard Home changelog > A network-wide ad and tracker blocking DNS server. - Vendor: AdGuard - Category: Developer Tools - Official site: https://adguard.com/adguard-home/ - Tracked by: What's New (https://whatsnew.fyi/product/adguard-home) - Harvested from: GitHub (AdguardTeam/AdGuardHome) - Entries below: 10 (newest first) What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog. ## Releases ### v0.108.0-b.90 — AdGuard Home v0.108.0-b.90 - Date: 2026-07-30 - Version: v0.108.0-b.90 - Original notes: https://github.com/AdguardTeam/AdGuardHome/releases/tag/v0.108.0-b.90 - Permalink: https://whatsnew.fyi/product/adguard-home/releases/v0.108.0-b.90 - Labels: Pre-release - **security** — AdGuard Home is now more resistant to resource exhaustion attacks when using DNS-over-QUIC - **added** — Bootstrap servers configuration now supports comments - **added** — The user is able to remove the static lease's hostname via the HTTP API - **changed** — The edge channel has been switched to the new UI and versioning scheme - **deprecated** — strict_sni_check is now deprecated - **fixed** — Blocked requests without an EDNS(0) OPT record Changes compared to the previous beta, v0.108.0-b.89. See [CHANGELOG.md] for all changes. ##### Acknowledgements A special thanks to @ATinyShoe for reporting the vulnerability, our community moderators team, as well as to everyone who filed and inspected issues, added translations, and helped us test this release! ##### Full changelog ###### Security - AdGuard Home is now more resistant to resource exhaustion attacks when using DNS-over-QUIC. This is GHSA-w6v6-f44j-3rj2. We thank @ATinyShoe for reporting this security issue. ###### Added - Bootstrap servers configuration now supports comments. - The user is able to remove the static lease's hostname via the HTTP API. ###### Changed - The `edge` channel has been switched to the new UI and versioning scheme. ###### Deprecated - `strict_sni_check` is now deprecated. ###### Fixed - Blocked requests without an EDNS(0) OPT record (#8183). [CHANGELOG.md]: https://github.com/AdguardTeam/AdGuardHome/tree/v0.108.0-b.90/CHANGELOG.md ### v0.108.0-b.89 — AdGuard Home v0.108.0-b.89 - Date: 2026-07-14 - Version: v0.108.0-b.89 - Original notes: https://github.com/AdguardTeam/AdGuardHome/releases/tag/v0.108.0-b.89 - Permalink: https://whatsnew.fyi/product/adguard-home/releases/v0.108.0-b.89 - Labels: Pre-release - **security** — AdGuard Home is now more resistant to JIGGLE attacks - **security** — AdGuard Home now validates responses from DoH upstreams more strictly - **security** — QUIC connections are now protected from unbounded reads - **security** — AdGuard Home now validates responses from DNSCrypt upstreams more strictly - **security** — The H2C connection establishment via HTTP/1.1 request upgrade is no longer supported - **security** — Go version has been updated to prevent the possibility of exploiting Go vulnerabilities - **security** — The size of rulelists is limited to prevent a user's machine from becoming overloaded if the filter source misbehaves - **security** — QUIC connections now observe timeouts more strictly - **added** — Improved updater logging to give users more insight into the problem with version updating - **changed** — The interval of filter updates can now be set to any number of hours between 0 and 8760 (365 days) in the configuration file - **changed** — The filtering object of the YAML configuration now includes a new property, max_http_size, which defines the maximum size of the HTTP request for rulelists - **fixed** — Validation of the answer field in DNS rewrite rules in case it is represented as CNAME - **fixed** — Invalid AA flag in DNS responses - **fixed** — The parsing of the ech parameter in DNS rewrite rules for the HTTPS record type - **fixed** — Blocked services check on the Custom filtering rules page does not work properly without specifying of a client Changes compared to the previous beta, v0.108.0-b.88. See [CHANGELOG.md] for all changes. ##### Acknowledgements A special thanks to @Nora-Qiu, @wallace0409, @Evelynkaz, and @N0zoM1z0 for reporting the vulnerabilities, our community moderators team, as well as to everyone who