[Bug]: VLESS + Reality TCP handshake drops after xray 26.6.1 update

[sashaAverin]

Describe the bug

After updating to xray 26.6.1, VLESS + Reality stops working. TCP connection establishes, xray connects to dest target (Yahoo), but connection drops after ~12 seconds without completing Reality handshake. Client gets “server closed connection” error.

How to reproduce the problem

1.	Configure VLESS + Reality inbound
2.	Try to connect from client
3.	Connection drops after ~12 seconds

Expected behavior

Successful VPN connection

Actual behavior

TCP handshake drops, no data transferred

Relevant logs

13:15:11.401038 net0  In  IP 94.181.225.18.64460 > 213.165.46.141.443: Flags [SEW]
13:15:11.401098 net0  Out IP 213.165.46.141.443 > 94.181.225.18.64460: Flags [S.E]
13:15:11.440273 net0  Out IP 213.165.46.141.56210 > 74.6.231.20.443: Flags [S]
13:15:11.602137 net0  In  IP 74.6.231.20.443 > 213.165.46.141.56210: Flags [S.]
13:15:23.542000 net0  In  IP 74.6.231.20.443 > 213.165.46.141.56210: Flags [F.]
13:15:23.542233 net0  Out IP 213.165.46.141.443 > 94.181.225.18.64460: Flags [F.] 

Screenshots

No response

3x-ui version

3.2.8

Xray-core version

26.6.1

How did you install 3x-ui?

install.sh script

Operating system

Ubuntu 24

Which parts of the panel are affected?

No response

Browser (only if it is a UI bug)

No response

Is the panel behind a reverse proxy or CDN?

None

Before submitting

• I searched existing issues and this bug has not been reported.
• I am running the latest released version of 3x-ui (or have verified the bug still exists on it).
• This bug report is written in English.
• I have redacted any sensitive data (tokens, real domains, client UUIDs).

[github-actions]

Thanks for the detailed report.

What changed between 3x-ui releases

Confirmed by checking go.mod across tags:

3x-ui version	Bundled xray-core
v3.2.5 / v3.2.6	v26.3.27 (stable)
v3.2.7 / v3.2.8	v26.6.1 (pre-release)

So updating from v3.2.6 → v3.2.7+ upgraded the bundled xray binary from the stable v26.3.27 to the pre-release v26.6.1. This is the most likely cause of the regression you're seeing.

The VLESS and Reality proxy code itself is unchanged between those two xray-core versions (confirmed via git diff). The notable change in v26.6.1 that could touch Reality is a reorganization of the ModernFingerprints pool used by the random uTLS fingerprint (commit 455f6bc2). Newer fingerprints (Firefox 148, Chrome 131/133, Safari 26.3) replaced older ones; if your client uses fingerprint: "random" it will now pick from the new set.

The 12-second drop

The default xray handshake timeout is 60 seconds (not 12). A drop at ~12 s is more consistent with the destination server (Yahoo) closing the forwarded TLS connection. That would happen if xray treated your connection as a non-Reality probe and forwarded it to Yahoo instead of completing the Reality handshake — meaning the server did not recognise the client's Reality credentials.

Steps to diagnose

1. Check server-side xray logs at debug level.

In the 3x-ui panel → Settings → Xray Configuration Template, set "loglevel": "debug", restart xray, then attempt a connection. Look for lines around REALITY or shortId — they will tell you whether the server accepted the client's handshake or fell back to forwarding.

Alternatively, on the server:

journalctl -u x-ui -f --lines=100

2. Confirm it is the xray version.

Downgrade to 3x-ui v3.2.6 (which uses xray v26.3.27) and test:

bash <(curl -Ls https://raw.githubusercontent.com/mhsanaei/3x-ui/master/install.sh) v3.2.6

If Reality works again on v3.2.6, that confirms the regression is in xray v26.6.1.

3. Check Reality key material is intact.

After a major version jump, verify the inbound's shortId list and publicKey/privateKey in the panel still match what your client has. Also confirm the client's serverName matches one of the server's configured serverNames.

Please share

To move this forward, please add:

• The xray debug log output from a failed connection attempt (redact your domain/IP/keys)
• Your client's xray version
• Whether downgrading to v3.2.6 resolves the issue

[sashaAverin]

Thanks for the analysis!

Confirming: I’m located in Russia. After downgrading to v3.2.6 I will test and report back.

Also regarding the DPI comment — I tested on both Dom.ru and Megafon networks, same result on both. Will try the Cloudflare/TLS approach if downgrade doesn’t help.

[madcat-314]

Hi! If the value in Inbound - Security - Reality - uTLS is set to Chrome, try changing it to Firefox.

[sashaAverin]

Downgrading to v3.2.6 (xray 26.3.27) did not resolve the issue — the same TCP handshake drop behavior persisted.

The working solution was switching from VLESS+Reality to VLESS+WebSocket+TLS proxied through Cloudflare CDN. This completely bypasses the DPI detection issue on Russian ISPs (tested on Domru and Megafon networks).

So the root cause appears to be ISP-level DPI blocking Reality traffic in Russia, not necessarily a regression in xray 26.6.1 — though the timing of the update coinciding with users losing connectivity is still suspicious.

[wavewithme]

Have similar issue, change uTLS Chrome -> Firefox works for me.

[glbart]

Have similar issue, change uTLS Chrome -> Firefox works for me.

+1, same issue. Chrome → Firefox fixed it.