# CoreDNS v1.13.1

- Product: CoreDNS (https://whatsnew.fyi/product/coredns)
- Vendor: CNCF
- Date: 2025-10-08
- Version: v1.13.1
- Original notes: https://github.com/coredns/coredns/releases/tag/v1.13.1
- Permalink: https://whatsnew.fyi/product/coredns/releases/v1.13.1

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **changed** — Avoid string concatenation in loops in core
- **security** — Update golang to 1.25.2 and golang.org/x/net to v0.45.0 to address multiple high-severity CVEs
- **fixed** — Reject invalid UTF-8 tokens in sign plugin dbfile

This release updates CoreDNS to Go 1.25.2 and golang.org/x/net v0.45.0 to address multiple
high-severity CVEs. It also improves core performance by avoiding string concatenation in
loops, and hardens the sign plugin by rejecting invalid UTF-8 tokens in dbfile.

##### Brought to You By

Catena cyber
Ville Vesilehto
Yong Tang

##### Noteworthy Changes

* core: Avoid string concatenation in loops (https://github.com/coredns/coredns/pull/7572)
* core: Update golang to 1.25.2 and golang.org/x/net to v0.45.0 on CVE fixes (https://github.com/coredns/coredns/pull/7598)
* plugin/sign: Reject invalid UTF‑8 dbfile token (https://github.com/coredns/coredns/pull/7589)