app/v2.12.1

• Added Porkbun, Namecheap and Njalla as ACME DNS providers
• Fixed slow reconnection after the client has been idle or asleep, most noticeable on mobile devices. The server now sends QUIC stateless resets, so a client holding a stale connection reconnects immediately instead of waiting out its idle timeout
• Fixed mimic refusing to start when its optional kernel module is not loaded
• Various dependency updates

---

• 新增 Porkbun、Namecheap 与 Njalla ACME DNS 服务商支持
• 修复客户端空闲或休眠后重连缓慢的问题，在移动端上尤为明显。服务端现在会发送 QUIC 无状态重置（stateless reset），使持有失效连接的客户端能够立即重连，不再等待超时
• 修复未加载可选内核模块时 mimic 拒绝启动的问题
• 若干依赖更新

app/v2.12.0

• Added mimic integration, which disguises the connection as TCP for networks that restrict UDP (Linux only, requires mimic to be installed separately)
• Improved the accuracy of Chrome QUIC fingerprint parroting
• Fixed a BBR panic on paths with a small MTU, introduced in 2.11.0 by Chrome parroting
• Various dependency updates

---

• 新增 mimic 集成，可将连接伪装成 TCP，用于限制 UDP 的网络环境（仅限 Linux，需另行安装 mimic）
• 提升 Chrome QUIC 指纹模仿的准确度
• 修复了小 MTU 下一个 BBR panic 问题，由 2.11.0 的 Chrome 指纹模仿引入
• 若干依赖更新

app/v2.11.0

• Added Chrome QUIC fingerprint parroting: the client's QUIC handshake now looks like Google Chrome's. Enabled by default, but can be turned off with the quic.disableChromeParrot option
• Modernized the ACME stack (CertMagic, ACMEz and the libdns providers)
• Removed the namedotcom ACME DNS provider, as it has not been updated for the new libdns API
• Updated quic-go to v0.61.0

---

• 新增 Chrome QUIC 指纹模仿：将客户端 QUIC 握手调整至与 Google Chrome 一致。默认启用，可通过 quic.disableChromeParrot 选项关闭
• 更新 ACME 相关依赖（CertMagic, ACMEz, libdns 等）
• 移除了 namedotcom ACME DNS 服务商，由于其未针对新的 libdns API 进行更新
• quic-go 更新至 v0.61.0

app/v2.10.0

• Added Encrypted Client Hello support
• Added a bandwidth.disableLossCompensation option for disabling Brutal congestion control's loss compensation mechanism, which can improve stability in some cases
• Various dependency updates and minor bug fixes

---

• 新增 Encrypted Client Hello 支持
• 新增 bandwidth.disableLossCompensation 选项，用于关闭 Brutal 的速率补偿机制，可以在一些情况下提升稳定性
• 若干依赖更新与小修复

app/v2.9.3

• Added Hysteria Realms UPnP/NAT-PMP port mapping support for easier NAT traversal
• Added a Hysteria Realms ipMode option to restrict connections to IPv4 or IPv6 only
• Updated quic-go to v0.60.0
• Fixed + in the authentication credentials being corrupted to a space when parsing hysteria2:// sharing links
• Fixed the HTTP proxy rejecting valid Basic authentication credentials
• Fixed the HTTPS proxy outbound using host:port instead of the hostname as the TLS SNI
• Fixed a data race in the client's HTTP/SOCKS5 listener multiplexer
• Fixed nftables redirect failure when the server binds to a specific IPv6 address
• DNS resolver now limits CNAME chain length to prevent unbounded recursion

---

• 为 Hysteria Realms 新增 UPnP/NAT-PMP 支持以加强 NAT 穿透能力
• 为 Hysteria Realms 新增 ipMode 选项，可将连接限制为仅使用 IPv4 或 IPv6
• quic-go 更新至 v0.60.0
• 修复了解析 hysteria2:// 分享链接时密码中的 + 被错误转换为空格的问题
• 修复了 HTTP 代理拒绝有效 Basic 验证凭据的问题
• 修复了 HTTPS 代理出站将 host:port 而非主机名用作 TLS SNI 的问题
• 修复了客户端 HTTP/SOCKS5 监听多路复用器中的线程安全问题
• 修复了服务端绑定指定 IPv6 地址时 nftables 重定向失效的问题
• DNS 解析器增加 CNAME 链长度限制，防止无限递归

app/v2.9.2

This release contains important security fixes and we strongly encourage everyone to upgrade.

