Release notes

mod_pagespeed 2.1 is released as two parts: the module, which runs inside Apache or nginx and applies the classic rewriting filters in the request itself, and the optimizer worker, a separate process introduced by the 2.0 re-architecture that does the heavy optimization work off the request path. Since 2.1.0 the two are released together; the native packages of the current release carry the package version 1.19.0, the product as a whole is 2.4.0, and that is the version the container images, the NuGet packages and the Helm chart’s application version carry. This page lists the current release, the release notes of each line, and every release in one list, newest first, followed by the security updates we have published and what has changed since the last upstream release. We recommend running the latest release: it always carries the most recent performance and security work.

The current release

Release notes by line

Each line has its own page with the full entry for every release, collapsed and newest first.

• mod_pagespeed 2.4 — 2.4.0, 2026-10-14 (packages 1.19.0). The current release: the module and the optimizer worker together, with several rule packs per server.
• mod_pagespeed 2.3 — 2.3.0, 2026-10-12 (packages 1.18.0). The module and the optimizer worker together, with rule packs.
• mod_pagespeed 2.2 — 2.2.0, 2026-10-06 (packages 1.17.0). The module and the optimizer worker together.
• mod_pagespeed 2.1 — 2.1.0, 2026-09-17 (packages 1.16.0). The first release of the two parts as one product.
• The 2.0 optimizer worker — 2.0.0-beta.1 to 2.0.42 (2026-08-10). The out-of-process optimizer before the converged line.
• The 1.15 module — 1.15.0 (2026-06-01) to 1.15.0+r22 (2026-08-08). The module after the renumber.
• The 1.1 module — 1.1.0-beta.1 (2026-02-25) to 1.1.0+r23–r24 (2026-06-01). The first releases of the maintained module, before the renumber.

All releases

Every release, grouped into four periods and newest first inside each. Each line says which part the release belongs to, the module or the optimizer worker, and links to the full entry on that line’s page. Where the module shipped several package revisions within a few days they are grouped into one entry, listed under the lowest revision in the group.

The converged line — September to October 2026

mod_pagespeed 2.1.0, 2.2.0, 2.3.0 and 2.4.0 are the module and the optimizer worker released together. 2.1.0 carries package version 1.16.0 in the apt and yum repositories and 2.1.0 on the NuGet package; no container images or Helm chart were published for it. 2.2.0 carries package version 1.17.0, and 2.2.0 on the container images, the NuGet packages and as the Helm chart’s application version. 2.3.0 carries package version 1.18.0, and 2.3.0 on the container images, the NuGet packages and as the Helm chart’s application version. 2.4.0 carries package version 1.19.0, and 2.4.0 on the container images, the NuGet packages and as the Helm chart’s application version. See the current release above and the 2.4, 2.3, 2.2 and 2.1 pages for the full entries.

Two parts, shipping in parallel — late May to August 2026

The first releases — May to early June 2026

Before the first releases — February to May 2026

Security updates

Every security fix we have published for either part is listed here with the release that carried it. Where a fix repairs a defect inherited from the open-source line — code that shipped in 1.14.36.1 and was never fixed upstream — the release entry says so.

