mediamtx

Fixes and improvements

General

• fix dropping UDP packets during connection close (https://github.com/bluenviron/mediamtx/issues/6278) UDP packets were dropped in case of errors regardless of their size. Now they are dropped only if they are empty and there's an error.
• docs: fix youtube rtmps URL (https://github.com/bluenviron/mediamtx/issues/6286) The rtmps URL for Youtube was wrong. The fingerprint is not required anymore.
• prevent free access to playback server in case of legacy credentials (https://github.com/bluenviron/mediamtx/issues/6311) When legacy credentials are in use (readUser, readPass, publishUser, publishPass), access to the playback server is granted to anyone. Prevent this by granting access only to users using readUser, readPass.
• auth: skip JWKS fetch when no JWT is provided (https://github.com/bluenviron/mediamtx/issues/6274) authenticateJWT fetched the JWKS before checking whether the request carried a token at all. Every anonymous request, such as the first unauthenticatedRTSP DESCRIBE or HLS request that precedes a 401, caused an outbound request to the JWKS server while holding the manager's write lock. An unauthenticated client could therefore make the server contact the identity provider at will and, while that endpoint was slow or unreachable, stall JWT authentication for everybody. Return "JWT not provided" before touching the JWKS. Also check the JWKS response status code. A non-2xx reply was fed straight to the JSON decoder, so an error page surfaced as a confusing parse error,and an error reply that happened to hold valid JSON was cached as the key set for an hour. Reject it with the status code, as authenticateHTTP already does. Behavior for requests that carry a token against a healthy JWKS server is unchanged.
• rewindablereader: fix possible OOM (https://github.com/bluenviron/mediacommon/issues/383) empty datagram packets might cause the allocation of unnecessary entries. Fix that.
• h264: revert https://github.com/bluenviron/mediacommon/issues/142 (https://github.com/bluenviron/mediacommon/issues/384) supporting standalone SEI units should not be necessary anymore since these are filtered out at the root (https://github.com/bluenviron/gortsplib/pull/1184). In case of any issue that should arise after this change, open a bug report and we'll adjust things accordingly.
• h264: support SEI recovery point in DTS extractor (https://github.com/bluenviron/mediacommon/issues/341) Treat a SEI recovery point message (payload type 6) as a random access point, similarly to a CRA in H265, so the DTS extractor can (re)initialize its state from the first coded frame that follows the recovery point.

API

• fix race condition when kicking RTSP sessions (https://github.com/bluenviron/mediamtx/issues/6260) (https://github.com/bluenviron/mediamtx/issues/6275)
• do not change passwords when their value is "" (https://github.com/bluenviron/mediamtx/issues/6141) (https://github.com/bluenviron/mediamtx/issues/6287) (https://github.com/bluenviron/mediamtx/issues/6292) some users call /config/global/get and passits content to /config/global/patch. Since the former now redacts passwords and replaces their value with "", this string is used as an effective password, breaking authentication. Now password values equal to "" are ignored by /config/global/patch, and the original password value is kept unchanged.
• fix deadlock when reloading the API (https://github.com/bluenviron/mediamtx/issues/6280) (https://github.com/bluenviron/mediamtx/issues/6279) (https://github.com/bluenviron/mediamtx/issues/6310) When the API is closing, a /config endpoint might be waiting on the server to reply, but the server is busy waiting on all API endpoints to return, causing a deadlock. Fix this by canceling requests from API endpoints to the server when the API is closing.

Media-Over-QUIC

• use "catalog" as catalog track name (https://github.com/bluenviron/mediamtx/issues/6268

Fixes and improvements

General

• require browser POST requests to have an allowed origin (https://github.com/bluenviron/mediamtx/issues/6238) Browsers can send POST requests without performing any preflight request and without checking whether the request origin is present in Access-Control-Allow-Origin. Intercept these requests and check server-side whether the origin is allowed, blocking the request if it is not.
• conf: fix comparison and sharing of the default authInternalUsers (https://github.com/bluenviron/mediamtx/issues/6205)
• h265: fix DTS extraction of streams with long-term reference pictures (https://github.com/bluenviron/mediacommon/issues/371)
• pmp4: support stsz with a constant sample size (https://github.com/bluenviron/mediamtx/issues/5803) (https://github.com/bluenviron/mediacommon/issues/373)
• pmp4, fmp4: restore check on inbound H265 SPS (https://github.com/bluenviron/mediacommon/issues/374) A valid H265 SPS is required for marshaling back an MP4, so we have to resume checking them.
• pmp4: support tracks without edts (https://github.com/bluenviron/mediacommon/issues/375) The edit box is optional (ISO/IEC 14496-12, 8.6.5), but tracks without it were rejected with "unexpected box 'mdia'".
• pmp4: return seek errors from GetPayload (https://github.com/bluenviron/mediacommon/issues/376) GetPayload checked the wrong variable after seeking, therefore a failed seek was ignored and the payload was read from the current position of the reader.
• pmp4, fmp4: correctly fill HvcC NumTemporalLayers / TemporalIdNested from SPS (https://github.com/bluenviron/mediacommon/issues/379)
• pmp4: support tracks longer than 2^32 ticks (https://github.com/bluenviron/mediacommon/issues/377)

