Two days after Zephyr 4.5.0, the project put out a maintenance release for an older branch. Zephyr 4.3.2 was published on the evening of 30 October 2026 as a bugfix release for 4.3.1, and its security section is long: 225 CVE entries. For 121 of them the notes give a description and a GitHub security advisory. The other 104 are marked as under embargo, with dates running from 31 October 2026 to 9 January 2027, so details will arrive in stages.

Zephyr is the real-time operating system inside a lot of small connected hardware: Bluetooth sensors, Thread and Matter devices, LoRaWAN nodes and boards built on Nordic, NXP, Silicon Labs or Espressif chips. Most people never see it, because it lives in a device's firmware.

What the published entries cover

The disclosed CVEs touch almost every part of the system. A few that matter for home and IoT gear:

  • Thread joining (CVE-2026-19741). OpenThread joiner autostart used a publicly documented default joining credential (PSKd). With a known default, the commissioning step no longer rests on a secret.
  • Bluetooth. About 20 entries, including a stack buffer overflow in Bluetooth Mesh solicitation PDUs triggered by an oversized advertisement (CVE-2026-15894), a use-after-free in the GATT subscribe path and an infinite loop in the GATT client.
  • LoRaWAN. An out-of-bounds write in fragmented transport when a fragment index is 0 (CVE-2026-12363), plus out-of-bounds reads in the clock sync and FUOTA downlink handlers.
  • Espressif chips. Cross-session AES key confusion in the ESP32 hardware crypto driver (CVE-2026-82390), and an out-of-bounds read in the ESP-hosted SPI driver that could permanently stop Wi-Fi reception (CVE-2026-17054).
  • Networking and updates. An out-of-bounds write in 6LoWPAN reachable through an unauthenticated IPv6 Router Advertisement (CVE-2026-12633), a heap overflow in the hawkBit OTA client (CVE-2026-10849) and several bugs in the UpdateHub OTA agent, including remote denial of service.
  • Secure storage. AEAD nonce reuse in the default nonce provider for secure_storage ITS, caused by missing thread synchronization (CVE-2026-15890).

Around 20 more deal with system calls that let a user-mode thread read kernel memory or take over the kernel. Those matter on devices that actually use Zephyr's user-mode isolation.

Beyond CVEs, the release closes 157 issues and moves Mbed TLS to 3.6.7. One of those issues is the built-in HTTP server serving files outside its web root for paths containing ...

What to do

If you build your own firmware on Zephyr 4.3, move to 4.3.2 or to the new 4.5 line and rebuild. For finished products you depend on the vendor. Nordic's nRF Connect SDK, for example, ships its own Zephyr fork, so fixes reach those devices through the vendor's SDK and firmware updates, not straight from this release. Check for firmware updates on Zephyr-based devices over the next few weeks, especially Thread and Bluetooth Mesh gear.