#	Advisory	Impact	Affected	Fixed in	Update
1	—	missing security headers — cached responses, nginx module	the nginx module in the container images and Helm chart, in releases up to and including 2.3.0	mod_pagespeed 2.4.0	Recommended; cached responses regain the headers as they expire, or purge the cache after upgrading to restore them at once
2	—	resource exhaustion — image optimization	releases up to and including 1.17.0 with image conversion enabled	mod_pagespeed 2.3.0	Recommended; animations above the new frame limit (default 200) are no longer converted
3	—	dependency update — Envoy filter (Envoy 1.37.6, advisories of 2026-08-26)	the Envoy filter in releases up to and including 1.17.0, built against Envoy 1.37.5 or older	mod_pagespeed 2.3.0	Recommended
4	CVE-2026-90439	dependency update — bundled nginx (1.30.5)	the NuGet sidecar package; not affected, because its bundled nginx is not built with HTTP/3	mod_pagespeed 2.3.0	Not required (keeps vulnerability scans clean)
5	—	denial of service — nginx module	the nginx module, all releases up to and including 1.16.0	mod_pagespeed 2.2.0	Recommended
6	—	denial of service — Apache module	the Apache module, all releases up to and including 1.16.0	mod_pagespeed 2.2.0	Recommended
7	—	denial of service — HTML rewriter	releases 1.15.0+r20 through 1.16.0	mod_pagespeed 2.2.0	Recommended
8	—	access-restriction bypass — nginx admin, statistics, console and message pages	the nginx module, all releases up to and including 1.16.0, where access to these pages is restricted in the nginx configuration	mod_pagespeed 2.2.0	Recommended; then replace the access rules for these pages with the updated example in every server block
9	—	information disclosure — per-host admin console	module 1.16.0 with the optimizer worker in use	mod_pagespeed 2.2.0	Recommended
10	—	cache integrity — nginx in-place optimization	the nginx module, all releases up to and including 1.16.0, with in-place optimization enabled (the default)	mod_pagespeed 2.2.0	Recommended
11	—	information disclosure — nginx in-place optimization	the nginx module, all releases up to and including 1.16.0, with in-place optimization enabled (the default)	mod_pagespeed 2.2.0	Recommended; flush the PageSpeed cache once after updating
12	—	request forgery — admin console	all releases up to and including 1.16.0, where the admin console is reachable beyond loopback	mod_pagespeed 2.2.0	Recommended; scripted purges and some monitoring probes need a change
13	—	denial of service — optimizer management API	optimizer worker 2.0.0 through 2.1.0 and optimizer packages through 1.16.0, with the management API enabled	mod_pagespeed 2.2.0	Recommended
14	—	information disclosure — optimizer management API with --api-read-open	optimizer worker 2.0.0 through 2.1.0 and optimizer packages through 1.16.0, started with --api-read-open	mod_pagespeed 2.2.0	Recommended; read-only clients that relied on it beyond the documented read endpoints need the API token
15	—	local privilege escalation — Windows	WeAmp.PageSpeed.AspNetCore and WeAmp.PageSpeed.NativeAssets.Windows 2.0.0 through 2.1.0, and the Windows optimizer worker built from them	mod_pagespeed 2.2.0	Recommended
16	CVE-2026-19931, CVE-2026-18924, CVE-2026-82209, CVE-2026-80229, CVE-2026-80230, CVE-2026-80231, CVE-2026-80255, CVE-2026-82208, CVE-2026-13608	dependency update — bundled HTTPS fetch library (curl 8.22.0)	module releases 1.1.0-beta.2 through 1.16.0	mod_pagespeed 2.2.0	Recommended
17	CVE-2026-32327, CVE-2026-34191, CVE-2025-49506, CVE-2026-34501, CVE-2026-34502	dependency update — bundled apr-util	apr-util 1.6.3 and earlier in the bundle; the affected components are not built into or called by any mod_pagespeed release	module 1.16.0	Recommended (no earlier release believed exposed)
18	GHSA-29g2-3rmr-qm68	dependency update — web console	ASP.NET Core packages before 2.0.42; container and Helm deployments before 2.2.0	optimizer worker 2.0.42 · mod_pagespeed 2.2.0	Recommended
19	—	denial of service — image decoding	optimizer worker before 2.1.0	mod_pagespeed 2.1.0	Recommended
20	—	hardening — privilege separation for the optimizer worker	—	mod_pagespeed 2.1.0	Recommended (new default in 2.1)
21	—	hardening — management API authentication	—	mod_pagespeed 2.1.0	Recommended (new default in 2.1)
22	—	hardening — browser-analysis sandbox	—	mod_pagespeed 2.1.0	Recommended (new default in 2.1)
23	—	hardening — system-call allow-list enforcement	—	mod_pagespeed 2.1.0	Recommended (new default in 2.1)
24	—	hardening — container and Helm defaults	—	mod_pagespeed 2.1.0	Recommended (new default in 2.1)
25	—	dependency update — base image	worker and nginx images before 2.0.41	optimizer worker 2.0.41	Recommended
26	—	cache disclosure — authenticated responses	optimizer worker before 2.0.40	optimizer worker 2.0.40	Recommended
27	—	cache disclosure — responses the origin later marks non-shareable	optimizer worker before 2.0.40	optimizer worker 2.0.40	Recommended
28	CVE-2026-42533	memory safety — bundled nginx	the sidecar package, the container images and the worker and nginx images, before module 1.15.0+r20 / worker 2.0.39 (bundled nginx before 1.30.4)	module 1.15.0+r20 · optimizer worker 2.0.39	Recommended
