I2P 2.14.0 (API 0.9.71) was released on 2026-10-20. This release hardens security across the router and bundled apps, brings a large round of i2psnark improvements, and fixes streaming and tunnel reliability issues.

As usual, we recommend that you update to this release. The best way to maintain security and help the network is to run the latest release.

Security

Router

  • AES operations and EdDSA signature comparison are now constant time (73819404c , 6440d5f16 )
  • Fixed an out-of-bounds read in garlic clove parsing and an undersized NTCP2 message 3 buffer (67b2f7327 , db3cd60f1 )
  • Tunnels drop duplicate fragments and cap the fragment reassembly map (8af94b9e4 , 4c3d10c12 )
  • Smaller robustness fixes in NetDB, NTCP, and datagram handling

i2ptunnel

  • HTTP proxy blocks requests to private, loopback, and link-local IPv4 addresses (3aef97a9d )
  • Fixed SOCKS 4/4a downgrade bypass of proxy authentication (ff63e0cdf )
  • HTTP server tunnels strip CR from headers; proxy auth strings are no longer logged
  • Output escaping fixes throughout the Hidden Services Manager

i2pcontrol

  • CSRF token protection, JSON security headers, and a delay on failed auth (9a1c56f35 , e79e4949d , 8fbfb70fb )
  • Removed fallback to the default itoopie password

i2psnark and Addressbook

  • Hardened bencode parsing (recursion limit, duplicate key rejection) and path traversal checks
  • Addressbook checks for destination mismatch on update (a884b9093 )

i2psnark

  • Magnet links: all trackers are now used and saved, plus dn name and xl size parameter support
  • Trackers and DHT: UDP backup tracker, smarter announce timing, spec-compliant dictionary sorting, compressed UDP and DHT messages
  • Performance: lower memory use and faster hashing when creating or rechecking torrents; tuned request throttling, pipelining, and timeouts
  • UI: free disk space shown and checked when adding torrents, audio playlist controls, live updates resume when the tab is visible again
  • Fixes: file priorities no longer lost after the startup check (GH #170 ), metainfo attribute extraction, extension handshake NPE
  • Groundwork for BitTorrent v2 (not yet user-facing)

Streaming and Transport

  • Streaming synchronization fixes in the retransmit and ack paths, plus slow start and reset tuning (061d4e3f6 )
  • Tunnels periodically use 5-slot tunnel build messages
  • New explicit force-IPv6 option, with Docker bridge support in progress
  • SAM: fixed DG2/DG3 subsessions (d2392ae9b )
  • I2CP: new discardMessage() session API

Other

  • SusiDNS: new “conflicts” address book
  • Reseed: added reseed2.i2pgit.org, reseed.kiota.ch, two skhron.eu servers, and i2p.ntp.poweredbyberlin.de; removed reseed.i2pgit.org
  • Docker: Debian Trixie, OpenJDK 21, Ant 1.10.18, commit SHA stamped in builds
  • Build fixes for izPack 5.2.6, gettext 1.0, and Gradle
  • GeoIP, Tor blocklist, tracker list, and translation updates

Full changelog: i2p-2.13.0…i2p-2.14.0

Thanks to zzz, eyedeekay, Nicholas Lopez, and fa for their contributions to this release.