# thingsboard v4.2.2.2 — ThingsBoard 4.2.2.2 Release - Product: thingsboard (https://whatsnew.fyi/product/thingsboard) - Vendor: thingsboard - Date: 2026-05-28 - Version: v4.2.2.2 - Original notes: https://github.com/thingsboard/thingsboard/releases/tag/v4.2.2.2 - Permalink: https://whatsnew.fyi/product/thingsboard/releases/v4.2.2.2 What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog. Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'. --- - **security** — Fixed CWE-770 in Jackson Core - **security** — Fixed CVE-2026-34487, CVE-2026-34486, CVE-2026-34483 - **security** — Fixed CVE-2025-70340: system alarm comments access control - **security** — Fixed multiple CVEs: 2026-39364, 2026-39363, 2026-4800 - **security** — Fixed CVE-2026-40895 - **security** — Fixed CVE-2026-5588, CVE-2026-5598, CVE-2025-14813, CVE-2026-35554, CVE-2026-27314 - **security** — Fixed CVE-2026-40975, CVE-2026-40973, CVE-2026-22740, CVE-2026-42198 - **security** — Fixed SSRF vulnerability in AI model provider URLs - **security** — Fixed SSRF and file access vulnerabilities in TBEL script sandbox - **security** — Fixed CVE-2026-40682, CVE-2026-42027 - **security** — Fixed CVE-2026-42579, CVE-2026-42583, CVE-2026-42584, CVE-2026-42587 - **security** — Hardened remote JS executor script invocation - **security** — Fixed CVE-2026-41284, CVE-2026-43512 - **changed** — Performance and reliability improvements for Efento message processing - **added** — Expose HTTP response compression configuration parameters - **added** — LZ4 compression support for Kafka - **fixed** — Fixed WS sessions limit handling for public users - **fixed** — Fixed REST API Call node blocking actor thread and semaphore permit leak - **fixed** — Fixed entity filtering by boolean data key for EDQS - **fixed** — Fixed MAX aggregation for mixed double and long telemetry values ##### What's Changed ###### Security * Fixed CWE-770 in Jackson Core by @zzzeebra in https://github.com/thingsboard/thingsboard/pull/15368 * Fixed CVE-2026-34487, CVE-2026-34486, CVE-2026-34483 by @zzzeebra in https://github.com/thingsboard/thingsboard/pull/15417 * Fixed CVE-2025-70340: system alarm comments access control by @dashevchenko in https://github.com/thingsboard/thingsboard/pull/15377 * Fixed multiple CVEs: 2026-39364, 2026-39363, 2026-4800 by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15466 * Fixed CVE-2026-40895 by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15538 * Fixed CVE-2026-5588, CVE-2026-5598, CVE-2025-14813, CVE-2026-35554, CVE-2026-27314 by @zzzeebra in https://github.com/thingsboard/thingsboard/pull/15458 * Fixed CVE-2026-40975, CVE-2026-40973, CVE-2026-22740, CVE-2026-42198 by @zzzeebra in https://github.com/thingsboard/thingsboard/pull/15557 * Fixed SSRF vulnerability in AI model provider URLs by @zzzeebra in https://github.com/thingsboard/thingsboard/pull/15412 * Fixed SSRF and file access vulnerabilities in TBEL script sandbox by @zzzeebra in https://github.com/thingsboard/thingsboard/pull/15585 * Fixed CVE-2026-40682, CVE-2026-42027 by @zzzeebra in https://github.com/thingsboard/thingsboard/pull/15588 * Fixed CVE-2026-42579, CVE-2026-42583, CVE-2026-42584, CVE-2026-42587 by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15598 * Hardened remote JS executor script invocation by @smatvienko-tb in https://github.com/thingsboard/thingsboard/pull/15600 * Fixed CVE-2026-41284, CVE-2026-43512 by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15649 ###### Core & Rule Engine * Performance and reliability improvements for Efento message processing by @dashevchenko in https://github.com/thingsboard/thingsboard/pull/15333 * Exposed HTTP response compression configuration params by @dashevchenko in https://github.com/thingsboard/thingsboard/pull/15520 * LZ4 compression support for Kafka by @volodymyr-babak in https://github.com/thingsboard/thingsboard/pull/15565 * Fixed WS sessions limit handling for public users by @dashevchenko in https://github.com/thingsboard/thingsboard/pull/15313 * Fixed REST API Call node blocking actor thread and semaphore permit leak by @smatvienko-tb in https://github.com/thingsboard/thingsboard/pull/15334 * Fixed entity filtering by boolean data key for EDQS by @dashevchenko in https://github.com/thingsboard/thingsboard/pull/15457 * Fixed MAX aggregation for mixed double and long telemetry values by @dashevchenko in https://github.com/thingsboard/thingsboard/pull/15560 * Added config property to control null ordering in dashboards by @dashevchenko in https://github.com/thingsboard/thingsboard/pull/15425 ###### UI * Bumped Node.js version from 22.18.0 to 22.22.2 by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15330 * HTML container widget by @ikulikov in https://github.com/thingsboard/thingsboard/pull/15556 * Hidden "Add Telemetry" button for Entity view by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15362 * Added '@angular/core/rxjs-interop' to modules map by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15373 * Fixed select options being clipped in widget settings form by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15399 * Fixed display long texts in Alarm asignee panel by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15408 * Fixed Alarm Assignee icon placement by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15423 * Adjusted size of entity type select to fit error message by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15427 * Fixed show/hide of custom header actions when using function to control visibility by @mtsymbarov-del in h _[Truncated at 4000 characters — full notes: https://github.com/thingsboard/thingsboard/releases/tag/v4.2.2.2]_