mongoose 7.23

Embedded web server, with TCP/IP network stack, MQTT and Websocket

Release notes

## Overview

This release adds fixes and improvements, and more examples.

## Security fixes

- [CVE-2026-73261] Built-in TCP/IP malformed TCP option handling
- [CVE-2026-73260] Built-in TLS X.509 DER parsing bounds check
- [CVE-2026-63626] Built-in TCP/IP PPP IPV6CP option parsing bounds check
- [CVE-2026-73252] Built-in TLS short-record handling
- [CVE-2026-73251] Built-in TLS certificate-chain verification with CA bundles

## Important Changes

* Added [HTTP Bearer Authentication](https://mongoose.ws/docs/guides/jwt-bearer-authorization/) with [JSON Web Token (JWT)](https://mongoose.ws/docs/guides/jwt-bearer-authorization/) support and [tutorial](https://github.com/cesanta/mongoose/tree/master/tutorials/http/jwt-auth)
* Added [mg_uecc_parse_private_key()](https://mongoose.ws/docs/api/tls/#mg_uecc_parse_private_key) to help in extracting private key data, enhancing support for JWT
* Added [mg_base64url_encode() and mg_base64url_decode()](https://mongoose.ws/docs/api/util/#mg_base64url_encode), complementing JWT support
* Added [DNS-SD query and response support](https://mongoose.ws/docs/api/dns/), with an [mDNS/DNS-SD client tutorial](https://github.com/cesanta/mongoose/tree/master/tutorials/udp/mdns-sd-client)
* Added [OTA rollback](https://mongoose.ws/docs/guides/firmware-ota-updates/) support for ESP32 and NXP i.MX RT boards
* Added `MG_ARCH_MCUXPRESSO` support, to ease integration with the NXP toolchain
* Added [mg_crc16()](https://mongoose.ws/docs/api/util/#mg_crc16), a CRC-16/ISO-HDLC generation helper function
* Added [mg_dscp()](https://mongoose.ws/docs/api/core/#mg_dscp) for setting Differentiated Services Code Point (DSCP) on outgoing traffic
* TLS hostname checking now works without a configured CA certificate
* Improved PPPoE and VLAN interoperability
* Improved Mongoose BSD socket layer stability, data integrity, and throughput under queue pressure
* Improved FreeRTOS+TCP handling
* Improved WolfSSL compatibility with the built-in TCP/IP stack
* Improved C89 compiler compatibility and added more test targets and coverage
* Added more test targets for big-endian platforms

## Minor changes

* Improved [mg_aton()](https://mongoose.ws/docs/api/string/#mg_aton) IPv6 address processing
* Added `%zu` formatting support for printf-like functions
* Improved JSON malformed hex input handling
* Improved Ethernet FCS validation on big-endian and unaligned-access platforms
* Built-in TLS now initializes its time source when needed
* Improved built-in TCP/IP testing
* Improved built-in TLS testing
* Improved test coverage

Share this resource