filed and inspected issues, added translations, and helped us test this release! ##### Full changelog ###### Security - AdGuard Home is now more resistant to JIGGLE attacks. This is GHSA-p5f5-3p5g-rfjw. We thank @Nora-Qiu for reporting this security issue. - AdGuard Home now validates responses from DoH upstreams more strictly. This is GHSA-4qjf-2hgm-92q6. We thank @wallace0409 for reporting this security issue. - QUIC connections are now protected from unbounded reads. This is GHSA-qr92-rwvw-mhgh and GHSA-cccx-2r6r-m9r4. We thank @wallace0409 for reporting this security issue. - AdGuard Home now validates responses from DNSCrypt upstreams more strictly. - The H2C connection establishment via HTTP/1.1 request upgrade is no longer supported. See [RFC 9113][rfc9113]. - Go version has been updated to prevent the possibility of exploiting the Go vulnerabilities fixed in [1.26.5][go-1.26.5]. - The size of rulelists is limited. This is necessary to prevent a user's machine from becoming overloaded if the filter source misbehaves. We thank Damir (@Evelynkaz) for reporting this security issue. - QUIC connections now observe timeouts more strictly. This is GHSA-73vv-3434-p64c. We thank @N0zoM1z0 for reporting this security issue. ###### Added - Improved updater logging to give users more insight into the problem with version updating (#8410). ###### Changed - The interval of filter updates can now be set to any number of hours between `0` and `8760` (365 days) in the configuration file. ###### Configuration changes - The `filtering` object of the YAML configuration now includes a new property, `max_http_size`, which defines the maximum size of the HTTP request for rulelists. To disable the limitation, set a large size, such as `1 TB`. ###### Fixed - Validation of the `answer` field in DNS rewrite rules in case it is represented as CNAME. - Invalid AA flag in DNS responses (#7955). - The parsing of the `ech` parameter in DNS rewrite rules for the HTTPS record type (#8276). - Blocked services check on the Custom filtering rules page does not work properly without specifying of a client. [go-1.26.5]: https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc [rfc9113]: https://datatracker.ietf.org/doc/html/rfc9113 [CHANGELOG.md]: https://github.com/AdguardTeam/AdGuardHome/tree/v0.108.0-b.89/CHANGELOG.md ### v0.107.78 — AdGuard Home v0.107.78 - Date: 2026-07-13 - Version: v0.107.78 - Original notes: https://github.com/AdguardTeam/AdGuardHome/releases/tag/v0.107.78 - Permalink: https://whatsnew.fyi/product/adguard-home/releases/v0.107.78 - **security** — AdGuard Home is now more resistant to JIGGLE attacks - **security** — AdGuard Home now validates responses from DoH upstreams more strictly - **security** — QUIC connections are now protected from unbounded reads - **security** — AdGuard Home now validates responses from DNSCrypt upstreams more strictly - **security** — The H2C connection establishment via HTTP/1.1 request upgrade is no longer supported - **security** — Go version has been updated to prevent the possibility of exploiting Go vulnerabilities - **security** — The size of rulelists is limited to prevent a user's machine from becoming overloaded - **added** — Improved updater logging to give users more insight into version updating problems - **changed** — The interval of filter updates can now be set to any number of hours between 0 and 8760 - **changed** — The filtering object of the YAML configuration now includes a new property max_http_size which defines the maximum size of the HTTP request for rulelists - **fixed** — Invalid AA flag in DNS responses - **fixed** — The parsing of the ech parameter in DNS rewrite rules for the HTTPS record type - **fixed** — Blocked services check on the Custom filtering rules page does not work properly without specifying of a client Security, security, security, security, security! No, we do not have Steve Ballmer for CEO, but we took a page out of his playbook to draw attention to what we think is one of the most important aspects of developing AdGuard Home — security. This update is a good illustration of that: security-related changes take up over half of the changelog, and it’s not a