Gately v0.6.6 released

November 12, 2026

Download v0.6.6 · GitHub Release

This release focuses on security hardening. Upgrading is recommended for everyone.

Security fixes

• Forged source headers: only the exact X-Real-Ip and similar headers were removed before, while PHP, WSGI and CGI backends treat X_Forwarded_For or X_Real_IP as the same variable as the real header, so a visitor could tell such a backend any client address or scheme. Visitor-supplied source and source port headers, including their underscore variants, are now always removed before forwarding. Forward auth subrequests get the same treatment, and Gately now writes X-Original-URI itself, so auth services that allow paths by it are no longer misled by a visitor's value.
• File service login throttling: WebDAV, FTP and SMB password checks had no attempt limit. A source with 10 failures within 15 minutes is now refused until the window ends (IPv6 grouped by /64, a successful login does not reset the count); recently verified credentials do not take a slot, and anonymous SMB probes are not counted.
• Restore: restoring an account file now uses a new session secret, so an old backup cannot bring back tokens revoked later by logout or "sign out of all devices"; backups that expand beyond 128 MB or contain more than 256 files are refused.
• Other: nginx configuration import limits block nesting (a deeply nested file exhausted the stack and ended the process); Host headers longer than 300 bytes get 400; user names written to the audit record and logs on failed logins are clipped to 64 characters.
• Dependencies: Go 1.26.11 standard library security fixes; updated golang.org/x/net, klauspost/compress and andybalholm/brotli; the SMB client of storage mounts moved to the maintained cloudsoda/go-smb2 (GO-2026-5051).

Accounts and sessions

• Server-side session revocation: logging out revokes the token, and "Settings → Account & Security → Sign-in sessions" has a new "Sign out of all devices" (POST /api/account/sessions/revoke) that ends all sessions from password, Passkey, third-party and fnOS gateway logins at once. API tokens are not affected.
• Outbound request limits (restrictOutbound, off by default): when on, outbound requests to administrator-configured addresses (webhooks, notifications, IP list subscriptions, DDNS callbacks, update checks, third-party login and so on) refuse loopback, private and link-local addresses (including 169.254.169.254). The check runs on the resolved IP for every connection, so redirects and DNS rebinding are covered. Reverse proxy upstreams, Wake-on-LAN, storage mounts and other internal-network features are not affected.
• Slow request protection: the admin port limits request body reads per endpoint. Regular endpoints must finish within 60 seconds; large-file endpoints (backup restore, upgrade packages, file uploads) have no total time limit but must keep sending at 4 KiB/s or more on average.

Web service

• Strip the path prefix on per-path backends (#86): a per-path backend can now strip its prefix before forwarding, so /api/zyqd/abc reaches the backend as /abc, with any path in the backend address in front. This matches nginx's proxy_pass http://backend/;, and nginx imports convert it automatically.
• Visitor source port (#83): with "Add X-Forwarded-*" enabled, X-Real-Port and X-Forwarded-For-Port are sent to the backend. When Gately sits behind a CDN or reverse proxy, the global settings take a "Real port header".
• Two-tier Gately (#81): when an outer instance only runs the WAF and an inner instance handles sign-in, set the same auth marker key on both and enable "Trust backend auth marker" on the outer site; visitors authenticated by the inner instance then skip the outer WAF as well.

See Web service and WAF.

Backup and restore (#85)

Restoring a configuration can now "Keep the current administrator account": the account, API tokens and third-party login to the admin UI keep their current values, and the backup may omit account.json, which suits moving another instance's configuration over. See Configuration · Backup and restore.

Fixes

• DDNS (#84): dynv6 records whose main domain is dynv6.net with sub domain xxxx no longer fail with 404 on sync and on deleting the provider record; the xxxx.dynv6.net zone is matched automatically.

Performance

• The ban list no longer rebuilds its CIDR list on every change when it holds many bans; site routing only compares wildcard domains after an exact-domain miss; expired rate limit and login failure records are swept at most once per second.
• Site Basic authentication and WebDAV cache successful bcrypt checks for 10 minutes, bringing the CPU cost per request from about 85 ms down to microseconds.
• Port forwarding reuses copy buffers when splice cannot be used; the live connection list only builds the 500 rows it returns; stripping source headers no longer allocates.
• Site statistics, Docker stats and logs, and the terminal session list in the web UI stop polling while the browser tab is hidden.

Upgrade notes

• Docker: pull the new image and recreate the container; OpenWrt: install the new .apk / .ipk over the old one; fnOS: install the new .fpk in the App Center; other installs can upgrade online from System Settings.
• Signed-in sessions stay valid after the upgrade; use "Sign out of all devices" when every device should sign in again.