The Stable channel has been updated to 150.0.7871.186/.187 for Windows and Mac and 150.0.7871.186 for Linux, which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log

Interested in switching release channels? Find out how here. If you find a new issue, please let us know by filing a bug. The community help forum is also a great place to reach out for help or learn about common issues.

Daniel Yip

Google Chrome

Fixes and improvements

General

• fix error message (#5922) 'all' is a synonym for 'all_others'
• fix clearing lists with environment variables (#5410) (#5924) MTX_AUTHINTERNALUSERS_0_IPS, MTX_LOGDESTINATIONS and MTX_RTSPTRANSPORTS can now be used to clear their corresponding list by setting them to an empty value.
• add runOnOnline / runOnOffline hooks (#5399) (#5956) These are triggered and a stream is online (i.e. not just provided by an offline segment).
• rename runOnReady into runOnAvailable, runOnNotReady into runOnUnavailable (#5957)
• fix wrong PTS and wrong playback of alwaysAvailableFile (#5436) (#5960) PTS offset of samples was not properly considered, and sleep between samples was PTS-based instead of being DTS-based.
• avoid potential timing attack when validating SHA256 credentials (#5961) The == operator is vulnerable to timing attacks as it short-circuits on a mismatch. Use ConstantTimeCompare to avoid this vector. Co-authored-by: Tristan Matthews tmatth@videolan.org
• normalize authentication error messages (#5421) (#5959) Log authentication errors as soon as possible, use the "warn" level, use the same message whatever the author or protocol.
• adjust code to prevent security scan false positives (#5963) about string escaping.
• ask for credentials only in case of protocols that support it (#5966) When clients connect with some protocols (SRT, RTMP), they are unable to provide credentials even if they are asked to. In this case, it's useless to wait for credentials, and it's better to immediately log authentication errors and apply the anti-brute force algorithm.
• docs: add fail2ban integration (#5016) (#5967)
• add comment to prevent security scan false positives (#5973)
• pmp4: fix support for ctts version 0 (#5436) (bluenviron/mediacommon#343)

API

• generate most of OpenAPI automatically (#5918) enums and structs are now generated automatically. This eliminates some inconsistencies and makes development easier.

Media-Over-QUIC

• fix race condition during startup (#5965) allocate the HTTP server only after the MoQ server has been initialized.
• fix several panics and OOM errors (#5964) Check for limits before allocating memory by using sizes passed from the remote peer. Also add fuzzing to all MoQ primitives.
• support draft-19 of the specification (#5968) * support draft-19 of the specification * support subscribing the same track multiple times.
• prevent excessive CPU consumption in reorderer (#5976) do not iterate by maxGroupID (passed by user) but iterate by internal pending packets (uncontrolled by user).

WebRTC

• prevent cross-origin unauthorized access (#5975) when a user had previously inserted credentials into a MediaMTX instance through a browser, and AllowOrigins was set to a wildcard, third-party websites visited by the user were allowed to read streams without restrictions. This is now prevented by returning "*" in Access-Control-Allow-Origins when AllowOrigins is a wildcard, a behavior that prevents browsers from sharing credentials with third-party websites.

RTSP

• restrict UDP port range to 32768-60999 (#5398) (#5958) this is the default Linux ephemeral port range.
• use session ID in requests to the external authentication server (#5977) Co-authored-by: Cycle1337 Cycle1337@outlook.com
• prevent truncation of 64-bit values on 32-bit platforms (bluenviron/gortsplib#1094)
• fix parsing RTCP of some Hanwha cameras (#5355) (bluenviron/gortsplib#1099)
• use original pion/sdp.SessionDescription instead of a custom one; move unmarshaler in sdpunmarshaler (bluenviron/gortsplib#1100)
• client: fix UDP ports not being released after close (bluenviron/gortsplib#1105)
• client: return an error when UDP port range is exhausted (bluenviron/gortsplib#1104)

HLS

• prevent cross-origin unauthorized access (#5975) when a user had previously inserted credentials into a MediaMTX instance through a browser, and AllowOrigins was set to a wildcard, third-party websites visited by the user were allowed to read streams without restrictions. This is now prevented by returning "*" in Access-Control-Allow-Origins when AllowOrigins is a wildcard, a behavior that prevents browsers from sharing credentials with third-party websites.

SRT

• fix compatibility with StreamToStudio app (#5414) (#5928)

Dependencies

• code.cloudfoundry.org/bytefmt updated from v0.78.0 to v0.82.0
• github.com/alecthomas/kong updated from v1.15.0 to v1.16.0
• github.com/bluenviron/gohlslib/v2 updated from v2.4.0 to v2.4.1
• github.com/bluenviron/gortmplib updated from v0.4.0 to v0.4.1
• github.com/bluenviron/gortsplib/v5 updated from v5.6.1 to v5.6.2
• github.com/bluenviron/mediacommon/v2 updated from v2.9.1 to v2.9.2
• github.com/matthewhartstonge/argon2 updated from v1.5.5 to v1.5.6
• github.com/pion/ice/v4 updated from v4.2.8-0.20260604162030-72f5001c4596 to v4.3.0
• github.com/pion/interceptor updated from v0.1.45 to v0.1.46
• github.com/pion/rtcp updated from v1.2.16 to v1.2.17
• github.com/pion/rtp updated from v1.10.2 to v1.10.5
• github.com/pion/webrtc/v4 updated from v4.2.15 to v4.2.17
• github.com/pires/go-proxyproto updated from v0.12.0 to v0.15.0
• github.com/quic-go/webtransport-go updated from v0.11.0 to v0.11.1
• golang.org/x/crypto updated from v0.53.0 to v0.54.0
• golang.org/x/net updated from v0.56.0 to v0.57.0
• golang.org/x/sync updated from v0.21.0 to v0.22.0
• golang.org/x/sys updated from v0.46.0 to v0.47.0
• golang.org/x/term updated from v0.44.0 to v0.45.0
• github.com/pion/datachannel updated from v1.6.0 to v1.6.2
• github.com/pion/dtls/v3 updated from v3.1.4 to v3.1.5
• github.com/pion/sctp updated from v1.10.0 to v1.11.0
• github.com/pion/stun/v3 updated from v3.1.5 to v3.1.6
• github.com/pion/turn/v5 updated from v5.0.9 to v5.0.12
• golang.org/x/text updated from v0.38.0 to v0.40.0

Security

Binaries are compiled from source code by the Release workflow, which is a fully-visible process that prevents any change or external interference in produced artifacts.

Checksums of binaries are also published in a public blockchain by using GitHub Attestations, and they can be verified by running:

ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx

You can verify checksums of binaries by downloading checksums.sha256 and running:

cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check