# mediamtx v1.18.1

- Product: mediamtx (https://whatsnew.fyi/product/mediamtx)
- Vendor: bluenviron
- Date: 2026-04-30
- Version: v1.18.1
- Original notes: https://github.com/bluenviron/mediamtx/releases/tag/v1.18.1
- Permalink: https://whatsnew.fyi/product/mediamtx/releases/v1.18.1

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Prevent code injection in case of MTX_QUERY in hooks by url-encoding MTX_QUERY
- **changed** — Use temporary redirects instead of permanent redirects to prevent unwanted caching
- **security** — Prevent open redirect attacks in HLS
- **added** — Support reading and writing KLV in HLS
- **added** — Add hlsCDNSecret option to serve HLS streams behind a CDN in a simplified way
- **changed** — Add public attribute to cache-control header in HLS
- **changed** — Allow caching non-low-latency HLS playlists
- **security** — Prevent open redirect attacks in WebRTC
- **fixed** — Merge request controls instead of overwriting in RPI Camera to support libcamera 0.7.0

##### Fixes and improvements

General

* prevent code injection in case of MTX_QUERY in hooks (https://github.com/bluenviron/mediamtx/issues/5707) When MTX_QUERY is used explicitly in hooks, for instance "curl http://something/?$MTX_QUERY", it can be used to inject arbitrary commands. MTX_QUERY is now url-encoded to prevent any abuse regardless of the configuration.
* use temporary redirects instead of permanent redirects (https://github.com/bluenviron/mediamtx/issues/5710) this prevents unwanted caching.

HLS

* prevent open redirect attacks (https://github.com/bluenviron/mediamtx/issues/5708)
* support reading and writing KLV (https://github.com/bluenviron/mediamtx/issues/5604)
* add hlsCDNSecret (https://github.com/bluenviron/mediamtx/issues/5716) this allows to serve HLS streams behind a CDN in a simplified way, compatible with the new HLS session system.
* add public attribute to cache-control header (https://github.com/bluenviron/gohlslib/issues/349)
* allow caching non-low-latency playlists (https://github.com/bluenviron/gohlslib/issues/350)

WebRTC

* prevent open redirect attacks (https://github.com/bluenviron/mediamtx/issues/5708)

RPI Camera

* Merge request->controls instead of overwriting (https://github.com/bluenviron/mediamtx-rpicamera/issues/97) libcamera 0.7.0 is more strict about changing controls; assignment is no longer allowed since https://github.com/raspberrypi/libcamera/commit/310cd8bc0756717cde97fe5b083926f6d6931f58 Instead, we use the merge call with overwrite.

##### Security

Binaries are compiled from source code by the [Release workflow](https://github.com/bluenviron/mediamtx/actions/workflows/release.yml), which is a fully-visible process that prevents any change or external interference in produced artifacts.

Checksums of binaries are also published in a public blockchain by using [GitHub Attestations](https://docs.github.com/en/actions/concepts/security/artifact-attestations), and they can be verified by running:

```
ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx
```

You can verify checksums of binaries by downloading `checksums.sha256` and running:

```
cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check
```