small one. We thank our awesome community members who helped us immensely by reporting some of the vulnerabilities, so that we could stay on top of our game and deliver timely fixes. ##### Full changelog See also the [v0.107.78 GitHub milestone][ms-v0.107.78]. ###### Security - AdGuard Home is now more resistant to JIGGLE attacks. This is GHSA-p5f5-3p5g-rfjw. We thank @Nora-Qiu for reporting this security issue. - AdGuard Home now validates responses from DoH upstreams more strictly. This is GHSA-4qjf-2hgm-92q6. We thank @wallace0409 for reporting this security issue. - QUIC connections are now protected from unbounded reads. This is GHSA-qr92-rwvw-mhgh and GHSA-cccx-2r6r-m9r4. We thank @wallace0409 for reporting this security issue. - AdGuard Home now validates responses from DNSCrypt upstreams more strictly. - The H2C connection establishment via HTTP/1.1 request upgrade is no longer supported. See [RFC 9113][rfc9113]. - Go version has been updated to prevent the possibility of exploiting the Go vulnerabilities fixed in [1.26.5][go-1.26.5]. - The size of rulelists is limited. This is necessary to prevent a user's machine from becoming overloaded if the filter source misbehaves. We thank Damir (@Evelynkaz) for reporting this security issue. ###### Added - Improved updater logging to give users more insight into the problem with version updating (#8410). ###### Changed - The interval of filter updates can now be set to any number of hours between `0` and `8760` (365 days) in the configuration file. ###### Configuration changes - The `filtering` object of the YAML configuration now includes a new property, `max_http_size`, which defines the maximum size of the HTTP request for rulelists. To disable the limitation, set a large size, such as `1 TB`. ###### Fixed - Invalid AA flag in DNS responses (#7955). - The parsing of the `ech` parameter in DNS rewrite rules for the HTTPS record type (#8276). - Blocked services check on the Custom filtering rules page does not work properly without specifying of a client. [go-1.26.5]: https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc [ms-v0.107.78]: https://github.com/AdguardTeam/AdGuardHome/milestone/113?closed=1 [rfc9113]: https://datatracker.ietf.org/doc/html/rfc9113 ### v0.108.0-b.88 — AdGuard Home v0.108.0-b.88 - Date: 2026-06-02 - Version: v0.108.0-b.88 - Original notes: https://github.com/AdguardTeam/AdGuardHome/releases/tag/v0.108.0-b.88 - Permalink: https://whatsnew.fyi/product/adguard-home/releases/v0.108.0-b.88 - Labels: Pre-release - **security** — Authorization in GLiNET mode is no longer vulnerable to path traversal attacks - **fixed** — Blocked services check on the Custom filtering rules page does not work properly without specifying of a client Changes compared to the previous beta, v0.108.0-b.87. See [CHANGELOG.md] for all changes. ##### Acknowledgements A special thanks to @djnnvx for reporting the vulnerability, our community moderators team, as well as to everyone who filed and inspected issues, added translations, and helped us test this release! ##### Full changelog ###### Security - Authorization in GLiNET mode is no longer vulnerable to path traversal attacks. **NOTE:** This is CVE-2026-41448. We thank @djnnvx for reporting this security issue. ###### Fixed - Blocked services check on the Custom filtering rules page does not work properly without specifying of a client. [CHANGELOG.md]: https://github.com/AdguardTeam/AdGuardHome/tree/v0.108.0-b.88/CHANGELOG.md ### v0.107.77 — AdGuard Home v0.107.77 - Date: 2026-06-02 - Version: v0.107.77 - Original notes: https://github.com/AdguardTeam/AdGuardHome/releases/tag/v0.107.77 - Permalink: https://whatsnew.fyi/product/adguard-home/releases/v0.107.77 - **security** — Authorization in GLiNET mode is no longer vulnerable to path traversal attacks - **added** — New `reason` query parameter in `GET /control/querylog` - **deprecated** — Query parameter `response_status` in `GET /control/querylog` is now deprecated in favor of the new `reason` query parameter The quality of a product is not defined solely by code or developers’ technical prowess. A strong community—or the lack of one—can often make or break how successful