Xray-core

Overview

Xray-core (XTLS/Xray-core) is open-source proxy/VPN core software widely used in censorship-circumvention stacks (V2Ray ecosystem, v2rayN, etc.). Supports multiple transport protocols including gRPC and Hysteria2.

Recent Developments

• 2026-10-04: Public disclosure of certificate verification bypass in pinnedPeerCertSha256 — MITM risk when pinning CA certs with empty ServerName (2026-10-04-xray-core-cert-verification-bypass)
• 2026-02-06: v26.2.6 silently fixed initial bypass; commit message “Simplify cert’s verification code” — no CVE at release (2026-10-04-xray-core-v26-2-6-release)
• 2026-01-16: pinnedPeerCertSha256 changed to always skip standard TLS verification — removed protection layer
• 2026-07: Incomplete fix reported via GHSA-5wf9-h793-W73C; fixed in 1.260327.1+ (2026-10-04-xray-core-github-advisory-ghsa)
• Removed allowInsecure in v26.2.6; users directed to pinning options

Warning

Users on affected versions (>= v26.1.13 before July 2026 fix) may have been exposed to MITM for months. Upgrade immediately; verify serverName configuration for IP-based endpoints.

Related

• tls-certificate-pinning
• proxy-software-security
• responsible-disclosure
• application-security
• v2ray

Sources

• 2026-10-04-xray-core-cert-verification-bypass
• 2026-10-04-xray-core-github-advisory-ghsa
• 2026-10-04-xray-core-kodemsecurity-analysis