This is an older version. The current version is 0.25.0. NSClient++ 0.25.0 · Released:
Installer files 0.16.4
| Architecture | Type | Scope | File size | Download | SHA256 |
|---|---|---|---|---|---|
| 64-bit | MSI · en-US | All users | — | github.com | VirusTotal |
| 32-bit | MSI · en-US | All users | — | github.com | VirusTotal |
Link and SHA256 come from the Windows Package Manager community manifest. Compare the hash of the downloaded file before running it.
Release notes
# Security release：request-smuggling fixes in the bundled web server
This release upgrades the Cesanta Mongoose web server bundled in the Windows builds to 7.23, closing two critical HTTP request-smuggling vulnerabilities in its HTTP parser. If NSClient++'s web server is reachable through a reverse proxy or WAF, upgrade promptly.
## Highlights
• **Bundled Mongoose upgraded from 7.20 to 7.23.** Fixes two critical (CVSS 9.1) HTTP request-smuggling vulnerabilities, [CVE-2026-73256](https://nvd.nist.gov/vuln/detail/CVE-2026-73256) and [CVE-2026-73257](https://nvd.nist.gov/vuln/detail/CVE-2026-73257), fixed upstream in Mongoose 7.22.
• **Windows builds only.** The Windows `WEBServer` module (REST API and web UI) uses the Mongoose backend; the Linux DEB/RPM packages build on Boost.Beast and never contained the vulnerable code.
• **Exploitable behind an intermediary.** Both flaws let an unauthenticated attacker smuggle requests past a reverse proxy, WAF or load balancer in front of NSClient++ — bypassing proxy-level ACLs or injecting into other clients' reused connections. Direct client → NSClient++ deployments have no front end to desynchronize, and NSClient++'s own authentication is still enforced per request either way.
## Detailed changes
### WEBServer — bundled Mongoose upgraded to 7.23 (security)
Mongoose versions before 7.22 mis-parse HTTP message framing in two ways:
| CVE | Flaw |
|---|---|
| [CVE-2026-73256](https://nvd.nist.gov/vuln/detail/CVE-2026-73256) | Broken HTTP/1.0 detection in `http_cb()` — a request combining `Transfer-Encoding：chunked` with conflicting HTTP/1.0 framing is parsed with different message boundaries than an HTTP/1.0 reverse proxy sees. |
| [CVE-2026-73257](https://nvd.nist.gov/vuln/detail/CVE-2026-73257) | Requests carrying **both** `Content-Length` and `Transfer-Encoding：chunked` are accepted instead of rejected, enabling CL.TE desynchronization against a Content-Length-preferring front end. |
All build pipelines now pin Mongoose 7.23 (the latest release, which also carries further upstream TLS and TCP/IP hardening)：the Windows CI workflows, the Linux docker scenario images that fall back to the Mongoose backend (`minimal`, `no-openssl`), and the developer build instructions. The full advisory record is on the [security notices](https://docs.nsclient.org/security/notices/) page.
## Upgrade notes
• **Upgrade Windows installs, promptly if behind a reverse proxy/WAF:** the request-smuggling CVEs only matter when an intermediary in front of NSClient++ frames the HTTP stream differently than the built-in web server. No configuration change is needed — this is a drop-in upgrade.
• **Linux packages are unaffected** (Boost.Beast web backend, no Mongoose), as are installs with the `WEBServer` module disabled.
**Full Changelog**：https://github.com/mickem/nscp/compare/0.16.3...0.16.4