a piece of software will be. We are very lucky to have such a devoted and passionate community around AdGuard Home. This update has once again demonstrated this, as we were able to quickly address a vulnerability reported by one of our community members. ##### Acknowledgments A special thanks to @djnnvx for reporting the vulnerability, our community moderators team and to everyone who filed and inspected issues, added translations, and helped us test this release! ##### Full changelog See also the [v0.107.77 GitHub milestone][ms-v0.107.77]. ###### Security - Authorization in GLiNET mode is no longer vulnerable to path traversal attacks. **NOTE:** This is CVE-2026-41448. We thank @djnnvx for reporting this security issue. ###### Added - New `reason` query parameter in `GET /control/querylog`. See `openapi/openapi.yaml` for the full description. ###### Deprecated - Query parameter `response_status` in `GET /control/querylog` is now deprecated. Use new `reason` query parameter instead. [ms-v0.107.77]: https://github.com/AdguardTeam/AdGuardHome/milestone/112?closed=1 ### v0.108.0-b.87 — AdGuard Home v0.108.0-b.87 - Date: 2026-05-22 - Version: v0.108.0-b.87 - Original notes: https://github.com/AdguardTeam/AdGuardHome/releases/tag/v0.108.0-b.87 - Permalink: https://whatsnew.fyi/product/adguard-home/releases/v0.108.0-b.87 - Labels: Pre-release - **changed** — Duration values in YAML configuration file now support d (days) units - **fixed** — DNS caching with disabled DNSSEC Changes compared to the previous beta, v0.108.0-b.86. See [CHANGELOG.md] for all changes. ##### Full changelog ###### Changed - Duration values in YAML configuration file now support `d` (days) units and has been updated. **NOTE:** Any rollback to version below the `v0.107.76` should convert the values back to hours. ###### Fixed - DNS caching with disabled DNSSEC ([#8384]). [#8384]: https://github.com/AdguardTeam/AdGuardHome/issues/8384 [CHANGELOG.md]: https://github.com/AdguardTeam/AdGuardHome/tree/v0.108.0-b.87/CHANGELOG.md ### v0.107.76 — AdGuard Home v0.107.76 - Date: 2026-05-21 - Version: v0.107.76 - Original notes: https://github.com/AdguardTeam/AdGuardHome/releases/tag/v0.107.76 - Permalink: https://whatsnew.fyi/product/adguard-home/releases/v0.107.76 - **fixed** — DNS caching with disabled DNSSEC - **changed** — Duration values in YAML configuration file now support d (days) units They say: don’t fix it if it’s not broken. But what if it is, in fact, broken? Like the cache we may have accidentally messed up during the last update?  For such cases, there are hotfixes!  Make sure to install the today’s update in order to fix the cache on your AdGuard Home. ##### Acknowledgments A special thanks to our community moderators team and to everyone who filed and inspected issues, added translations, and helped us test this release! ##### Full changelog See also the [v0.107.76 GitHub milestone][ms-v0.107.76]. ###### Changed - Duration values in YAML configuration file now support `d` (days) units and has been updated. **NOTE:** Any rollback to version below the `v0.107.76` should convert the values back to hours. ###### Fixed - DNS caching with disabled DNSSEC ([#8384]). [#8384]: https://github.com/AdguardTeam/AdGuardHome/issues/8384 [ms-v0.107.76]: https://github.com/AdguardTeam/AdGuardHome/milestone/111?closed=1 ### v0.108.0-b.86 — AdGuard Home v0.108.0-b.86 - Date: 2026-05-19 - Version: v0.108.0-b.86 - Original notes: https://github.com/AdguardTeam/AdGuardHome/releases/tag/v0.108.0-b.86 - Permalink: https://whatsnew.fyi/product/adguard-home/releases/v0.108.0-b.86 - Labels: Pre-release - **security** — Go version has been updated to prevent exploitation of Go vulnerabilities fixed in version 1.26.3 - **security** — IDs of requests received over DoH and DoQ and forwarded to plain-DNS upstreams are now set to non-zero values to improve security - **added** — New `reason` query parameter in `GET /control/querylog` - **changed** — Frontend API requests no longer depend on axios - **changed** — Dashboard charts use Recharts instead of Nivo - **changed** — `enable_dnssec` in `dns` configuration now defines whether the proxy should set the DO flag in upstream requests, with