AdGuard Home 0.107.79: DoQ security fix, clean upgrade

released
lab run
upgraded from
0.107.78
guest
Debian 13 container
tested
yes, in our lab

Summary

A small release focused on fixes. It updates Go to pick up upstream Go security fixes (1.26.6) and makes AdGuard Home more resistant to resource exhaustion when using DNS-over-QUIC (GHSA-w6v6-f44j-3rj2). It also fixes DNS64 handling of unresolved CNAME/DNAME answers and blocked requests that have no EDNS(0) OPT record.

Breaking changes and deprecations

  • strict_sni_check is now deprecated. If you set it in your config, plan to remove it. We did not test this option.
  • The edge channel now uses the new UI and versioning scheme. This only matters if you follow edge.
  • Added (not breaking): comments in bootstrap server configuration, a "language" property in the install APIs, and removing a static lease’s hostname via the HTTP API.

Tested in our lab

We installed 0.107.78 from the official release tarball, ran the first-time setup through the install API, and added a DNS rewrite (lab.test to 10.1.2.3). We then stopped the service, replaced the binary with 0.107.79 and started it again.

  • The service came back up on 0.107.79 with the same config.
  • The web API answered and DNS queries worked, both for the rewrite and for normal domains.
  • The rewrite was still there after the upgrade.
  • Logs showed no new errors. A permissions warning on the install directory appears on both versions.

We did not test DNS-over-QUIC, the DoQ fix, DNS64, or the other fixes.

Lab log

$ ./AdGuardHome -s install
$ curl -s -X POST -H "Content-Type: application/json" localhost:3000/control/install/configure -d "{\"web\":{\"ip\":\"0.0.0.0\",\"port\":3000},\"dns\":{\"ip\":\"0.0.0.0\",\"port\":5353},\"username\":\"admin\",\"password\":\"[redacted]\"}" -w "%{http_code}\n"
OK
200
$ curl -s -u admin:[redacted] localhost:3000/control/status
{"version":"v0.107.78",[...]"running":true}
$ dig +short @127.0.0.1 -p 5353 lab.test
10.1.2.3
$ ./AdGuardHome/AdGuardHome -s stop
2026/10/31 20:13:30.875836 [info] service_manager: stopping service name=AdGuardHome
$ ./AdGuardHome/AdGuardHome -s start
2026/10/31 20:13:32.040158 [info] service_manager: starting service name=AdGuardHome
$ ./AdGuardHome/AdGuardHome --version
AdGuard Home, version v0.107.79
$ curl -s -u admin:[redacted] localhost:3000/control/status
{"version":"v0.107.79",[...]"running":true}
$ dig +short @127.0.0.1 -p 5353 lab.test
10.1.2.3
$ curl -s -u admin:[redacted] localhost:3000/control/rewrite/list
[{"domain":"lab.test","answer":"10.1.2.3","enabled":true}]

Reported by others

Nothing beyond the project’s own release notes: v0.107.79. We did not check forums or issues.

Verdict

Upgrade now, especially if you expose DNS-over-QUIC. The upgrade was uneventful in our test, and it carries a security fix. Back up your AdGuardHome.yaml first, as usual.

sources