ESPHome

A security flaw in ESPHome allows attackers to perform firmware updates through the web interface without entering the configured username and password. Affected versions up to 2021.9.1 with enabled web server and HTTP authentication are vulnerable.

ESPHome Dashboard contains a Cross-Site Scripting vulnerability where authenticated users can inject malicious JavaScript code into configuration files to steal session cookies and perform unauthorized actions.

ESPHome Dashboard component is vulnerable to Cross-Site Request Forgery attacks, allowing attackers to create, edit, or delete configuration files on behalf of logged-in users through malicious web pages.

A security vulnerability in ESPHome allows authenticated attackers to read and write arbitrary files in the configuration directory, which can lead to execution of malicious code.

ESPHome software on ESP-IDF platform has a web server authentication flaw that allows attackers to access protected functions without valid credentials, including over-the-air updates.

A programming flaw in ESPHome allows attackers to crash smart home devices when API encryption is not enabled.

Release 2026-06-20

Release 2026-06-18

Release 2026-06-18

Release 2026-06-17

Release 2026-06-16

Release 2026-06-15

Release 2026-06-11

Bug fixes for RC5 remote decoding polarity issues, ESP-IDF version restoration during build processes, Windows path handling for RP2040 template loading, and duplicate BLE Device Information Service resolution with string UUIDs.

Bug fixes and improvements including crash loop resolution for voice assistant configuration, Windows symlink handling, RTL8710B flash image fixes, SX126x frequency calibration correction, enhanced crash debugging for ESP32, and build system improvements for toolchain changes.

Maintenance release with dependency updates, ESP-IDF toolchain improvements, bug fixes for Python 3.11 compatibility, Tuya status pin null guard restoration, SX126x sleep wake fixes, Bluetooth proxy connection recovery, and various platform-specific enhancements for ESP32, ESP8266, and LibreTiny.

Unable to analyze release notes as the provided URL appears to be for a future version (2026.5.0) that does not exist yet. ESPHome typically follows a different versioning scheme and this URL is not accessible.

Beta release with breaking changes to sensor device classes for sen5x, sgp4x, and sen6x components removing incorrect AQI classifications from VOC and NOx sensors. Also includes dependency updates, CI improvements, audio enhancements, and Zigbee configuration restrictions.

Beta release updating zeroconf and aioesphomeapi dependencies, removing version field from ESP-IDF component files, and improving ESP32 toolchain version checking to respect framework source overrides.

Beta release with ESP-IDF build improvements, TinyUSB configuration validation, toolchain warning fixes, and component updates. Breaking changes include stricter validation that rejects invalid TinyUSB and WiFi SSID configurations.

Beta release 2026.5.0b1 for ESPHome with various improvements and bug fixes. Specific changes not detailed in provided changelog link.

Maintenance release adding optional Device Builder toggle, fixing secrets handling with quoted keys, substitution references in dictionaries, WiFi connectivity in safe mode, and Nextion text sensor state updates.

Fixes automation codegen types, rejects unsupported MCP23xxx interrupt options, improves ESP32 printf handling and memory usage, clamps LVGL meter values, and enhances API service argument handling with logging improvements.

Bug fix release addressing LVGL tabview triggers, Windows timezone validation, deep sleep duration types, WiFi connection state tracking, rotary encoder field types, ESP32 WiFi bootloop issues with missing NVS partitions, Nextion upload timeouts, ESP32 touch watchdog feeding, and RGB565 alpha render

Bug fix release addressing LVGL display issues, memory optimization for RGB565 animations, core variable placement fixes, null pointer crash prevention in LD2412 sensor, and improvements to IO expander interrupt handling. Also adds ESP32 Secure Boot V1 ECDSA signing support.

Bug fix release addressing multiple component issues including display rendering problems, core stability fixes, watchdog timer handling, configuration parsing regressions, and compilation errors across various hardware platforms and components.

Beta release with various bug fixes including package include support, PlatformIO progress bar rendering, micro wake word stability improvements, web server OTA reset protection, and addressable light transition fixes. Also adds ESP32-P4 PDM microphone support and API speed optimizations.

Unable to analyze release notes as the provided URL appears to be for a future version (2026.4.0) that does not exist yet. ESPHome typically follows a different versioning scheme and this URL is not accessible.

Beta release 2026.4.0b1 for ESPHome with various improvements and bug fixes. Specific changes not detailed in provided changelog link.

Bug fixes for Nextion display queue timing, LVGL image handling when dimensions change, and ESP32 build process when SDK configuration options are modified.

Bug fix release addressing WiFi roaming issues, UART communication problems, sensor calibration errors, BLE server data handling, thermostat runtime logic, and memory leaks. Includes new ESP8266 scanf float option and improved timezone validation messaging.

Unable to analyze release notes as the provided URL appears to be for a future version (2026.3.0) that does not exist yet. ESPHome typically follows a different versioning scheme and this URL is not accessible.

Beta release containing multiple bug fixes including compilation errors, memory management issues, data races, and off-by-one errors in event pools across various components like API, speaker, ESP-NOW, USB, BLE, and MQTT modules.

Beta release containing multiple bug fixes across various components including frame parser length handling, IR checksum corrections, sensor component fixes, voice assistant null pointer dereference prevention, temperature reading corrections, and HTTP request data race resolution.

Beta release with library updates, ESP32-S3 compatibility improvements, dependency bumps, and various bug fixes including UART debug, temperature sensor division by zero, touch coordinate mapping, battery update throttling, lightning sensor energy mask, and version parsing enhancements.

Beta release 2026.3.0b1 for ESPHome with various improvements and bug fixes. Specific changes not detailed in the provided changelog link.

Release 2026-03-03

Bug fix release addressing multiple component issues including API connection failures, compilation errors, memory bugs, and sensor filter regressions. Fixes affect max7219digit, mipi_dsi, dsmr, haier, bme68x_bsec2, water_heater, pid, ld2420, rtttl, hmc5883l, and sensor components.

Bug fix release addressing compilation issues on newer ESP32 variants, BLE characteristic value overflow, socket allocation problems, E1.31 protocol support restoration, pulse counter glitch filter calculation error, and WiFi power management improvements to prevent brownouts.

Unable to analyze release notes as the provided URL appears to be for a future version (2026.2.0) that does not exist yet. ESPHome typically follows a different versioning scheme and this URL is not accessible.