v1.0.41 — Security hardening

v1.0.41 is a security release for the admin API and admin UI. It has no new features, database migrations, or Compose changes.

What changed

Dependency updates

A dependency audit found known vulnerabilities in the admin API and UI dependencies. They are all fixed:

Admin UI: axios 1.7.2 → 1.20.0, and React Router 6.24 → 7.18.5 (react-router). This fixes an open redirect (CVE-2026-53669) and XSS (CVE-2026-22029) advisories in the router, and several axios advisories including HTTP response splitting, SSRF and prototype pollution.
Admin API: FastAPI 0.111 → 0.162 (Starlette 0.37 → 1.10), cryptography 42 → 50, aiosmtplib 3 → 5.1.3, and a current certifi CA bundle. The Starlette update fixes SSRF, HTTP request smuggling and resource-exhaustion advisories.

JWT library replaced

The admin API used python-jose, which has an unpatched critical signature-verification flaw (CVE-2026-85394) and depends on ecdsa, which has an unfixed timing attack (CVE-2024-23342). Admin session tokens and per-site JWT authentication now use PyJWT. python-jose, ecdsa, rsa and pyasn1 are no longer installed.

Existing admin sessions stay valid across the upgrade.

Exclusion regex denial-of-service fixed

Rule exclusions can be limited by a path regex or a regex target (ARGS:/…/). The admin API re-checks those regexes against logged request paths and argument names for previews, learning suggestions, readiness and log details. That check used Python's backtracking regex engine, so a badly written pattern combined with a crafted request could stall the admin API, including the endpoint Caddy calls for per-site JWT authentication. Exclusion regexes are now matched with RE2, the same linear-time engine Coraza uses.

A request parameter whose name looks like a regex (for example /.*/) is now treated as a literal name when building learning suggestions and exclusion drafts. Previously that name was reused as the exclusion's regex, which could make a suggested exclusion much broader than intended.

Behaviour changes

Per-site JWT audience is enforced. When a site has a JWT audience configured, tokens without an aud claim are now rejected. They were previously accepted. If your identity provider omits aud, either have it include aud or clear the site's audience setting.
Exclusion regexes must be valid RE2. Path and target regexes are validated as RE2 when saved, which is what Coraza requires. Python-only syntax such as possessive quantifiers (a++) or atomic groups ((?>…)) is rejected. An existing exclusion with such a pattern never matches in previews or readiness. Coraza cannot load it either, so it was not working before this release.
Short SECRET_KEY warning. The admin API logs a warning if SECRET_KEY is shorter than 32 bytes. The documented secrets.token_hex(32) value is 64 characters.

Images and upgrade

Production images target linux/amd64:

ghcr.io/socfortress/waf-caddy:1.0.41
ghcr.io/socfortress/waf-admin-api:1.0.41
ghcr.io/socfortress/waf-admin-ui:1.0.41

Back up the database, configuration, certificate storage, and deployment settings. Preserve local Compose overrides. Upgrading from v1.0.39 or older? Also follow the v1.0.40 notes, including its certificate persistence migration, plus the v1.0.39 and v1.0.37 notes.

Update deployment files with git pull --ff-only, preserving customizations, and set both values in .env:

WAF_IMAGE_TAG=1.0.41
CRS_CADDY_DIGEST=sha256:20d75683fd4a7d9870561557404a3c1bff244ec829567f8f0f88f1039145b089

The digest takes precedence over the tag. Production Caddy and the CRS validator must use the same release digest. Verify docker compose config, stop configuration edits, and upgrade the services together:

docker compose pull
docker compose stop admin-ui admin-api caddy-waf waf-sandbox
docker compose up -d --wait postgres redis http-echo caddy-waf waf-sandbox
docker compose up -d --wait admin-api admin-ui
docker compose ps

After upgrading:

Sign in to the admin UI, with TOTP if enabled.
If you use per-site JWT authentication, send one real token from your identity provider through a protected site.
Send one test alert email.

Validation

Backend suite: 672 passed, including 30 new JWT tests (session tokens; RS256/ES256/PS256 JWKS verification; issuer/audience; algorithm confusion; alg: none) and 23 new ReDoS regression tests.
Frontend suite: 121 passed, including 7 new routing tests, plus the production build.
Dependency scans of the admin API and UI report no known vulnerabilities.
The published waf-admin-api:1.0.41 image was checked: PyJWT 2.15.1 and google-re2 are present, and python-jose, ecdsa and pyasn1 are absent. A 100,000-character hostile path is matched by RE2 instantly.

Images are built from merged source e6cdf2b80cb8ab83f24a805dc1bbf34b54a4e195. See publication verification for digests, revisions, platforms, and anonymous pull checks.

Rollback

There are no schema changes, so rolling back to v1.0.40 only needs the v1.0.40 image tag and Caddy digest in .env, then the same upgrade sequence. Rolling back also brings back the vulnerabilities fixed here. Exclusions saved on v1.0.41 are valid RE2 and keep working on v1.0.40.

This release does not deploy changes to the lab or production servers.

socfortress/waf-platform-public v1.0.41 v1.0.41 — Security hardening on GitHub