Stability
High FXServer CPU usage on Linux
Linux servers used noticeably more CPU from 12913 on. A Cfx.re collaborator confirmed the fix shipped in 14193, which reverts the pplx library to its pre-Node 22 version.
- Released
- 2025-03-31
- Support
- End of life
- Commit
- 60505548e2
- FiveM
- —
Known issues in this build
Fixed in this build
Voice
External voice connections blocked without warning (reverted)
Builds 13759 to 13890 shipped the first version of the external Mumble block, which broke setups that use external voice clients. It was reverted in 13930 and came back in a safer form in 15859.
Missing fixes (this build is still exposed)
Security
Server crashes from malformed connection, HTTP and latent-event input
Missing bounds checks in the connection handshake, the HTTP request parser and latent event reassembly could crash the server when it received crafted data. Anyone who can reach the server's port could trigger it. Update to 38435 or newer.
Security
One client could freeze the server by flooding game events
Before 37262 there was no core rate limit on netGameEvent packets. A single client could flood events such as weaponDamageEvent until the main thread hung and txAdmin restarted the server. The issue was reported on 35636 and 36727. 37262 drops clients that go over the new 'netGameEvent' rate limiter.
Security
Latent event reassembly is now bounded
The server's reassembly of large client-to-server latent events got hard limits, plus diagnostics for 'latent ACK overflow'. Older builds let a client keep more partial event state than they needed to, which costs memory and CPU.
Security
Better rate limiting for client latent events
Rate limiting of latent (TriggerLatentServerEvent) traffic from clients was tightened in the reassembly packet handler. On older builds a client could push latent event traffic harder than intended.
Security
Clients can no longer create multiple player objects
With OneSync, a modified client could register more than one networked player object (CNetObjPlayer) for itself. That is a known abuse path for desync and crashes. Since 23984 the server rejects the extra ones.
Security
New block_net_game_event command
Server owners can now block specific net game event types from clients with block_net_game_event (and undo it with unblock_net_game_event). Use it when an event type is being abused. The syntax was simplified in 16541.
Security
sv_protectServerEntities: stop clients deleting server-created entities
This new replicated convar (default off) protects entities created by server scripts from being deleted by clients. If cheaters delete your server-spawned vehicles, peds or props, run 14317 or newer and set sv_protectServerEntities true.
Voice
Voice server blocks external connections by default
Before 15859 anyone could connect to the built-in Mumble (voice) server, even without being a player on the game server. Now mumble_allowExternalConnections defaults to false, and voice clients must match a connected player who has finished routing. Set it to true only if you deliberately use an external Mumble client.
Voice
Mumble server network robustness
Oversized or invalid outgoing voice messages used to hit an assertion. They are now dropped cleanly, and the send queue is drained properly. The voice server should be less likely to stall or crash under bad traffic.