RTSP

• rtpmjpeg: reject reserved quantization value 127 (https://github.com/bluenviron/gortsplib/issues/1161) RFC 2435 reserves quantization values 100-127, but the guard used Quantization < 127
• mpeg4audiolatm: don't panic on a layer that reuses the config (https://github.com/bluenviron/gortsplib/issues/1162)
• sdp: support oversized numbers in origin (https://github.com/bluenviron/mediamtx/issues/5949) (https://github.com/bluenviron/gortsplib/issues/1171)

RTMP

• correctly fill HvcC NumTemporalLayers / TemporalIdNested from SPS (https://github.com/bluenviron/gortmplib/issues/129)
• reader: support standalone SEIs from DJI drones (https://github.com/bluenviron/mediamtx/issues/5221) (https://github.com/bluenviron/gortmplib/issues/130)

HLS

• make the server manage sessions (https://github.com/bluenviron/mediamtx/issues/6239) Sessions are now managed by the HLS server, detaching their lifecycle from muxers. This also comes with a performance improvement, since finding a session now traverses a single mutex, and not two channels like before.
• return 404 when a session is valid but muxer is closed (https://github.com/bluenviron/mediamtx/issues/5736) (https://github.com/bluenviron/mediamtx/issues/6240) HLS sessions are now kept open for up to 30 seconds after a muxer is closed. This allows the server to handle incoming requests belonging to these sessions and to classify then as 404 rather than 401.
• change error returned in case session is not found (https://github.com/bluenviron/mediamtx/issues/6241) match the RTSP behavior and return a "session not found" message rather than an "authentication error", which is reserved for creating sessions, not for using them.
• muxer: return 404 when closed (https://github.com/bluenviron/gohlslib/issues/394)

WebRTC

• fix AV1 getting stuck by stripping padding (https://github.com/bluenviron/mediamtx/issues/5632) (https://github.com/bluenviron/mediamtx/issues/5774) (https://github.com/bluenviron/mediamtx/issues/6242) AV1 OBU padding is generated by several encoders. Stripping it has been demonstrated to solve most situations in which browsers get stuck when playing such streams.
• fix stuck decoding with DJI drones (https://github.com/bluenviron/mediamtx/issue

New major features

Media-over-QUIC

• support forwarding streams (https://github.com/bluenviron/mediamtx/issues/6145)

API

• add /paths/static-sources/get endpoint (https://github.com/bluenviron/mediamtx/issues/6177) this allows to obtain details about static sources.
• add type-specific properties to forward destinations (https://github.com/bluenviron/mediamtx/issues/6178)
• add type-specific properties to static sources (https://github.com/bluenviron/mediamtx/issues/6184)

Fixes and improvements

General

• add --validate-conf flag (https://github.com/bluenviron/mediamtx/issues/5549) (https://github.com/bluenviron/mediamtx/issues/6140)
• use internal/core/VERSION as single source of truth to get version (https://github.com/bluenviron/mediamtx/issues/6119)
• httpp: propagate Flush() through the response writer wrappers (https://github.com/bluenviron/mediamtx/issues/6126) handlerLogger's responseRecorder and handlerWriteTimeout's writeTimeoutWriter both wrap http.ResponseWriter but implement neither http.Flusher nor Unwrap(). Any handler that flushes mid-response has that flush silently dropped, and its output only reaches the client when the handler returns. That defeats the stated purpose of writeTimeoutWriter, whose own comment says it exists so one can "write long responses, splitted in chunks, without causing timeouts": the deadline is reset per Write(), but nothing ever leaves the buffer until the end. Found while adding a server-sent-events endpoint: events written and flushed at t=0.4s onlyreached the client at t=2.2s, when the handler returned. Adding Flush() plus Unwrap() (so http.ResponseController can reach through) fixes both. The new test drives a real listener throughboth wrappers and reads while the handler is still blocked, so it fails on the current code by hitting the read deadline.
• support setting read buffer size on macOS (https://github.com/bluenviron/mediamtx/issues/6128) (https://github.com/bluenviron/mediamtx/issues/6131)
• drop support for Debian Bullseye (https://github.com/bluenviron/mediamtx/issues/6137) Bullseye reached EOL on 31st august 2026.
• emit "closed" log message when a server is closed (https://github.com/bluenviron/mediamtx/issues/6152)
• fix external command exit code reporting on non-Windows platforms (https://github.com/bluenviron/mediamtx/issues/6155)
• conf: support YAML version directives (https://github.com/bluenviron/mediamtx/issues/6157)
• metrics: add 'pos' property to forward_dests (https://github.com/bluenviron/mediamtx/issues/6183)
• metrics: deprecate the 'remoteAddr' property (https://github.com/bluenviron/mediamtx/issues/6174) Metrics are meant to provide aggregate statistics, not per-peer properties, that can be accessed through the API. The property is still served to keep backward compatibility.
• metrics: add 'type' to forward dests, deprecated 'protocol' (https://github.com/bluenviron/mediamtx/issues/6170) 'type' is aligned with the terminology used in the rest of the server.
• metrics, pprof: set default Allow-Origins to empty list (https://github.com/bluenviron/mediamtx/issues/6165) This prevents cross-site attacks to the API with the default configuration.
• always-available: support disabling recording when the source is offline (https://github.com/bluenviron/mediamtx/issues/6182) Add alwaysAvailableRecorded parameter that controls whether recording happens during offline periods for always-available paths. When set to false, recording only starts when a real source is connected.
• allow sources and forward destinations with an empty password (https://github.com/bluenviron/mediamtx/issues/6193) Restore the behavior introduced in https://github.com/bluenviron/mediamtx/issues/395 and accidentally reverted by https://github.com/bluenviron/mediamtx/issues/5779, which factored the RTMP/HLS credential check into validateURL() and applied it to RTSP sources too. A username with an explicitly empty password is valid per RFC 3986

