LoginSign Up
← Back to all sparks
N

NSD

DEVOPS
Velocity5.0

Authoritative DNS name server from NLnet Labs

nlnetlabs.nl/projects/nsd ↗

NSD's 4.15 line is being shaped by outside researchers' bug reports.

dnssecurityopen-sourcecatalog-zonesinfrastructure
◆Current state
NLnet Labs shipped two NSD releases in October. 4.15.3 fixed four CVEs in the simdzone zone-file parser that only crafted zone files can trigger, a risk mainly for multi-tenant setups where third parties feed zone data. 4.15.4 adds a report-channel EDNS option, a catalog-group-pattern setting that limits which patterns catalog member zones may use, and the UNECE and ISO record types, alongside a long list of fixes credited to researchers at Palo Alto Networks and Tsinghua University.
◆Where it's heading
Most of the 4.15 cycle is reactive: four security or bug-fix releases since August, with outside researchers finding parser overflows, crashes on malformed catalog zones and IXFR edge cases. Features still arrive, and at least one, catalog-group-pattern, was suggested by a researcher who also reported bugs. Catalog zones and zone-file parsing are where the attention is concentrated.
◆Prediction
Expect more fixes in catalog zone and zone-file parsing as outside fuzzing continues, likely in another 4.15 patch. The entries give no sign of a 4.16 feature release.

◆Recent moves

  1. 19d ago

    NSD 4.15.4 released

    4.15.4 adds a report-channel EDNS option, a catalog-group-pattern setting and UNECE and ISO record types, plus fixes for malformed SOA records, NSEC3 opt-out and catalog consumer crashes. Several fixes and one feature came from outside researchers, the pattern of the whole 4.15 cycle.

    View source ↗
  2. 26d ago

    NSD 4.15.4rc1 pre-release

    The release candidate for 4.15.4, matching the final's scope. A standard gating step.

    View source ↗
  3. 26d ago

    NSD 4.15.3 security release

    A security release fixing four CVEs in the simdzone zone-file parser, triggered only by crafted zone files. Most deployments are unaffected, but multi-tenant setups that accept zone data from third parties should upgrade.

    View source ↗
  4. 2mo ago

    NSD 4.15.2 released

    NSD 4.15.2 adds HHIT and BRID record types, new SVCB service parameter keys (docpath, pvd, oots), EDNS0 padding over TLS and PROXYv2 access control. It also closes a long list of crash-path bugs in IXFR processing and malformed-record handling.

    View source ↗
  5. 2mo ago

    NSD 4.15.2 release candidate

    Pre-release candidate for 4.15.2, identical in scope to the final release — a standard gating step before stable publication.

    View source ↗
  6. 2mo ago

    NSD 4.15.1 security release: four CVEs fixed

    4.15.1 is a dedicated security release fixing four CVEs: IP access control bypass for certain address ranges (CVE-2026-18664), TCP service DoS via window throttling (CVE-2026-18916), UDP service DoS via crafted DNS cookie queries (CVE-2026-19401), and PROXYv2 port BLOCKED ACL bypass (CVE-2026-19538). For operators running NSD as public authoritative DNS, these are updates to apply immediately.

    View source ↗