Valkey 9.1 release notes
========================

Upgrade urgency levels:

| Level    | Meaning                                                             |
|----------|---------------------------------------------------------------------|
| LOW      | No need to upgrade unless there are new features you want to use.   |
| MODERATE | Program an upgrade of the server, but it's not urgent.              |
| HIGH     | There is a critical bug that may affect a subset of users. Upgrade! |
| CRITICAL | There is a critical bug affecting MOST USERS. Upgrade ASAP.         |
| SECURITY | There are security fixes in the release.                            |

Valkey 9.1.1  -  Released Tue 21 July 2026
------------------------------------------

Upgrade urgency SECURITY: This release includes security fixes we recommend you apply as soon as possible.

### Security Fixes
* CVE-2026-56684: Fix a use-after-free in TLS connection handling that could allow an authenticated client to achieve remote code execution using CLIENT KILL (#4234)
* CVE-2026-63639: Reject corrupt stream RDB files containing a shared NACK across consumers, which could allow remote code execution. Reported by @z0v3r1n and @lifip. (#4073)

### Bug Fixes
* Omit the implicit `alldbs` ACL rule from `ACL LIST`, `ACL SAVE` and `CONFIG REWRITE` so older versions can parse the output by @dvkashapov (#3964)
* Improve throughput when IO threads are enabled by offloading object deallocation from the main thread by @roshkhatri (#3938)
* Fix use-after-free crash when `ACL LOAD` removes a user whose authenticated client has its close deferred by @ranshid (#3800)
* Enforce `db=` ACL permissions on every DB clause of `COPY`, closing a bypass with `REPLACE` or repeated DB tokens by @enjoy-binbin (#3801)
* Enforce database-level ACLs for `CLUSTER FLUSHSLOT`, which removes keys from all databases by @enjoy-binbin (#3806)
* Fix use-after-free in the module API when unregistering the first registered cluster message receiver by @eifrah-aws (#3846)
* Fix `HRANDFIELD` with a positive count looping forever when non-expired fields are fewer than the requested count by @cjx-zar (#4047)
* Fix clients left on the wrong database after module keyspace notifications for `MOVE` and `COPY` by @enjoy-binbin (#4024)
* Fix Sentinel crash during coordinated failover when the command link to the old primary disconnects by @lukepalmer (#4068)
* Fix crash when active hash field expiration leaves a single-entry expiry bucket whose last field is later removed by @ranshid (#3950)
* Fix assertion in `HEXPIRE`, `HGETDEL` and `HPERSIST` when a module blocks the client in a keyspace notification callback by @enjoy-binbin (#3743)
* Fix undefined behavior in the failover delay calculation when `cluster-node-timeout` is below 30 milliseconds by @enjoy-binbin (#3941)
* Reject zipmap RESTORE/RDB payloads with overflowing length fields that could cause out-of-bounds access on 32-bit builds by @madolson (#3920)
* Reject NAN scores in listpack and ziplist encoded sorted sets on RDB/RESTORE load, preventing a crash on skiplist conversion by @madolson (#3921)
* Fix corrupted replies (dropped leading bytes) caused by a reply buffer race when IO threads are enabled by @nanyan0312 (#4060)
* Fix startup crash on 32-bit systems where time_t is 64-bit (such as Alpine 3.23) when generating `INFO` output by @chenshi5012 (#3787)
* `HGETDEL` now returns a syntax error when the `FIELDS` keyword is missing or misplaced by @lcxn123 (#4049)
* `COMMAND INFO` in RESP3 now returns the subcommands field as an array instead of a set for commands without subcommands by @rickrams (#3939)
* Send the replica version on the dual-channel RDB connection so full syncs with newer encodings like hash field TTLs succeed by @hpatro (#4105)
* Fix duplicate failure handling and an invalid reply sequence in cluster slot migration by @chx9 (#3723)
* Reject control characters in `SENTINEL SET` values to prevent config-file injection via Sentinel config rewrite by @eifrah-aws (#3847)
* Reject control characters and delimiters in cluster AUX fields and validate `cluster-announce-ip` to prevent nodes.conf injection by @eifrah-aws (#3848)
* Redact key names and user data from more server log messages when `hide-user-data-from-log` is enabled by @zackcam (#3872)
* `ACL LOG` now reports the denied database ID for `COPY` instead of the command name when `db=` access is denied by @enjoy-binbin (#3888)
* Fix garbled shard IDs in the cluster UPDATE message log line by @enjoy-binbin (#3942)
* Fix negative `master_sync_total_bytes` in `INFO replication` during disk-based sync when the RDB exceeds 2GB by @chx9 (#3811)
* Increase the maximum process title length from 255 to 1024 characters to avoid truncation with long paths by @pkhartsk (#3843)