Fixes and improvements

General

• prevent spamming of 'stream is closed' error during shutdown (https://github.com/bluenviron/mediamtx/issues/6062)
• impose a minimum value to clock rate of always-available tracks (https://github.com/bluenviron/mediamtx/issues/6086) Clock rates below 10 caused the emission of empty samples. Fix the issue by imposing a minimum value of 8khz, that rises to 22khz in case of AAC.
• fix race condition during sub-stream creation (https://github.com/bluenviron/mediamtx/issues/6075) (https://github.com/bluenviron/mediamtx/issues/6095) When a stream with always-available turned on switches from offline to online, or from a publisher to another, the reader mutex was not acquired during writing of codec parameters. This is now fixed.
• restore ability to run the server in a read-only file system (https://github.com/bluenviron/mediamtx/issues/6098) This was temporarily lost after the introduction of the native MoQ QUIC listener.
• fix deadlock when changing configuration through file and API (https://github.com/bluenviron/mediamtx/issues/6077) (https://github.com/bluenviron/mediamtx/issues/6101) When changing configuration in parallel by editing the configuration file and calling the API, the server could get into a deadlock that prevented any further action. This is fixed.
• change default value of authHTTPExclude (https://github.com/bluenviron/mediamtx/issues/6103) by default, do not exclude any action from HTTP authentication. Old value triggered several security warnings.
• add destFingerprint parameter (https://github.com/bluenviron/mediamtx/issues/6106) this allows to validate self-signed certificates of forward destinations.
• pmp4: fix panic in case of bad input (https://github.com/bluenviron/mediacommon/issues/354) the stsc box was not checked properly. This is now fixed.
• pmp4: fix panic in case of bad input (https://github.com/bluenviron/mediacommon/issues/355) The parser was not checking that the MP4 was properly sending addresses of samples, resulting in samples with invalid addresses. This is now fixed.
• pmp4, fmp4: do not emit empty payloads (https://github.com/bluenviron/mediacommon/issues/353)

API

• redact password in responses (https://github.com/bluenviron/mediamtx/issues/6110) passwords are not exposed anymore through the API. They can only be set, not read.

Media-Over-QUIC

• support pulling streams from other servers (https://github.com/bluenviron/mediamtx/issues/6111)
• do not accept empty payloads (https://github.com/bluenviron/mediamtx/issues/6085)
• limit maximum amount of published tracks (https://github.com/bluenviron/mediamtx/issues/6087) this prevents clients from consuming an excessive amount of memory.
• make /moq URL suffix optional (https://github.com/bluenviron/mediamtx/issues/6107) In order to establish a MoQ session with WebTransport, a /moq suffix was required until now. This is now optional in order to allow connecting to the server with the standard MoQ URL format.
• impose maximum size on pending reordered bytes (https://github.com/bluenviron/mediamtx/issues/6112) Decrease the maximum memory that clients can take by imposing a maximum size of 100MB on the pending reordered bytes.

RTSP

• accept relative digest URI (https://github.com/bluenviron/gortsplib/issues/1118) RFC 2617 section 3.2.2 allows the digest URI to be either an absolute URI or a relative path. Some clients use the latter, which was rejected with "wrong URL" since urlMatches only accepted an exact match against the absolute request URL.
• send initial RTCP sender report without waiting for a period (https://github.com/bluenviron/gortsplib/issues/1052) (https://github.com/bluenviron/gortsplib/issues/1111) (https://github.com/bluenviron/gortsplib/issues/1120) Reports were emitted only on the ticker, so the first one arrived Period after Initialize (10s by default) and later still when no RTP packet had been sent by that first tick, since report() returns nil unt