In late June 2026 the OpenWrt project released 25.12.5, the fifth service release of the 25.12 stable series. This is not a feature release: it is one of those you install without thinking twice, because it patches several remotely triggerable vulnerabilities in network services that ship enabled by default. The announcement explicitly recommends updating.
The big one: CVE-2026-53921
The centrepiece is CVE-2026-53921, rated critical: a stack buffer overflow in the DHCPv6 IA reply serialization inside odhcpd, the daemon OpenWrt uses as its DHCPv6, DHCPv4 and router advertisement (RA) server. It is triggered with crafted DHCPv6 REQUEST packets.
In practical terms: this is a component that listens on the local network by default and processes packets before any authentication. On a router, that is precisely the worst possible combination.
And it does not come alone. The same revision fixes further problems in odhcpd:
- A use-after-free in the DHCPv6 IA handler.
- A stack memory disclosure via truncated DHCPv6 options.
- A pre-authentication denial of service.
Known issues
The announcement also lists a few open items worth keeping on the radar before updating a large deployment:
- Pixel 10 phones have trouble connecting to WPA3-protected WiFi 6 access points.
- 802.11r Fast Transition causes connection problems with some WiFi clients when WPA3 is in use.
- SQM CAKE MQ throughput may be unexpectedly low on some configurations after the scheduler fixes.
Context: the 25.12 series
It helps to remember where this branch comes from. 25.12.0, released in March 2026, was a significant step for OpenWrt: it introduced a new package manager, added a built-in upgrade tool and extended support to more than 2,200 devices. Revisions .1 through .5 are the usual bedding-in of a stable series, and this fifth one is clearly the most urgent of the lot.
What to do
Update, sooner rather than later. A router is a device that is always on, always exposed and rarely thought about — which is exactly why pre-auth flaws in its network daemons are such attractive targets. You can do it from LuCI, under System → Backup / Flash Firmware, or with sysupgrade from the shell. If you manage several units, prioritise those running odhcpd facing untrusted segments.
The details are in the official OpenWrt 25.12.5 announcement and the full 25.12.5 changelog. Versions and support lifecycle are on the OpenWrt page.