29	—	cross-site scripting — CSS inlining	all releases up to and including 1.15.0+r19; long-standing defects inherited from the open-source line	module 1.15.0+r20	Recommended
30	—	cross-site scripting — local-storage cache inlining	all releases up to and including 1.15.0+r19; long-standing defects inherited from the open-source line	module 1.15.0+r20	Recommended
31	—	cross-site scripting — inline-image deduplication	all releases up to and including 1.15.0+r19; long-standing defects inherited from the open-source line	module 1.15.0+r20	Recommended
32	—	cross-site scripting — inline image preview	all releases up to and including 1.15.0+r19; long-standing defects inherited from the open-source line	module 1.15.0+r20	Recommended
33	—	denial of service — image resolution limit	all releases up to and including 1.15.0+r19; long-standing defects inherited from the open-source line	module 1.15.0+r20	Recommended
34	—	denial of service — image spriting	all releases up to and including 1.15.0+r19; long-standing defects inherited from the open-source line	module 1.15.0+r20	Recommended
35	—	denial of service — JavaScript minifier	all 1.15 releases up to and including r19	module 1.15.0+r20	Recommended
36	—	denial of service — HTML parser	all 1.15 releases up to and including r19	module 1.15.0+r20	Recommended
37	—	content integrity — CSS dependency parsing	all releases up to and including 1.15.0+r19; long-standing defects inherited from the open-source line	module 1.15.0+r20	Recommended
38	—	content integrity — HTML character references	all releases up to and including 1.15.0+r19; long-standing defects inherited from the open-source line	module 1.15.0+r20	Recommended
39	—	thread safety — HTML parsing (startup race)	all releases up to and including 1.15.0+r19; long-standing defects inherited from the open-source line	module 1.15.0+r20	Recommended
40	CVE-2026-50812, CVE-2026-50813	memory safety — bundled SQLite	worker and nginx images before 2.0.39	optimizer worker 2.0.39	Recommended
41	—	denial of service — image dimension reading	optimizer worker before 2.0.39	optimizer worker 2.0.39	Recommended
42	—	dependency update — runtime images	2.0.x container images before 2.0.37	optimizer worker 2.0.37	Recommended
43	—	hardening — admin console	—	optimizer worker 2.0.37	Recommended
44	—	dependency update — bundled HTTPS fetch library	all releases up to and including 1.15.0+r17	module 1.15.0+r18	Recommended
45	—	hardening — input validation and output escaping	all releases up to and including 1.15.0+r17; the underlying gaps date back to 1.14.36.1 and earlier	module 1.15.0+r18	Recommended
46	CVE-2026-42055, CVE-2026-48142	dependency update — bundled nginx	the ASP.NET Core sidecar, all 1.15 releases up to and including r16 (bundled nginx before 1.30.3)	module 1.15.0+r17	Recommended
47	—	memory safety — nginx request handling	all releases up to and including 1.15.0+r16; a defect inherited from the open-source line	module 1.15.0+r17	Recommended
48	—	dependency update — runtime image	2.0.x container images before 2.0.33	optimizer worker 2.0.33	Recommended
49	—	hardening — bundled third-party code (defense in depth)	—	module 1.15.0+r16	Recommended
50	—	dependency update — bundled image codecs	optimizer worker before 2.0.32	optimizer worker 2.0.32	Recommended
51	—	hardening — binary hardening of the shipped native library	—	optimizer worker 2.0.32	Recommended
52	—	hardening — binary hardening and reduced attack surface	—	module 1.15.0+r15	Recommended
53	—	hardening — parser bounds and IIS sub-resource TLS	all releases up to and including 1.15.0+r10	module 1.15.0+r11–r14	Recommended; particularly for IIS deployments
54	—	dependency update — admin console	all 1.15 releases up to and including r10	module 1.15.0+r11–r14	Recommended
55	—	content integrity — agent-optimized markdown output	optimizer worker before 2.0.30	optimizer worker 2.0.30	Recommended
56	—	dependency update — container images	2.0.x container images before 2.0.22	optimizer worker 2.0.22	Recommended
57	—	memory safety — IIS module unload	IIS deployments, all releases up to and including 1.15.0+r8	module 1.15.0+r9	Recommended for IIS deployments
58	—	availability — prebuilt nginx module	prebuilt Ubuntu nginx module packages, 1.15.0+r3–r6	module 1.15.0+r7–r8	Recommended
59	—	denial of service — nginx request handling	all 1.1.0 releases up to and including r21; a defect inherited from the open-source line	module 1.1.0+r22	Recommended
60	—	hardening — admin-surface access control and sidecar defaults	—	module 1.1.0+r22	Recommended
61	—	dependency update — admin console (13 published advisories)	all 1.1.0 releases up to and including r17	module 1.1.0+r18–r21	Recommended
62	CVE-2023-4863	memory safety — bundled libwebp	the open-source line, 1.14.36.1 and earlier	module 1.1.0	Recommended
63	—	memory safety — image processing	the open-source line, 1.14.36.1 and earlier	module 1.1.0	Recommended
64	—	denial of service — untrusted input handling	the open-source line, 1.14.36.1 and earlier	module 1.1.0	Recommended
65	—	dependency update — bundled image codecs and HTTPS fetch library	the open-source line, 1.14.36.1 and earlier	module 1.1.0	Recommended
66	—	hardening — admin surface	the open-source line, 1.14.36.1 and earlier	module 1.1.0	Recommended

