Home › OpenWrt
OpenWrt: which version is safe to update to?
Open-source Linux firmware for routers and access points: yearly stable series plus service releases. Every release below is checked against official notes, NVD CVE data and public community reports.
Follow new OpenWrt releases in a feed reader: Atom feed.
Before you update OpenWrt
How updates ship. OpenWrt ships a new stable series about once a year (such as 24.10 and 25.12), then numbered service releases on it that mostly fix bugs and security issues. The previous series keeps getting security fixes for a while before it reaches end of life. Packages you installed yourself come from the package feeds and update separately from the firmware.
What usually goes wrong. Most reports are tied to specific devices or targets (Wi-Fi drivers, switch chips, flash layouts), extra packages that have to be reinstalled after a sysupgrade, and bigger changes that come with a new series, such as 25.12 replacing opkg with apk.
How to back out. Download a configuration backup before upgrading. A sysupgrade replaces the whole firmware image, so going back means flashing the older image and restoring your backup, then reinstalling any packages you added. A backup made on a newer series may not restore cleanly on an older one.
All recent releases
Recent CVEs (last 120 days)
- CVE-2026-62948 CRITICAL 9.6 OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, odhcpd writes a DHCPv6 client FQDN option 39 hostname into /tmp/odhcpd.leases through src/statefiles.c statefiles_write_state6() and stat…
- CVE-2026-72840 HIGH 8.7 OpenWrt LuCI contains an overly permissive ACL definition in luci-mod-system-mounts that grants write access to /etc/crontabs/root to users intended only for mount configuration. Authenticated users with only the mount-…
- CVE-2026-53922 MEDIUM 6.5 odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In commit cfddd56 and earlier, an unauthenticated host on the same link can first obtain two bindings through normal DHCPv6 SOLICIT and REQU…
- CVE-2026-55490 MEDIUM 6.5 OpenWrt is a Linux operating system targeting embedded devices. Before v25.12.5, an integer underflow in handle_send_a() of the Emergency Access Daemon allows any unauthenticated attacker on the local network to crash t…
- CVE-2026-62947 MEDIUM 4.9 OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, the cgi-download handler in cgi-io authorizes the requested path against the caller's ubus session file ACL before canonicalization, and…
The weekly "safe to update?" email
One short email a week: what shipped, what broke, and what's safe to install. No spam.
Thanks — you're on the list.
We store only your email address and the date you signed up, to send this newsletter. We never sell or share it. Every email will have a one-click unsubscribe; you can also ask us to delete your address at any time. Privacy details.