Version 6.2.0 of the Passenger application server has been released. This release addresses several vulnerabilities (CVE-2026-42533, CVE-2026-60005, CVE-2026-56434, and one with a pending CVE number) as well as improves compatibility with FreeBSD.

Breaking Changes

This version of Passenger changes how the Watchdog API is authenticated. From version 5.2.0 → 6.1.8 if the watchdog_api_server_authorizations array was empty then authorization was skipped; in 6.2.0 Passenger disallows empty credentials for the Watchdog API and will reject all Watchdog API calls when configured that way.

Due to an issue in Passenger's code, the watchdog_api_server_authorizations array was empty by default from Passenger 5.2.0 → 6.1.8.

Installing 6.2.0

Please see the installation guide for advice on getting started with Passenger. Coming from a language other than Ruby, Python, Meteor or Node? Even if we didn't write a specific tutorial for your language, we made a generic guide that shows you the steps.

Upgrading to 6.2.0

We strongly advise staying up to date with the latest version.

Check out our upgrade guides for the different platforms:

Please be aware that you can enjoy enterprise features and sponsor the open source development directly by buying Phusion Passenger Enterprise.