Valkey 9.1.0 GA - Released Tue May 19 2026
---------------------

Upgrade urgency LOW: This is the first stable release of Valkey 9.1.

### Security fixes

* (CVE-2026-23479) Use-After-Free in unblock client flow
* (CVE-2026-25243) Invalid Memory Access in RESTORE command
* (CVE-2026-23631) Use-after-free when full sync occurs during a yielding Lua/function execution

### New Features and enhanced behavior
* Add cluster bus network traffic usage metric in bytes by @hpatro (#3396)
* Reduce latency spikes during rehashing via incremental page release by @chzhoo (#3481)

### Bug Fixes
* Fix(syncio): Set errno on EOF in syncRead and propagate to conn->last by @abmathur-ie (#3580)
* Fix GEOSEARCH BYPOLYGON leak on invalid COUNT by @bandalgomsu (#3568)
* Handle NULL pointer in streamTrim listpack delta calculation by @smkher (#3591)
* Fixes server crash when RDMA benchmark clients disconnect by @quanyeyang (#3448)
* Fix the memory leak in valkey-benchmark by @nmvk (#3643)

Valkey 9.1.0-rc2 - Released Tue Apr 28 00:00:00 2026
-------------------------------------

Upgrade urgency LOW: This is the second release candidate of Valkey 9.1.0.

### Behavior Changes
* Revert strict TLS certificate validation at config load as it is a breaking change, deferred to next major version (#3572)

### New Features and enhanced behavior
* Do the failover immediately if the replica is the best ranked replica by @enjoy-binbin (#2227)
* Add `cluster-config-save-behavior` option to control nodes.conf save behavior by @enjoy-binbin (#3372)
* Lua scripting engine is now statically linked by default instead of dynamically linked by @eifrah-aws (#3392)
* Module command result callback addition by @martinrvisser (#2936)

### Performance and Efficiency improvements
* Redesign IO threading communication model with lock-free queues (8-17% throughput gain) by @akashkgit (#3324)
* Increase embedded string threshold from 64 to 128 bytes (30% GET throughput gain) by @Nikhil-Manglore (#3397)
* ARM NEON SIMD optimization for pvFind() in vset.c (2-3x speedup) by @ahmadbelb (#3033)
* Optimize WATCH duplicate key check from O(N) to O(1) using per-db hashtable by @enjoy-binbin (#3360)
* Optimize `CLUSTERSCAN MATCH` so that it uses a specific slot if given by @nmvk (#3380)
* Improve COB memory tracking with copy avoidance by @dvkashapov (#3306)

### Bug Fixes
* Fix `valkey-cli --cluster del-node` for unreachable nodes by @yang-z-o (#3209)
* Enhance cluster stale packet detection to prevent sub-replica and empty primary by @zhijun42 (#2811)
* Big endian bitmap byte order mismatch fix by @nmvk (#3401)
* Fix slot-migration-max-failover-repl-bytes unable to accept -1 by @enjoy-binbin (#3443)
* Fix config rewrite producing negative values for unsigned memory configs by @enjoy-binbin (#3440)
* Fix HPERSIST RESP protocol violation on wrong-type key by @madolson (#3516)
* Fix lua-enable-insecure-api default value cannot be changed to yes by @enjoy-binbin (#3548)

Valkey 9.1.0-rc1 - Released Tue Mar 17 00:00:00 2026
-------------------------------------

Upgrade urgency LOW: This is the first release candidate of Valkey 9.1.0, with
new features, performance improvements, and bug fixes.