• Added Gecko obfuscation: a new experimental obfuscation layer that fragments QUIC handshake packets
• Fixed a security issue where UDP packets could bypass ACL
• Fixed a potential server OOM caused by incomplete or oversized HTTP requests during sniff
• Fixed an ACL bypass via trailing dots in domain names (e.g. example.com.)
• Fixed incorrect destination handling in the SOCKS5 UDP outbound
• Fixed https:// prefix detection in the DoH resolver
• Outbound rules now reject invalid port values
• Minor performance improvements

---

此版本包含重要安全修复，强烈建议更新

• 新增 Gecko：一种实验性的新混淆实现，会对 QUIC 握手包进行分片处理
• 修复了 UDP 包可绕过 ACL 的安全问题
• 修复了启用 sniff 时，不完整或超大 HTTP 请求可能导致服务端 OOM 的问题
• 修复了通过在域名末尾添加点（如 example.com.）绕过 ACL 的问题
• 修复了 SOCKS5 UDP 出站中目标地址处理错误的问题
• 修复了 DoH 解析器对 https:// 前缀的判断错误
• outbound 规则现在会拒绝无效端口号
• 小幅性能改进

app/v2.9.1

No public IP? No problem. Hysteria Realms punches through your NAT to let you host a Hysteria server from home, a cellular network, or even a coffee shop. Clients connect directly, peer-to-peer. No port forwarding, no relay.

• Fixed an issue where the client failed to connect to a server behind symmetric NAT, improving hole punching success rate
• The hysteria cert command now includes sniGuard: disable in its sample server config, so self-signed certs work with Realms out of the box

---

没有公网 IP 也没问题！Hysteria Realms 通过 NAT 打洞，让你从家宽、手机流量甚至咖啡店都能运行 Hysteria 服务端。与客户端 P2P 连接，无需配置端口转发或中转。

• 修复了一个导致服务端位于对称 NAT 后时客户端无法连接的问题，提升打洞成功率
• hysteria cert 命令现在会在示例服务端配置中包含 sniGuard: disable，让自签名证书在 Realms 模式下能正常使用

app/v2.9.0

• Added Hysteria Realms: No public IP? No problem. Punches through your NAT to let you host a Hysteria server from home, a cellular network, or even a coffee shop. Clients connect directly, peer-to-peer. No port forwarding, no relay.

---

• 新增 Hysteria Realms：没有公网 IP 也没问题！通过 NAT 打洞，让你从家宽、手机流量甚至咖啡店都能运行 Hysteria 服务端。与客户端 P2P 连接，无需配置端口转发或中转。

app/v2.8.2

This release contains important security fixes and we strongly encourage everyone to upgrade.

• Fixed a security issue where, when sniff was enabled, an attacker could craft malicious QUIC packets to cause a server OOM crash
• Fixed a compatibility issue with some older versions of nftables when server port hopping was enabled
• Fixed a potential thread safety issue in salamander obfs
• Important: Due to changes in how some QUIC handshake parameters are handled, UDP forwarding will not work when v2.8.2 clients connect to older servers (TCP is unaffected). New servers are fully compatible with both new and old clients. We strongly recommend upgrading both servers and clients.

---

此版本包含重要安全修复，强烈建议更新

• 修复了启用 sniff 时，攻击者可通过构造恶意 QUIC 包导致服务端 OOM 崩溃的安全问题
• 修复了服务端启用端口跳跃时，与部分旧版本 nftables 的兼容性问题
• 修复了 salamander obfs 中潜在的线程安全问题
• 重要提示：本版本由于调整了 QUIC 握手中部分参数的处理方式，v2.8.2 客户端在连接旧版本服务端时 UDP 转发将无法正常工作 (TCP 不受影响)。新版服务端则完全兼容新旧客户端。强烈建议同步升级服务端与客户端。

app/v2.8.1

This release contains important fixes and we strongly encourage everyone to upgrade.

• Fixed an issue where client connections could cause the server to crash when using BBR/Reno as the congestion control algorithm
• Fixed iptables calls potentially failing due to lock contention during server port-range listening
• Added HYSTERIA_FIREWALL_BACKEND environment variable to specify the firewall backend (iptables or nftables) for server port-range listening

---

此版本包含重要修复，强烈建议更新

• 修复了在使用 BBR/Reno 作为拥塞控制算法时，客户端连接在一些情况下会导致服务端崩溃的问题
• 修复了服务端端口范围监听时，iptables 调用可能因为竞争条件而失败的问题
• 新增 HYSTERIA_FIREWALL_BACKEND 环境变量，用于指定服务端端口范围监听的防火墙后端 (iptables 或 nftables)