default value `true` - **deprecated** — Query parameter `response_status` in `GET /control/querylog` is now deprecated in favor of new `reason` query parameter - **fixed** — Statistics database deadlock - **fixed** — Translated labels on the DNS settings pages not updating after changing the UI language - **fixed** — Dashboard charts now correctly display lower query counts - **fixed** — Redundant validation warnings about DHCP when it is disabled - **fixed** — Safe Browsing and Parental Control labels on the General Settings page not updating after changing the UI language Changes compared to the previous beta, v0.108.0-b.85. See [CHANGELOG.md] for all changes. ##### Acknowledgements A special thanks to @N0zoM1z0 for reporting the vulnerability, our community moderators team, as well as to everyone who filed and inspected issues, added translations, and helped us test this release! ##### Full changelog ###### Security - Go version has been updated to prevent the possibility of exploiting the Go vulnerabilities fixed in [1.26.3][go-1.26.3]. - IDs of requests received over DoH and DoQ and forwarded to plain-DNS upstreams are now set to non-zero values to improve security. This is GHSA-xgx4-4h9w-53pv. We thank @N0zoM1z0 for reporting this security issue. ###### Added - New `reason` query parameter in `GET /control/querylog`. See `openapi/openapi.yaml` for the full description. ###### Changed - Frontend API requests no longer depend on axios. - Dashboard charts use Recharts instead of Nivo. - `enable_dnssec` in `dns` configuration now defines whether the proxy should set the DO flag in the upstream requests, the default is `true` (#7046). ###### Deprecated - Query parameter `response_status` in `GET /control/querylog` is now deprecated. Use new `reason` query parameter instead. ###### Fixed - Statistics database deadlock (#8359). - Translated labels on the DNS settings pages not updating after changing the UI language. - Dashboard charts now correctly display lower query counts (#6823). - Redundant validation warnings about DHCP when it's disabled (#8348). - Safe Browsing and Parental Control labels on the General Settings page not updating after changing the UI language. [CHANGELOG.md]: https://github.com/AdguardTeam/AdGuardHome/tree/v0.108.0-b.86/CHANGELOG.md [go-1.26.3]: https://groups.google.com/g/golang-announce/c/qcCIEXso47M ### v0.107.75 — AdGuard Home v0.107.75 - Date: 2026-05-19 - Version: v0.107.75 - Original notes: https://github.com/AdguardTeam/AdGuardHome/releases/tag/v0.107.75 - Permalink: https://whatsnew.fyi/product/adguard-home/releases/v0.107.75 - **security** — Fixed a critical vulnerability in DNS-over-QUIC and DNS-over-HTTPS where request IDs forwarded to plain-DNS upstreams were not properly set to non-zero values - **security** — Updated Go to version 1.26.3 to prevent exploitation of known Go vulnerabilities - **changed** — Frontend API requests no longer depend on axios - **changed** — Dashboard charts now use Recharts instead of Nivo - **changed** — The enable_dnssec configuration option now defines whether the proxy should set the DO flag in upstream requests, with the default set to true - **fixed** — Statistics database deadlock - **fixed** — Translated labels on DNS settings pages not updating after changing the UI language - **fixed** — Dashboard charts now correctly display lower query counts - **fixed** — Redundant validation warnings about DHCP when it is disabled - **fixed** — Safe Browsing and Parental Control labels on the General Settings page not updating after changing the UI language This update gives AdGuard Home a solid security upgrade — think of it as tightening the locks and double-checking the doors. We’ve fixed a critical vulnerability affecting DNS-over-QUIC and DNS-over-HTTPS that could put your DNS privacy at risk. The gap is now closed, and your encrypted traffic is back to traveling through a properly armored tunnel. We also updated Go to the latest version, sweeping out known vulnerabilities in its libraries. ##### Acknowledgments A special thanks to @N0zoM1z0 for reporting the vulnerability, our community moderators team and to everyone who filed and inspected issues, added