### New Features and enhanced behavior
* Database-level access control by @dvkashapov (#2309)
* Move Lua scripting engine into a Valkey module by @rjd15372 (#2858)
* Support cross node consistency for `SCAN` commands through configurable DB hash seed by @sarthakaggarwal97 (#2608)
* Support automatic TLS reload by @yang-z-o (#3020)
* Support TLS authentication using SAN URI by @yang-z-o (#3078)
* Prevent invalid TLS certificates from being loaded by @yang-z-o (#2999)
* Failing to save the cluster config file will no longer exit the process by @enjoy-binbin (#1032)

### Command and API updates
* Makes `CLUSTER KEYSLOT` available in standalone mode by @stockholmux (#3040)
* Update HSETEX so that it always issue keyspace notifications after validation by @ranshid (#3001)
* Adds HGETDEL command by @roshkhatri (#2851)
* Support NX/XX flag in HSETEX command by @hanxizh9910 (#2668)
* New `CLUSTERSCAN` command for cluster-wide key scanning across nodes by @nmvk (#2934)
* New `MSETEX` command to set multiple keys with a shared expiration by @enjoy-binbin (#3121)
* `CLUSTER SHARDS`/`CLUSTER SLOTS` now include an `availability-zone` field by @bandalgomsu (#3156)

### Performance and Efficiency improvements
* Optimize zset memory usage by embedding element in skiplist by @chzhoo (#2508)
* Remove internal server object pointer overhead in small strings by @rainsupreme (#2516)
* Optimize skiplist query efficiency by embedding the skiplist header by @chzhoo (#2867)
* Improve performance during rehashing by @chzhoo (#3073)
* Optimize SREM/ZREM/HDEL to pause auto shrink when deleting multiple items by @enjoy-binbin (#3144)
* Abort and swap the tables if ht1 is very full during the hashtable shrink rehashing by @enjoy-binbin (#3175)
* Improve performance of copy avoidance when command reply tracking is disabled by @dvkashapov (#3086)
* Enable hardware clock by default by @dvkashapov (#3103)
* Improve `COMMAND` performance by caching responses by @ebarskiy (#2839)
* Add support for asynchronous freeing of keys on writable replicas by @Scut-Corgis (#2849)
* Faster `XRANGE`/`XREVRANGE` via stream range hot-path optimization by @nesty92 (#3002)
* Replicas can reuse the RDB file as AOF preamble after disk-based full sync by @RayaCoo (#1901)

### Module API changes
* Add ValkeyModule_ClusterKeySlotC by @bandalgomsu (#2984)
* Add more client info flags to module API by @martinrvisser (#2868)
* Add prefix-aware ACL permission checks and new module API by @eifrah-aws (#2796)
* Support unsigned 64-bit numeric config values in module API by @artikell (#1546)

### Observability and logging
* Cumulative metrics for active I/O threads usage by @deepakrn (#2463)
* Cumulative metric for active main thread usage by @dvkashapov (#2931)
* Support whole cluster info for INFO command in cluster_info section by @soloestoy, @ranshid (#2876, #2964)
* Add remaining_repl_size field in `CLUSTER GETSLOTMIGRATIONS` output by @enjoy-binbin (#3135)
* Add logging helper function to print node's ip:port when nodename not explicitly set by @zhijun42 (#2777)
* Dual-channel-replication announces itself at replica-announce-ip if configured by @jdheyburn (#2846)
* Show replica dual-channel replication buffer memory in `INFO MEMORY` and `MEMORY STATS` by @enjoy-binbin (#2924)
* Add `rdb_transmitted` state to replica state in `INFO` by @enjoy-binbin (#2833)
* New INFO section for scripting engines by @rjd15372 (#2738)
* Adding json support for log-format config by @jbergstroem (#1791)
* Add server side TLS certificate expiry tracking and INFO telemetry by @YiwenZhang12 (#2913)
* Add option to use libbacktrace for backtraces in crash reports by @rainsupreme (#3034)

### Build and Tooling
* Show RPS histogram in valkey-benchmark by @hanxizh9910 (#2471)
* Add --warmup and --duration parameters to valkey-benchmark by @rainsupreme (#2581)
* Lazy loading of RDMA libs in CLI/Benchmark when building as module by @Ada-Church-Closure (#3072)
* Add support for atomic slot migration to valkey-cli by @murphyjacob4 (#2755)
* Replace C++ fast_float dependency with pure C implementation (ffc) by @lemire (#3329)

