MoaV v2.3.1

Security-focused patch release on top of 2.3.0. Update is recommended for everyone.

Upgrade note (XDNS operators): Xray v26.9.30+ changed the XDNS finalmask schema. After moav update, run moav bootstrap (idempotent, keeps your keys and user UUIDs) to re-render the server inbound, then moav regenerate-users. XDNS clients must run a core at or above v26.9.30 and re-download their bundle.

Why update now (security)

• Xray-core v26.10.21 and Prometheus 3.15.1 are rebuilt on Go 1.27.3, which distrusts the compromised eMudhra / emSign intermediate CA roots (the October 2026 cACompromise; Go block CVE-2026-111943). Also brings Go fixes in net/http, crypto/tls, and x/net HTTP/2.
• Grafana 13.2.4 ships ten CVE fixes (CVE-2026-15815, -76154, -79656, -13719, -13720, -81841, -15577, -33374, -93294, -95502).

Blog post: MoaV 2.3.1: update now

Component bumps

• sing-box 1.14.3
• wstunnel 11.1.0
• Psiphon Conduit 2.1.0
• Snowflake 2.15.2
• telemt 3.5.14
• cAdvisor 0.60.6
• docker-socket-proxy 0.5.0
• XDNS finalmask migrated to the Xray v26.9.30+ object schema, plus a server-side mKCP MTU fix (see the upgrade note).
• Held: TrustTunnelClient at 1.0.49, pending a live quiche to ngtcp2 compatibility test.

Community

• Conduit monitoring: an expanded Grafana dashboard plus two opt-in contrib/ ops scripts (conduit-monitor, rotate-log), contributed by @jSFBay (#317).

No breaking config changes; keys, users, and certificates are untouched. Full per-component detail and validation notes in the CHANGELOG under [2.3.1].

What's Changed

• monitoring: Conduit ops scripts + dashboard panels by @ibeezhan in #317
• fix(dashboard): title the Conduit 'Limits' stat tile by @ibeezhan in #343
• chore: bump bundled components to latest (2026-10 audit) by @ibeezhan in #342
• release: v2.3.1 by @ibeezhan in #344

Full Changelog: v2.3.0...v2.3.1

Quick Install

curl -fsSL https://moav.sh/install.sh | bash

This will install MoaV to /opt/moav and guide you through setup.

Documentation

moav.sh/docs — full documentation

Get started

• Quick Start — install to first user in ~10 minutes
• Client Setup — connect from phones and desktops
• DNS Configuration — records, delegations, freeing port 53

Reference

• CLI Reference — every command and flag
• Setup Guide — every option, in depth
• Monitoring — Grafana dashboards and metrics
• Troubleshooting — symptom-first fixes

Understand it

• Supported Protocols — per-protocol ports, ciphers, stealth
• Architecture — container topology and bundle flow
• Threat Model — what is and is not protected
• OPSEC Guide — operator-side hardening

Help out

• Support MoaV — run a server, contribute, translate, donate
• Translating the Docs — one page is a complete contribution

Running it with an AI agent? llms.txt is a compact orientation for coding agents; llms-full.txt is the whole corpus. Both ship as release assets.

Community

Telegram · X · Issues · moav.sh