translations, and helped us test this release! ##### Full changelog See also the [v0.107.75 GitHub milestone][ms-v0.107.75]. ###### Security - Go version has been updated to prevent the possibility of exploiting the Go vulnerabilities fixed in [1.26.3][go-1.26.3]. - IDs of requests received over DoH and DoQ and forwarded to plain-DNS upstreams are now set to non-zero values to improve security. This is GHSA-xgx4-4h9w-53pv. We thank @N0zoM1z0 for reporting this security issue. ###### Changed - Frontend API requests no longer depend on axios. - Dashboard charts use Recharts instead of Nivo. - `enable_dnssec` in `dns` configuration now defines whether the proxy should set the DO flag in the upstream requests, the default is `true` (#7046). ###### Fixed - Statistics database deadlock (#8359). - Translated labels on the DNS settings pages not updating after changing the UI language. - Dashboard charts now correctly display lower query counts (#6823). - Redundant validation warnings about DHCP when it's disabled (#8348). - Safe Browsing and Parental Control labels on the General Settings page not updating after changing the UI language. [ms-v0.107.75]: https://github.com/AdguardTeam/AdGuardHome/milestone/110?closed=1 [go-1.26.3]: https://groups.google.com/g/golang-announce/c/qcCIEXso47M ### v0.107.74 — AdGuard Home v0.107.74 - Date: 2026-04-16 - Version: v0.107.74 - Original notes: https://github.com/AdguardTeam/AdGuardHome/releases/tag/v0.107.74 - Permalink: https://whatsnew.fyi/product/adguard-home/releases/v0.107.74 - **security** — Update frontend libraries to prevent exploitation of CVE-2026-40175 - **security** — Update Go version to prevent exploitation of vulnerabilities fixed in Go 1.26.2 - **changed** — Add new field doh in http configuration with insecure_enabled and routes settings - **fixed** — Fix incorrect forwarding of root domain requests when domain-specific upstreams are configured - **fixed** — Fix strict SNI check setting not being persisted when TLS configuration is changed - **fixed** — Fix status reported by launchd service implementation in cases of scheduled service restart - **fixed** — Fix clients block/unblock when moving clients between allowed and disallowed lists As with everything in life, the best things are only the best because they stand out from the mundane. Without regular there would be no exceptional. …all these words to say that this AdGuard Home update is the ‘boring’ one, with mostly bug fixes and security updates — so that the next time we add something new, it would feel fresh and exciting! ##### Acknowledgments A special thanks to our community moderators team and to everyone who filed and inspected issues, added translations, and helped us test this release! ##### Full changelog See also the [v0.107.74 GitHub milestone][ms-v0.107.74]. ###### Security - Frontend libraries has been updated to prevent the possibility of exploiting the vulnerability described in [CVE-2026-40175][cve-2026-40175]. - Go version has been updated to prevent the possibility of exploiting the Go vulnerabilities fixed in [1.26.2][go-1.26.2]. ###### Changed ###### Configuration changes In this release, the schema version has changed from 33 to 34. - Added a new field `doh` in `http` configuration. ```yaml # BEFORE: 'http': # … 'tls': # … 'allow_unencrypted_doh': false # AFTER: 'http': # … 'doh': 'insecure_enabled': false 'routes': - 'GET /dns-query' - 'POST /dns-query' - 'GET /dns-query/{ClientID}' - 'POST /dns-query/{ClientID}' 'tls': # … ``` To roll back this change, set the `schema_version` back to `33`. ###### Fixed - Incorrect forwarding of root domain requests when domain-specific upstreams are configured (#7058). - The strict SNI check setting is not persisted when the TLS configuration is changed (#8327). - Status reported by the launchd service implementation in cases of scheduled service restart. - Fixed clients block/unblock when moving clients between allowed and disallowed lists. [cve-2026-40175]: https://nvd.nist.gov/vuln/detail/CVE-2026-40175 [go-1.26.2]: https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU [ms-v0.107.74]: https://github.com/AdguardTeam/AdGuardHome/milestone/109?closed=1