Table of Contents

Release Notes 1.6.0.17 LTS

This is the 3rd release in the 1.6.0 line of LTS releases, built with .NET 10.0.15.

Metadata

This release documentation version 1.0.

Release 1.6.0.17
Release date 2026-11-11
Release type Full Release
Future LTS (Long Term Support)
Server version 1.6.0.17+1.6.0.17-LTS-3fcaad97
Log Server version 1.6.0.17+1.6.0.17-LTS-1357f753
HostScreen Server version 1.6.0.17+1.6.0.17-LTS-83166e3c
Web Terminal Hub version 1.6.0.17+1.6.0.17-LTS-d54d648c
Web Terminal Client version 1.6.0.17+1.6.0.17-LTS-1cb1afb9
Management Console 1.6.0.17+1.6.0.17-LTS-b98b83cb
Log Viewer 1.6.0.17+1.6.0.17-LTS-1ea8114f

.NET Platform

.NET Release 10.0.15
.NET Runtime 10.0.15
ASP.NET Core Runtime 10.0.15
Notable changes Link

Web Terminal Client Renderer File Names (checksum)

Location: Program Files\Flynet\Jubilant\WebTerminal\web
139.19a9153c8008fbccbb4c.js 175.00150f5ec4b1c0c5d5d7.js
193.b2d3b9069542c3e95ab2.js 195.4caccc07b0539137c944.js
264.3f70d2733065bb50ca31.js 312.a3a9cb31838ab2d7f4ec.js
348.6805af9308554210583e.js 352.b71936792f0a485478f5.js
637.5da779567e9e7d68673c.js 945.38abcac5ec086177a07d.js
952.fb6ec946ad3f08b25385.js loader.25292ba42daca28a138e.js
main.7a2992836cb3b00bb972.js

Fixed Since v1.6.0.12

ID Protocols Description
HSS!132 3270 Prevent PA keys from sending field data
WTC!552 Not specified Fix display of large host screens when stretch-to-fit is disabled
LVA!33 Not protocol-specific Address npm dependency vulnerabilities

Change Notes

HSS!132 (MR !115) — Prevent PA keys from sending field data

The 1.6.0 LTS release now includes the 3270 PA-key correction: PA1, PA2, and PA3 no longer send screen-field data.

WTC!552 (MR !380) — Fix display of large host screens when stretch-to-fit is disabled

Corrected screen positioning for large host displays when stretch-to-fit is disabled, preventing the display from shifting upward. The browser-size scenario that exposed the issue passed after the correction.

LVA!33 (MR !24) — Address npm dependency vulnerabilities

Updated affected npm dependencies to patched releases to address the reported vulnerabilities.

Installation

Fresh Install

Please see the Jubilant Admin Manual for Fresh Install Instructions.

Upgrade

Note

Please note the specials steps below if upgrading from a version before 1.6.x.

If upgrading from a version of before v1.6.x extra steps must be carried out before and after the install steps below.

Upgrade is carried out using Jubilant scripts.

  1. Unzip the installer into a folder.
  2. Close any web browsers.
  3. Close any Services windows.
  4. Open PowerShell ISE as Administrator.
  5. In the PowerShell ISE open the Jubilant PowerShell script: "JubilantUpdate.ps1".
  6. Run the required script by pressing the green play / run script button on the toolbar.
  7. The upgrade of Jubilant is complete.

If this is an upgrade from before 1.6.x, make sure the after install steps are also completed.

Version Validation

Find out how to validate the installed version.

Security

.NET Security

We recommend upgrading to 1.6.0.17 for security reasons. This release updates .NET and addresses vulnerabilities in .NET and npm dependencies.

Vulnerabilities Fixed in this Release

The following dependency vulnerabilities were addressed by updates in this release. The advisory severity describes the dependency vulnerability, not necessarily the risk to every deployment.

CVE or Advisory Severity RNIID(s) Description Fixed In
CVE-2026-96958 High SB!51, WTA!125 Denial of service in System.Security.Cryptography.Xml. System.Security.Cryptography.Xml 10.0.13
CVE-2026-96960 High SB!51, WTA!125 Denial of service in System.Security.Cryptography.Xml. System.Security.Cryptography.Xml 10.0.13
CVE-2026-96959 High SB!51, WTA!125 Denial of service in System.Security.Cryptography.Xml. System.Security.Cryptography.Xml 10.0.13
CVE-2026-84008 High SB!51, HSS!130, WTA!125 Denial of service in System.Security.Cryptography.Pkcs. System.Security.Cryptography.Pkcs 10.0.13
CVE-2026-70162 Moderate SB!51, HSS!130, WTA!125 Denial of service in System.Security.Cryptography.Pkcs. System.Security.Cryptography.Pkcs 10.0.13
GHSA-86xp-94pg-8r6r Moderate WTA!125 Denial of service in the SignalR MessagePack protocol dependency. Microsoft.AspNetCore.SignalR.Protocols.MessagePack 10.0.13
CVE-2026-92707 Moderate WTA!128 Nested MessagePack arrays can exceed buffer length limits. MessagePack 3.1.12

General .NET Vulnerabilities Fixed in this Release

This release uses .NET Runtime 10.0.15 and ASP.NET Core Runtime 10.0.15. The security fixes since the previous release's .NET 10.0.12 include those in .NET 10.0.13, 10.0.14, and 10.0.15. The highest severity in this range is Critical.

The following runtime fixes are relevant to product endpoints. The fixed version is the first .NET 10 runtime release containing the fix.

CVE Severity Fixed in .NET Description
CVE-2026-70188 Critical 10.0.13 Kestrel can accept malformed newline characters in HTTP/2 request trailers and header values. The Server uses Kestrel HTTP/2 endpoints.
CVE-2026-70181 High 10.0.13 Multipart form processing can exhaust memory. The Web Terminal and Management Console hubs accept multipart uploads.
CVE-2026-114146 Critical 10.0.15 SignalR connections can be improperly bound to the negotiated identity, allowing injected hub invocations to run as another user. The product uses SignalR endpoints.
CVE-2026-114149 High 10.0.15 Multipart form processing can bypass a header-count limit and consume excessive resources. The Web Terminal and Management Console hubs accept multipart uploads.

Additional high-severity fixes for independently versioned cryptography packages are listed in Vulnerabilities Fixed in this Release.

Node Security

This release includes npm dependency security updates for the Web Terminal Client, Management Console Client, and Log Viewer Client.