Wowza Streaming Engine 4.12.1: Smoother source switching, better H.265 support and S3-compatible cloud storage

Wowza Streaming Engine
1

Hello everybody,

Wowza Streaming Engine (WSE) 4.12.1 is now available. The release makes switching video sources during a live stream much smoother, improves H.265 support for WebRTC and HLS, and lets you upload to S3-compatible cloud storage beyond Amazon, as well as a long list of transcoder, WebRTC and reliability fixes and security updates.

Please refer to the

complete 4.12.1 release notes

for a full list of changes, updates and improvements, which are summarized below:

Version: Wowza Streaming Engine™ 4.12.1 build 20261020183206 released Oct 20, 2026.

Java support: Wowza Streaming Engine 4.12.1 is compiled using Java 17 (OpenJDK Java SE JRE 17.0.12). It can be used with Java versions 17 or 21. For more details, see Java version information.

Summary of new features and fixes

Smoother source switching in the transcoder

The live transcoder now handles a change of source in the middle of a stream, for example a LoopUntilLive switch from a looping video to a live feed, or a scheduled playlist moving between VOD files with different resolutions or codecs. Viewers should no longer see long pauses, choppy or frozen video, or glitches.

  • Decoder recovery: Failed decoder creation is now retried, and repeated rebuilds are reduced when a configuration keeps being rejected.
  • Codec-switch stalls: No more long output interruption when video arrives before the replacement codec configuration.
  • Fixes for visual artifacts, very low frame rates and frozen video after a source change, plus a decoder memory leak (see bug fixes below).
  • Many fixes for NVIDIA and NETINT hardware transcoding, covering resolution, bit-depth, HDR and color range changes.

Better H.265 support

  • H.265 over WebRTC: The H.265 RTP packetizer now inserts VPS/SPS/PPS before keyframes that lack them, just like the H.264 packetizer already does. H.265 sources that send their parameter sets only once or out of band (common for RTMP, RTSP and SRT encoders) now play over WebRTC and WHIP stream targets.
  • RTSP/RTP H.265 ingest: CRA and BLA pictures are now detected as keyframes, so open-GOP sources (the default for x265 and most HEVC encoders) keep producing HLS chunks.

S3-compatible cloud storage

S3 cloud storage stream targets can now upload to S3-compatible storage services, such as Fastly Object Storage.

  • URL template: The new cloudstorage.urlTemplate property takes host[:port][/path] and may include ${bucketName}, ${region}, ${serviceType} and ${domainSuffix}.
  • Access permissions: The new cloudstorage.acl property sets the x-amz-acl header (public-read by default; none omits the header).
  • Playback URLs: S3 playback URLs now follow the target’s playback host, playback SSL and bucket root path.
  • WSE Manager: The Advanced tab shows URL Template, Domain Suffix, Object ACL, SSL and Playback Over SSL when the S3 provider is selected.
  • Cloud storage targets that can’t create their storage connection now report Error instead of Active.

Reliability and WebRTC improvements

  • Shutdown: The transcoder and SRT now shut down within a bounded time, and the server reports anything that did not stop in time instead of hanging.
  • WebRTC on EC2: The EC2 metadata probe used to discover the server’s public address can now be turned off. Add the new webrtcHarvestEnableAwsHarvester property to <WebRTC><Properties> in the application’s Application.xml and set it to false.
  • Restarting an application now closes all of its WebRTC peer connections (WebSocket signaling, WHIP and WHEP).
  • The Windows updater now installs codec files correctly.