No container images or Helm chart were published for 2.1.0; for those deployments, the fixes listed as fixed in 2.1.0 arrive with 2.2.0.

Beyond the individual fixes listed above, both parts carry continuing security work.

At a high level, that work spans:

• Memory-safety hardening across the engine and request-handling paths, backed by continuous sanitizer testing on every platform.
• Robustness against malformed or oversized input — untrusted content and abnormal conditions are handled gracefully instead of crashing or exhausting resources.
• Admin-surface hardening — stricter authentication, safer defaults, and improved resilience of administrative and reporting endpoints to malformed or unauthorized external requests.
• Binary hardening of the shipped modules (RELRO, BIND_NOW, stack-protector, FORTIFY_SOURCE) and a reduced attack surface.
• Ongoing dependency updates, including image codecs, the bundled HTTPS fetch library, and tracking upstream nginx security releases, gated by continuous CVE scanning.

We keep these descriptions general by design: security entries state the impact class and the recommendation, not the mechanism. If your servers run an older open-source mod_pagespeed build, moving to mod_pagespeed 2.1 is the supported way to get all of the above.

The security page sets out how to report a problem and how we handle reports.

Since the last upstream release

The last upstream release was 1.14.36.1, published in August 2020 — the one release made under the Apache incubator. The last Google-era stable release before it was 1.13.35.2, February 2018. If the build you run today came from either of those, this section is the short version of what is different in what we ship now.

We-Amp helped build ngx_pagespeed, maintained mod_pagespeed and helped drive the Apache incubation throughout the Google era, and has carried the line forward since. The module alone carries 765 first-parent merges since 1.13.35.2. Very little of that is visible from a configuration file, which is what the three lists below are for.

