v0.1.0

NX Node v0.1.0

Nexora Node is now NX Node

Update the panel first. NX Panel v0.1.0 moves its own server (see its
release). Then update each node from the panel's Nodes page, where it shows
Needs migration, or run the install command shown there on the node.

• The node lives in /opt/nx-node and /var/opt/nx-node and runs as nx-node (ghcr.io/nx-panel/node for Docker). The install script moves a node installed under the old name, by script or in Docker, keeping its method, its address and its certificates. If a step fails, the old node is put back.
• The install hands the node the panel's new client certificate. A node not yet updated keeps working with the previous one until then.
• Environment variables are NX_* (NX_STATE_DIR, NX_NODE_LISTEN, …).
• Nothing else changes in this release: the protocols and features are those of v0.0.6.

v0.0.6

Nexora Node v0.0.6

Before you update

Update the panel to v0.0.6 first. Panels up to v0.0.5 can still send a route rule with the direct action. That action never did anything, but this node refuses a whole configuration that names it. Panel v0.0.6 removes such rules and is out at the same time.

What's new

• urltest outbounds work. Before, a node given an outbound of type urltest failed to start its whole configuration. Now it starts, picks the fastest member, and switches when one fails.
• QUIC and UDP sessions stay up on large packets. Hysteria, Hysteria2 and TUIC sessions, and UDP relayed by other protocols, no longer close when a packet is too large for the network path.
• Further fixes in the proxy core: detecting when a QUIC connection is application-limited, listening on the IPv4 wildcard, IPv6 literal addresses, and key-material errors on OpenVPN connections.

Tested against Xray-core 26.10.21 and sing-box 1.14.4 clients on every protocol and transport: everything connects as before.

Under the hood

• The OpenVPN module is updated to v0.1.6.
• Fixes from upstream libraries: mieru 3.39.0 (the server can close idle TCP sessions, fewer allocations), pion/dtls 3.1.15 (cookie-response backoff), and the MTProxy library 1.12 (more reliable public-IP detection, and an SNI check that copes with a missing IP family).
• Built with Go 1.27.3, which fixes a security issue in certificate verification (GO-2026-6809).

v0.0.5

Nexora Node v0.0.5

Before you update

No panel update is needed: this node works with panels on v0.0.3, v0.0.4 and v0.0.5. Panel v0.0.5 is out at the same time and adds forms for the new OpenVPN settings.

If you run the node in Docker with a Tailscale endpoint, make sure /app/cache is mounted on host storage, as the shipped docker-compose.yml does. The endpoint's login now lives there. The first start after this update still joins the tailnet as a new device, one last time, because the earlier containers kept no state.

What's new

• MikroTik clients can connect to the OpenVPN server. RouterOS refused the server's reply and never finished connecting. This was tested on a real MikroTik.
• Tailscale endpoints keep their device. The node now keeps the endpoint's login in its cache directory. A restart or a new container no longer joins the tailnet as a new device, and an endpoint set up with a one-off auth key stays logged in after its key is spent. On a server install, the first start moves the existing login into the cache, so the node keeps its machine key and its tailnet address.
• Start warnings clear themselves. When the node skipped an item at start and the panel later added, fixed or removed it, the node kept reporting it as skipped until the next restart. Now the warning goes away as soon as the change applies. For example, endpoints whose certificate arrived after the first push no longer show as missing while they serve.

Under the hood

• The OpenVPN module is updated to v0.1.5.
• Fixes from upstream libraries: mieru 3.38.2 (a QUIC read loop, socks5 authentication checks) and pion/dtls 3.1.14 (handshake and session-resumption hardening), plus the golang.org/x modules.
• The Docker image now runs on Alpine 3.24, since Alpine 3.20 is out of support.
• Built with Go 1.27.2.

v0.0.4

Nexora Node v0.0.4

Before you update

No panel update is needed. This release changes nothing the panel sends or reads, so it works with the same panel releases as v0.0.3.

What's new

• A crash fix you should not skip. A crafted QUIC packet could crash the whole node when a routing rule sniffs traffic, such as the torrent-blocking preset. This release closes that hole, along with several other input-validation fixes: a size cap on HTTP transport requests, the gRPC frame length check, a Trojan multiplex memory leak, and a race in multi-user Shadowsocks.
• Changing an outbound now updates everything that goes through it. Detours, selectors, URL tests and DNS servers that use an outbound are rebuilt when that outbound changes. Before, they kept using the old settings until the node restarted.
• Removed inbounds really stop serving. Clients that were already connected kept working after their inbound was removed or the node stopped. This affected SSH, AnyTLS, and multiplexed VLESS, VMess, Trojan and Shadowsocks. Those clients are now cut off.
• OpenConnect no longer hangs. Removing an OpenConnect endpoint, or stopping the node, while a client was connected could freeze the node.
• Fewer leftovers after a failed update. When the panel pushes a configuration the node refuses, nothing from it keeps running in the background. A removed MASQUE (WARP) outbound also stops reconnecting to Cloudflare.
• DNS changes apply in one go. Removing several DNS servers at once, where one depends on another, no longer makes the whole update fail.
• UDP fixes for Hysteria, Hysteria 2 and TUIC packet fragmentation, and for packets with a zero UDP checksum.

Under the hood

• Built compatible with sing-box 1.14.3. The node now keeps its own inbound, outbound, endpoint and DNS managers, so live changes keep working on the new engine.
• The OpenVPN module is updated to v0.1.4.
• Built with Go 1.27.2.

v0.0.3

Nexora Node v0.0.3

Before you update

Update your Nexora panel to the latest release first, then update your nodes. This node release works with the newest panel. With an older panel, users who reach their traffic limit may not be cut off.

What's new

• Changes apply without restarting the node. Editing routing, DNS, logging or rule sets in the panel now reaches a running node without dropping everyone's connections.
• Safer updates. If a new configuration is refused, the node keeps running the previous one instead of ending up half-applied. Items the node cannot run are listed as warnings in the panel, and the rest keeps working.
• Users change without disconnecting others. Adding or removing users on OpenVPN, OpenConnect, SOCKS, HTTP, mixed and naive inbounds no longer affects other users' connections. A removed user's QUIC session is closed right away.
• A node serves only while its panel is reachable. A node switched off in the panel stops serving. If the panel cannot be reached for 3 minutes, the node stops serving until the connection returns.
• New outbound options. VLESS, VMess and Trojan outbounds can use XHTTP and mKCP, and VLESS Encryption is available on outbounds.
• Faster transfers for Shadowsocks, VMess, Trojan and gRPC, and a fix for HTTPUpgrade connections that could lose the first byte of a stream.
• Options that only apply to client apps are no longer accepted in node configuration.

Under the hood

• Built with Go 1.27.2, which includes the latest standard-library security fixes.

v0.0.2

remove pipeline

v0.0.1

First stable release of Nexora Node
Pairs with panel v0.0.1.

Nodes are installed and updated from the panel: add the node there and run the one-line command it gives you. Upgrading from a beta: update the panel first, then press Update in each node's install drawer.

Docs: English · فارسی · Русский · 中文

Reports

v0.0.0-beta.8

remove pipeline

v0.0.0-beta.7

remove pipeline

v0.0.0-beta.6

remove pipeline