We have released nghttp2 v1.68.1.

Do not download the archive files generated by GitHub. They do not work. Please download the signed and versioned tar balls, such as nghttp2-1.68.1.tar.gz.

This release includes security advisory.

Security Advisory

CVE-2026-27135: Denial of service: Assertion failure due to the missing state validation

For more information, read the security advisory.