Important
This release fixes multiple critical CVEs in dependencies that Coolify uses. Update immediately.
Tip
Every v4 line has a security fix release. On v4.4, update from the dashboard: Settings → Update → Check now → Update. We recommend that everyone moves to v4.4.7, because the v4.1, v4.2, v4.3, v4.4 minior releases also include other security fixes that are not backported.
To update to a patched version of v4.0 to v4.3, run this on your server to update to the security fix release of your line:
curl -fsSL https://cdn.coollabs.io/coolify/patch.sh | sudo bash| Running | Security fix release |
|---|---|
| v4.0.x | v4.0.1 |
| v4.1.x | v4.1.3 |
| v4.2.x | v4.2.1 |
| v4.3.x | v4.3.24 |
| v4.4.x | v4.4.7 |
The script requires a stable release (not a beta, RC, or nightly).
On a v4 beta or older release? First install the v4.0.1 security fix release manually by running the command below, then update to v4.4.7 right away from the dashboard (Settings → Update → Check > now → Update):
curl -fsSL https://cdn.coollabs.io/coolify/install.sh | sudo bash -s 4.0.1Security
- Updated PHP to 8.4.27 to fix PHP2Shell (CVE-2026-109618, CVE-2026-109619).
- Updated Node.js to 24.22.1 for the terminal server and the asset build.
- Updated cloudflared to 2026.10.3 for the eMudhra certificate compromise.
- Updated Sentinel to 1.1.2 to fix CVE-2026-111943.
Issues
- fixes #12266