LoginSign Up
← Back to all sparks
N

NSD

DEVOPS
Velocity5.0

Authoritative DNS name server from NLnet Labs

nlnetlabs.nl/projects/nsd ↗

NSD patched 8 CVEs across two dedicated security releases and added EDNS0 padding and PROXYv2 access controls.

dnssecurityopen-sourcenetworkingself-hostedinfrastructure
◆Current state
NSD released three significant versions in quick succession: 4.15.1 fixed four CVEs including a TCP-window-throttle DoS, a UDP cookie-option DoS, an IP ACL bypass for some address ranges, and a PROXYv2 port ACL bypass. 4.15.2 followed with feature additions — HHIT/BRID RR type support, new SVCB service parameter keys (docpath, pvd, oots), EDNS0 padding over TLS per RFC 7830/8467, and configurable PROXYv2 access control — alongside another substantial round of hardening fixes, many reported by Palo Alto Networks. The 4.15.0 release introduced a breaking change to Prometheus metrics, moving zone names from metric labels to label values.
◆Where it's heading
NSD is in a security-intensive maintenance phase with a consistent external contributor: Qifan Zhang at Palo Alto Networks has reported the majority of bugs fixed in the 4.15.x cycle, including heap overflows, assertion failures on malformed records, and multiple DoS vectors. This external security research pressure is accelerating the quality of NSD's defensive posture. Protocol completeness work (new RR types, SVCB parameters) continues alongside the security fixes.
◆Prediction
The PROXYv2 improvements suggest NSD deployments behind TLS-terminating load balancers are a growing use case — expect additional configuration controls for encrypted-DNS setups. The experimental multi-catalog-consumer-zones flag may graduate to stable in a future release.

◆Recent moves

  1. 13d ago

    NSD 4.15.2 released

    NSD 4.15.2 adds HHIT and BRID RR type support, new SVCB service parameter keys (docpath, pvd, oots), EDNS0 padding over TLS, and PROXYv2 access control — expanding protocol completeness for DNS-over-TLS and next-generation DNS record types. The release also closes a long list of crash-path bugs in IXFR processing and malformed-record handling.

    View source ↗
  2. 21d ago

    NSD 4.15.2 release candidate

    Pre-release candidate for 4.15.2, identical in scope to the final release — a standard gating step before stable publication.

    View source ↗
  3. 21d ago

    NSD 4.15.1 security release: four CVEs fixed

    4.15.1 is a dedicated security release fixing four CVEs: IP access control bypass for certain address ranges (CVE-2026-18664), TCP service DoS via window throttling (CVE-2026-18916), UDP service DoS via crafted DNS cookie queries (CVE-2026-19401), and PROXYv2 port BLOCKED ACL bypass (CVE-2026-19538). For operators running NSD as public authoritative DNS, these are updates to apply immediately.

    View source ↗
  4. 2mo ago

    NSD 4.15.0 released

    4.15.0 restructures Prometheus metrics output — zone names move from metric identifiers into label values, aligning with Prometheus best practices and enabling cleaner aggregation. This is a breaking change requiring dashboard updates for existing users but significantly improves the usability of per-zone metrics in Grafana and similar tools.

    View source ↗
  5. 2mo ago

    NSD 4.15.0 release candidate

    Pre-release candidate for 4.15.0, including the breaking Prometheus metrics change — a review gate before the stable release.

    View source ↗
  6. 2mo ago

    NSD 4.14.3: four CVEs including heap overflow and TLS authentication bypass

    4.14.3 fixed four CVEs including a heap overflow via crafted SVCB RR (up to 65509 attacker-controlled bytes, CVE-2026-12244), a DoT crash-restart DoS from early TLS connection close (CVE-2026-12245), an out-of-bounds stack write from oversized APL rdata (CVE-2026-12246), and a TLS zone-transfer authentication bypass via TCP fallback (CVE-2026-12490). These preceded the 4.15.x security cycle and established the pattern of coordinated CVE disclosure with Palo Alto Networks.

    View source ↗