Carried over unchanged

• Every existing pagespeed configuration directive and filter name from the open-source release continues to work, with a small set of long-obsolete filter names now accepted with a warning.
• The ModPagespeed* directive spelling still parses, and the admin console is still at /pagespeed_admin/.
• The module still runs in process, inside Apache and nginx, on the server you already operate.
• The Debian and Ubuntu package name is unchanged — mod-pagespeed-stable — so the .deb paths in your configuration management carry over.

Changed

• The dependency graph was rebased off its 2018-vintage pins. libwebp moved from 1.1.0 to 1.5.0, which clears CVE-2023-4863; libpng, giflib and libjpeg-turbo were brought to current upstream versions; curl moved to the 8.x line, with the HTTP fetcher rewritten on top of it; and zlib was replaced by zlib-ng.
• The file-based cache was replaced by Cyclone Cache — a fixed-size, lock-free, memory-mapped backend shared with the rest of the converged line. There are no more periodic pruning scans across millions of small files. Old FileCache directories are not read, and FileCacheInodeLimit parses as a no-op so Apache configurations keep loading.
• The build moved off the 2012-era gyp and Python 2 toolchain to Bazel, and packages are prebuilt, reproducible and signed — .deb, .rpm and .msi — so there is nothing to compile.
• The nginx module is dynamic. It loads as a module rather than being recompiled against the nginx source tree, and the prebuilt packages are built per distribution with a runtime compatibility guard, so a distribution’s own nginx patch does not leave you with a module that will not load.
• Apache 2.4 and later, and one X-Page-Speed header. The _ap24 suffix is gone from the package name, and the X-Page-Speed response header is now the same across every port — no port-specific override and no special expired-state header to special-case in monitoring.
• The admin console was rebuilt as a single-page application, bundled into one file so it ships inside the module itself with no extra static-asset deployment step. It is the operator UI for cache configuration and filter configuration, and it is stamped with the release tag at build time, so the running build is unambiguous from the UI.
• The whole line is licensed under the Apache License 2.0 — the same license the original codebase carried — and the relicensing is retroactive. The source is published at github.com/We-Amp/mod_pagespeed.

New since 1.14.36.1

• AVIF joined WebP as an opt-in image format, alongside ongoing filter-stack modernization: modern JavaScript and CSS syntax support, Core Web Vitals reporting, Subresource Integrity and CSP awareness.
• IIS became a first-class platform alongside Apache and nginx, and an ASP.NET Core sidecar package (WeAmp.PageSpeed.Sidecar) joined as an additional integration option — see ASP.NET Core Getting Started for both ASP.NET Core options.
• Linux on arm64. The upstream tree had no aarch64 build at all; Apache and nginx now ship arm64 builds alongside x86_64.
• The optimizer worker joined as the second part of the product. The heavy work — image transcoding, critical CSS, variant-aware caching — runs in a separate process, and with the Apache module or the reverse-proxy deployment the module serves the results from the shared cache. On the deb and rpm channels the two install and upgrade together from the same signed repository; the current release covers the pair.

Everything published after 1.14.36.1 is on this page, release by release. The upstream history up to and including it is archived here, unchanged:

Release notes for the upstream line, up to 1.14.36.1 →

Install and upgrade

mod_pagespeed 2.1 ships as native packages for Apache and nginx — the module and the pagespeed-optimizer worker from the same signed repository — as Docker images, and as a Helm chart. See Getting started to install, the installation guide for Docker, the Helm deployment guide for Kubernetes, and Deployment for production rollouts.

The Apache packages install the configuration that points the module at the optimizer worker. The native nginx module runs on its own; to use the optimizer worker with nginx, run the reverse-proxy deployment.

The IIS package ships from the 1.15 packaging channel.

Reporting a security issue

Found a security problem? Please email security@modpagespeed.com so we can investigate and ship a fix. We publish security-relevant changes here as part of the regular release notes. Our disclosure policy is on the security page.