# thingsboard v4.3.1.2 — ThingsBoard 4.3.1.2 Release - Product: thingsboard (https://whatsnew.fyi/product/thingsboard) - Vendor: thingsboard - Date: 2026-05-28 - Version: v4.3.1.2 - Original notes: https://github.com/thingsboard/thingsboard/releases/tag/v4.3.1.2 - Permalink: https://whatsnew.fyi/product/thingsboard/releases/v4.3.1.2 What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog. Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'. --- - **security** — Fixed CWE-770 in Jackson Core - **security** — Fixed CVE-2026-34487, CVE-2026-34486, CVE-2026-34483 - **security** — Fixed CVE-2025-70340: system alarm comments access control - **security** — Fixed CVE-2026-39364, CVE-2026-39363, CVE-2026-4800 - **security** — Fixed CVE-2026-40895 - **security** — Fixed CVE-2026-5588, CVE-2026-5598, CVE-2025-14813, CVE-2026-35554, CVE-2026-27314 - **security** — Fixed CVE-2026-40975, CVE-2026-40973, CVE-2026-22740, CVE-2026-42198 - **security** — Fixed SSRF vulnerability in AI model provider URLs - **security** — Fixed SSRF and file access vulnerabilities in TBEL script sandbox - **security** — Fixed CVE-2026-40682, CVE-2026-42027 - **security** — Fixed CVE-2026-42579, CVE-2026-42583, CVE-2026-42584, CVE-2026-42587 - **security** — Hardened remote JS executor script invocation - **security** — Fixed CVE-2026-41284, CVE-2026-43512 - **added** — Audit logging for tenant profile operations - **added** — Added entity keys V2 endpoint with sample values - **changed** — Performance and reliability improvements for Efento message processing - **changed** — Refactored APIs to meet OpenAPI standard - **added** — Exposed HTTP response compression configuration params - **added** — LZ4 compression support for Kafka - **fixed** — Fixed WS sessions limit handling for public users ##### What's Changed ###### Security * Fixed CWE-770 in Jackson Core by @zzzeebra in https://github.com/thingsboard/thingsboard/pull/15368 * Fixed CVE-2026-34487, CVE-2026-34486, CVE-2026-34483 by @zzzeebra in https://github.com/thingsboard/thingsboard/pull/15417 * Fixed CVE-2025-70340: system alarm comments access control by @dashevchenko in https://github.com/thingsboard/thingsboard/pull/15377 * Fixed multiple CVEs: 2026-39364, 2026-39363, 2026-4800 by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15466 * Fixed CVE-2026-40895 by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15538 * Fixed CVE-2026-5588, CVE-2026-5598, CVE-2025-14813, CVE-2026-35554, CVE-2026-27314 by @zzzeebra in https://github.com/thingsboard/thingsboard/pull/15458 * Fixed CVE-2026-40975, CVE-2026-40973, CVE-2026-22740, CVE-2026-42198 by @zzzeebra in https://github.com/thingsboard/thingsboard/pull/15557 * Fixed SSRF vulnerability in AI model provider URLs by @zzzeebra in https://github.com/thingsboard/thingsboard/pull/15412 * Fixed SSRF and file access vulnerabilities in TBEL script sandbox by @zzzeebra in https://github.com/thingsboard/thingsboard/pull/15585 * Fixed CVE-2026-40682, CVE-2026-42027 by @zzzeebra in https://github.com/thingsboard/thingsboard/pull/15588 * Fixed CVE-2026-42579, CVE-2026-42583, CVE-2026-42584, CVE-2026-42587 by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15598 * Hardened remote JS executor script invocation by @smatvienko-tb in https://github.com/thingsboard/thingsboard/pull/15600 * Fixed CVE-2026-41284, CVE-2026-43512 by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15649 ###### Core & Rule Engine * Audit logging for tenant profile operations by @zzzeebra in https://github.com/thingsboard/thingsboard/pull/13076 * Added entity keys V2 endpoint with sample values by @dskarzh in https://github.com/thingsboard/thingsboard/pull/15044 * Performance and reliability improvements for Efento message processing by @dashevchenko in https://github.com/thingsboard/thingsboard/pull/15333 * Refactored APIs to meet OpenAPI standard by @dashevchenko and @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15443 * Exposed HTTP response compression configuration params by @dashevchenko in https://github.com/thingsboard/thingsboard/pull/15520 * LZ4 compression support for Kafka by @volodymyr-babak in https://github.com/thingsboard/thingsboard/pull/15565 * Fixed WS sessions limit handling for public users by @dashevchenko in https://github.com/thingsboard/thingsboard/pull/15313 * Fixed REST API Call node blocking actor thread and semaphore permit leak by @smatvienko-tb in https://github.com/thingsboard/thingsboard/pull/15334 * Fixed entity filtering by boolean data key for EDQS by @dashevchenko in https://github.com/thingsboard/thingsboard/pull/15457 * Fixed alarm rule crash on duration source change by @zzzeebra in https://github.com/thingsboard/thingsboard/pull/15439 * Fixed MAX aggregation for mixed double and long telemetry values by @dashevchenko in https://github.com/thingsboard/thingsboard/pull/15560 * Added config property to control null ordering in dashboards by @dashevchenko in https://github.com/thingsboard/thingsboard/pull/15425 ###### UI * Improved default tenant home dashboard by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15000 * Changed default "Add" button style in entity tables by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/14984 * Bumped Node.js version from 22.18.0 to 22.22.2 by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15330 * Enhanced localization: "save-to-gallery" translations by @deaflynx in https://github.com/thingsboard/thingsboard/pull/15339 * Exposed http-utils functions via WidgetContext.httpUtils by @vvlladd28 in https://github.com/th _[Truncated at 4000 characters — full notes: https://github.com/thingsboard/thingsboard/releases/tag/v4.3.1.2]_