### Bug Fixes
* Strictly check CRLF when parsing querybuf by @enjoy-binbin (#2872)

### Contributors
* Abhishek Mathur @abmathur-ie
* Adam Fowler @adam-fowler
* Aditya Teltia @AdityaTeltia
* Akash Kumar @akashkgit
* Alina Liu @asagege
* Allen Samuels @allenss-amazon
* Alon Arenberg @alon-arenberg
* aradz44 @aradz44
* Arthur Lee @arthurkiller
* bandalgomsu @bandalgomsu
* Baswanth @baswanth09
* Benson-li @li-benson
* Binbin @enjoy-binbin
* Björn Svensson @bjosv
* bpint @bpint
* chenshi @chenshi5012
* chzhoo @chzhoo
* cjx-zar @cjx-zar
* Daejun Kim @djk1027
* Daniil Kashapov @dvkashapov
* Deepak Nandihalli @deepakrn
* Diego Ciciani @diegociciani
* eifrah-aws @eifrah-aws
* Evgeny Barskiy @ebarskiy
* FAN PEI @fanpei91
* Gabi Ganam @gabiganam
* Gagan H R @gaganhr94
* Hanxi Zhang @hanxizh9910
* Harkrishn Patro @hpatro
* Harry Lin @harrylin98
* hieu2102 @hieu2102
* Jacob Murphy @murphyjacob4
* Jeff Duffy @jaduffy
* jiegang0219 @jiegang0219
* Jim Brunner @JimB123
* jjuleslasarte @jjuleslasarte
* Johan Bergström @jbergstroem
* John @johnufida
* Joseph Heyburn @jdheyburn
* Jun Yeong Kim @junyeong0619
* Katie Holly @Fusl
* Ken @otherscase
* korjeek @korjeek
* Kurt McKee @kurtmckee
* Kyle J. Davis @stockholmux
* Kyle Kim @kyle-yh-kim
* lcxn123 @lcxn123
* Leon Anavi @leon-anavi
* lovelypiska @chx9
* Luke Palmer @lukepalmer
* Madelyn Olson @madolson
* Mangat Singh Toor @immangat
* Marc Jakobi @mrcjkb
* martinrvisser @martinrvisser
* Marvin Rösch @marvinroesch
* Murad Shahmammadli @MuradSh
* NAM UK KIM @namuk2004
* nanyan @nanyan0312
* Nikhil Manglore @Nikhil-Manglore
* Ouri Half @ouriamzn
* Patrik Hermansson @phermansson
* Ping Xie @PingXie
* pkhartsk @pkhartsk
* Quanye Yang @quanyeyang
* Raghav Muddur @nmvk
* Rain Valentine @rainsupreme
* Ran Shidlansik @ranshid
* Ricardo Dias @rjd15372
* Rick Ramsay @rickrams
* Ritoban Dutta @ritoban23
* Roshan Khatri @roshkhatri
* ruihong123 @ruihong123
* Sachin Venkatesha Murthy @sachinvmurthy
* sananes @yaronsananes
* Sarthak Aggarwal @sarthakaggarwal97
* Satheesha CH Gowda @satheesha
* Saurabh K @smkher
* Seungmin Lee @sungming2
* Shinobu Nunotaba @Ada-Church-Closure
* Simon Baatz @gmbnomis
* skyfirelee @artikell
* Sourav Singh Rawat @frostzt
* stydxm @stydxm
* sushil paneru @sushilpaneru1
* Taeknology @Taeknology
* Ted Lyngmo @TedLyngmo
* Tony Wooster @twooster
* uriyage @uriyage
* Vadym Khoptynets @poiuj
* Venkat Pamulapati @ChiliPaneer
* Viktor Söderqvist @zuiderkwast
* Vitah Lin @vitahlin
* Vitali @VitalyAR
* withRiver @withRiver
* wxmzy88 @wxmzy88
* xbasel @xbasel
* Yair Gottdenker @yairgott
* Yana Molodetsky @yanamolo
* Yang Zhao @yang-z-o
* Yiwen Zhang @YiwenZhang12
* yulazariy @yulazariy
* yzc-yzc @yzc-yzc
* zackcam @zackcam
* zhaozhao.zz @soloestoy
* Zhijun Liao @zhijun42
