valkey

Upgrade urgency HIGH: There are critical bugs that may affect a subset of users.

Bug fixes

• Avoid memory leak of new argv when HEXPIRE commands target only non-exiting fields (#2973)
• Fix HINCRBY and HINCRBYFLOAT to update volatile key tracking (#2974)
• Avoid empty hash object when HSETEX added no fields (#2998)
• Fix case-sensitive check for the FNX and FXX arguments in HSE...

Upgrade urgency MODERATE: Program an upgrade of the server, but it's not urgent.

Bug fixes

• Authenticate slot migration client on source node to internal user (#2785)
• Bug fix: reset io_last_written on c->buf resize to prevent stale pointers (#2786)
• Sentinel: fix regression requiring "+failover" ACL in failover path (#2780)
• Cluster: Avoid usage of light weight messages to...

Upgrade urgency MODERATE: Program an upgrade of the server, but it's not urgent.

Bug fixes

• Fix Lua VM crash after FUNCTION FLUSH ASYNC + FUNCTION LOAD (#1826)
• Fix invalid memory address caused by hashtable shrinking during safe iteration (#2753)
• Cluster: Avoid usage of light weight messages to nodes with not ready bidirectional links (#2817)
• Send duplicate multi meet pa...

Valkey 9.0.0 GA - October 21, 2025

Upgrade urgency LOW: This is the first release of Valkey 9.0 which includes stability, bug fixes, and incremental improvements over the third release candidate.

Bug fixes

• HSETEX with FXX should not create an object if it does not exist (#2716)
• Fix crash when aborting a slot migration while child snapshot is ac...

Upgrade urgency LOW: This is the third release candidate of Valkey 9.0.0, focused on stability, bug fixes, and incremental improvements.

Security fixes

• (CVE-2025-49844) A Lua script may lead to remote code execution
• (CVE-2025-46817) A Lua script may lead to integer overflow and potential RCE
• (CVE-2025-46818) A Lua script can be executed in the context of another user
• (CVE-2025-4...