# mediamtx v1.19.3

- Product: mediamtx (https://whatsnew.fyi/product/mediamtx)
- Vendor: bluenviron
- Date: 2026-07-23
- Version: v1.19.3
- Original notes: https://github.com/bluenviron/mediamtx/releases/tag/v1.19.3
- Permalink: https://whatsnew.fyi/product/mediamtx/releases/v1.19.3

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **fixed** — Fix error message where 'all' is a synonym for 'all_others'
- **fixed** — Fix clearing lists with environment variables MTX_AUTHINTERNALUSERS_0_IPS, MTX_LOGDESTINATIONS and MTX_RTSPTRANSPORTS by setting them to an empty value
- **added** — Add runOnOnline and runOnOffline hooks triggered when a stream is online
- **changed** — Rename runOnReady into runOnAvailable and runOnNotReady into runOnUnavailable
- **fixed** — Fix wrong PTS and wrong playback of alwaysAvailableFile by properly considering PTS offset of samples and using DTS-based sleep between samples
- **security** — Avoid potential timing attack when validating SHA256 credentials by using ConstantTimeCompare instead of == operator
- **changed** — Normalize authentication error messages to log as soon as possible at warn level with consistent message regardless of author or protocol
- **fixed** — Ask for credentials only in case of protocols that support it to avoid unnecessary waiting and improve anti-brute force algorithm application
- **fixed** — Fix support for ctts version 0 in pmp4
- **changed** — Generate most of OpenAPI automatically including enums and structs
- **fixed** — Fix race condition during Media-Over-QUIC startup by allocating HTTP server only after MoQ server initialization
- **fixed** — Fix several panics and OOM errors in Media-Over-QUIC by checking limits before allocating memory
- **added** — Support draft-19 of Media-Over-QUIC specification
- **added** — Support subscribing the same Media-Over-QUIC track multiple times
- **fixed** — Prevent excessive CPU consumption in Media-Over-QUIC reorderer by iterating over internal pending packets instead of maxGroupID
- **security** — Prevent cross-origin unauthorized access in WebRTC and HLS by returning '*' in Access-Control-Allow-Origins when AllowOrigins is a wildcard
- **changed** — Restrict UDP port range to 32768-60999 for RTSP which is the default Linux ephemeral port range
- **changed** — Use session ID in RTSP requests to the external authentication server
- **fixed** — Fix parsing RTCP of some Hanwha cameras
- **fixed** — Fix RTSP client UDP ports not being released after close
- **fixed** — Fix SRT compatibility with StreamToStudio app

##### Fixes and improvements

General

* fix error message (https://github.com/bluenviron/mediamtx/issues/5922) 'all' is a synonym for 'all_others'
* fix clearing lists with environment variables (https://github.com/bluenviron/mediamtx/issues/5410) (https://github.com/bluenviron/mediamtx/issues/5924) MTX_AUTHINTERNALUSERS_0_IPS, MTX_LOGDESTINATIONS and MTX_RTSPTRANSPORTS can now be used to clear their corresponding list by setting them to an empty value.
* add runOnOnline / runOnOffline hooks (https://github.com/bluenviron/mediamtx/issues/5399) (https://github.com/bluenviron/mediamtx/issues/5956) These are triggered and a stream is online (i.e. not just provided by an offline segment).
* rename runOnReady into runOnAvailable, runOnNotReady into runOnUnavailable (https://github.com/bluenviron/mediamtx/issues/5957)
* fix wrong PTS and wrong playback of alwaysAvailableFile (https://github.com/bluenviron/mediamtx/issues/5436) (https://github.com/bluenviron/mediamtx/issues/5960) PTS offset of samples was not properly considered, and sleep between samples was PTS-based instead of being DTS-based.
* avoid potential timing attack when validating SHA256 credentials (https://github.com/bluenviron/mediamtx/issues/5961) The == operator is vulnerable to timing attacks as it short-circuits on a mismatch. Use ConstantTimeCompare to avoid this vector. Co-authored-by: Tristan Matthews <tmatth@videolan.org>
* normalize authentication error messages (https://github.com/bluenviron/mediamtx/issues/5421) (https://github.com/bluenviron/mediamtx/issues/5959) Log authentication errors as soon as possible, use the "warn" level, use the same message whatever the author or protocol.
* adjust code to prevent security scan false positives (https://github.com/bluenviron/mediamtx/issues/5963) about string escaping.
* ask for credentials only in case of protocols that support it (https://github.com/bluenviron/mediamtx/issues/5966) When clients connect with some protocols (SRT, RTMP), they are unable to provide credentials even if they are asked to. In this case, it's useless to wait for credentials, and it's better to immediately log authentication errors and apply the anti-brute force algorithm.
* docs: add fail2ban integration (https://github.com/bluenviron/mediamtx/issues/5016) (https://github.com/bluenviron/mediamtx/issues/5967)
* add comment to prevent security scan false positives (https://github.com/bluenviron/mediamtx/issues/5973)
* pmp4: fix support for ctts version 0 (https://github.com/bluenviron/mediamtx/issues/5436) (https://github.com/bluenviron/mediacommon/issues/343)

API

* generate most of OpenAPI automatically (https://github.com/bluenviron/mediamtx/issues/5918) enums and structs are now generated automatically. This eliminates some inconsistencies and makes development easier.

Media-Over-QUIC

* fix race condition during startup (https://github.com/bluenviron/mediamtx/issues/5965) allocate the HTTP server only after the MoQ server has been initialized.
* fix several panics and OOM errors (https://github.com/bluenviron/mediamtx/issues/5964) Check for limits before allocating memory by using sizes passed from the remote peer. Also add fuzzing to all MoQ primitives.
* support draft-19 of the specification (https://github.com/bluenviron/mediamtx/issues/5968) * support draft-19 of the specification * support subscribing the same track multiple times.
* prevent excessive CPU consumption in reorderer (https://github.com/bluenviron/mediamtx/issues/5976) do not iterate by maxGroupID (passed by user) but iterate by internal pending packets (uncontrolled by user).

WebRTC

* prevent cross-origin unauthorized access (https://github.com/bluenviron/mediamtx/issues/5975) when a user had previously inserted credentials into a MediaMTX instance through a browser, and AllowOrigins was set to a wildcard, third-party websites visited by the user were allowed to read streams without restrictions. This is now prevented by returnin

_[Truncated at 4000 characters — full notes: https://github.com/bluenviron/mediamtx/releases/tag/v1.19.3]_