IMPORTANT
This release fixes multiple critical CVEs in dependencies that Coolify uses. Update immediately.
TIP
Every v4 line has a security fix release. On v4.4, update from the dashboard:
Settings → Update → Check now → Update. We recommend that everyone moves to v4.4.7, because the v4.1, v4.2, v4.3, v4.4 minior releases also include other security fixes that are not backported.To update to a patched version of v4.0 to v4.3, run this on your server to update to the security fix release of your line:
curl -fsSL https://cdn.coollabs.io/coolify/patch.sh | sudo bash
Running Security fix release v4.0.x v4.0.1 v4.1.x v4.1.3 v4.2.x v4.2.1 v4.3.x v4.3.24 v4.4.x v4.4.7 The script requires a stable release (not a beta, RC, or nightly).
On a v4 beta or older release? First install the v4.0.1 security fix release manually by running the command below, then update to v4.4.7 right away from the dashboard (
Settings → Update → Check > now → Update):curl -fsSL https://cdn.coollabs.io/coolify/install.sh | sudo bash -s 4.0.1
Security
- Updated PHP to 8.4.27 to fix PHP2Shell (CVE-2026-109618, CVE-2026-109619).
- Updated Node.js to 24.22.1 for the terminal server and the asset build.
- Updated cloudflared to 2026.10.3 for the eMudhra certificate compromise.
- Updated Sentinel to 1.1.2 to fix CVE-2026-111943.