Espressif released ESP-IDF v5.5.6 on 16 October 2026. It is a bugfix release for the 5.5 branch, the one ESPHome and the Arduino core currently build on: ESPHome's development branch recommends ESP-IDF 5.5.5, and Arduino core 3.3.12 for ESP32 is based on 5.5.5 too. Besides three security fixes, the release has two breaking changes, and one of them matters to anyone running Zigbee or Thread on an ESP32-C5.

Three security fixes

The release notes list three vulnerability fixes, without CVE numbers:

  • Classic Bluetooth (Bluedroid): L2CAP message parsing now checks the buffer length, to prevent out-of-bounds reads and writes. The merged change touches the L2CAP code and the A2DP sink, the part that receives Bluetooth audio.
  • Wi-Fi: Espressif ported security fixes from the upstream wpa_supplicant project. The changed files cover SAE, the handshake behind WPA3-Personal, the PMKSA cache, WPA key handling, and the TLS client and X.509 certificate parsing used on enterprise (EAP) networks.
  • ESP-TEE: arguments that the application passes to secure services are now copied into TEE memory before the service runs. This only concerns projects that use Espressif's trusted execution environment.

Two breaking changes

Key Manager support is removed on the ESP32-C5, ESP32-P4 and ESP32-S31, because, in Espressif's words, "the hardware peripheral needs further design changes before it can be offered as a production feature". If a project relies on the Key Manager on one of those chips, check that before updating.

The second change fixes a bug reported in August. Zigbee and Thread devices identify themselves with a 64-bit IEEE 802.15.4 address (EUI-64), which ESP-IDF builds from the chip's 48-bit MAC address by inserting two bytes, FF:FE, in the middle. On the ESP32-C5 those two bytes were read from eFuse in the wrong order, so the address came out with FE:FF instead. In the bug report's example, the MAC 60:55:F9:F7:2C:A2 should become 60:55:F9:FF:FE:F7:2C:A2. Version 5.5.6 restores the correct order.

As a result, a C5 gets a different 802.15.4 address once its firmware is rebuilt with 5.5.6. If that C5 is already part of a Zigbee or Thread network, check after the update whether the coordinator or border router still recognises it as the same device.

What to do

If you build with ESP-IDF directly, v5.5.6 is the version to move to on the 5.5 branch; Espressif recommends installing it with its EIM installer (eim install -i v5.5.6). ESPHome and Arduino users get these fixes only when those projects move to 5.5.6. On 16 October, ESPHome's recommended, latest and dev ESP-IDF versions all still pointed at 5.5.5.