Bug fixes

  • Fixed garbled, pixelated or ghosted transcoded video when the source switches between streams, for example with the LoopUntilLive module.
  • Fixed transcoded output dropping to well under 1 fps after a source codec change on all transcoding paths except NVIDIA EVA.
  • Fixed a memory leak where every source codec change kept the previous decoder’s frame buffers allocated for the rest of the session.
  • Fixed transcoded output staying near 1 fps for an extended period after the transcoder fell behind and switched to decoding keyframes only.
  • Fixed about 25 seconds of frozen transcoded video after a decoder failed to deliver a picture.
  • Fixed colors staying wrong for the rest of the session on NVIDIA EVA transcoding when a source switch also increased the resolution.
  • HDR transitions: Tone-mapping state is now reset when sources change, and pictures whose HDR-to-SDR conversion fails are discarded.
  • NETINT resolution changes: Fixed buffer overruns, server crashes and green HEVC frames after resolution changes.
  • Runtime overlays: Fixed freezes, crashes and incorrect frame releases when overlays are enabled during EVA or NETINT transcoding.
  • Fixed a deadlock that could hang an application or VHost stop while a transcoder was shutting down.
  • SRT lifecycle: Startup, disconnect and server shutdown are now coordinated. Connections are cleaned up only once, and replacement publishers are protected.
  • Frame grabs: Unsuccessful frame grabs are now reported instead of returning blank or stale images.
  • RTSP/RTP H.265 ingest: Fixed open-GOP sources (the default for x265 and most HEVC encoders) no longer producing HLS chunks after the first keyframe. CRA and BLA pictures are now detected as keyframes.
  • WebRTC: Restarting an application now closes all of its WebRTC peer connections (WebSocket signaling, WHIP and WHEP). WebSocket signaling clients receive a status message before the socket closes, and publishers no longer keep streaming to a stream that the restart removed.
  • Fixed WHIP, WHEP and WebSocket signaling hanging for every WebRTC session when WSE runs in a container on EC2 and the instance metadata service never responds. The metadata probe now times out.
  • Fixed HLS, CMAF and MPEG-DASH cloud storage stream targets showing Active while every upload failed because the storage controller could not be created. They now report Error.
  • Fixed creating a WebRTC application through the REST API without WebRTC parameters. The application is now created with the default settings.
  • Letterboxing and overlays: Letterboxed pictures now keep their colors and contrast, and limited-range SDR overlay levels are corrected on CPU and EVA paths.
  • NETINT bit-depth changes: In-stream changes between 8-bit and 10-bit video are now handled by rebuilding or selecting a compatible decoding path when needed.
  • NETINT HDR conversion: PQ/HLG sources are now routed correctly when producing 8-bit SDR renditions, while HDR is preserved on Main10 outputs.
  • Reconnect cleanup: Fixed an old stream’s shutdown stopping its replacement transcoder or leaving incorrect connection counts.
  • GPU frame accuracy: Fixed incorrect buffered-frame repeats on EVA, and repeated or substituted pictures caused by unfinished legacy CUDA copies.
  • Color and range: Fixed missing color labels on EVA and NETINT H.264 output, preserved full-range EVA picture levels, and corrected the conversion of full-range sources for affected NETINT encoders.
  • MPEG-2 aspect ratio: Fixed the picture shape for sources that specify square pixels.
  • WebRTC: Fixed ingest stopping after an ICE restart for publishers whose offer uses a=sendonly, including WHIP publishers. The stream stayed published, but the server dropped its media.
  • Fixed WebRTC data channels failing silently.
  • Fixed audio failing to decrypt in live CMAF and DASH with cbcs encryption and key rotation. The seig sample group entry now carries each track’s own encryption pattern, matching its tenc. With key rotation, the sgpd box no longer carries a duplicate 16-byte key ID. This also applies to cenc/cbc1 output, including DASH VOD and DVR.

Security

  • Input validation: Malformed H.264/H.265 headers and invalid lengths are now rejected before they can cause excessive allocations, parser errors or processing loops.
  • Fixed a stored cross-site scripting (XSS) vulnerability: stored values on WSE Manager’s stream target view page are now escaped.
  • Updated Jackson to version 2.18.11.
  • Updated Spring Framework to version 6.2.19 and Spring Boot to version 3.5.16 in WSE Manager to resolve CVE-2026-41842, CVE-2026-41845, and CVE-2026-41850.
  • Removed the unused grpc-netty-shaded library, which the Google Cloud Storage stream target does not load, to resolve CVE-2025-55163. Upgrades delete it.
  • Docker images now use Ubuntu 24.04 bases: eclipse-temurin:21-jre-noble for the engine and tomcat:11.0-jdk17-temurin-noble for WSE Manager. This resolves CVE-2026-84782 in the engine image’s OpenSSL and removes vulnerable Go binaries that the floating Tomcat tag had pulled into the WSE Manager image.

Upgrade notes

  • WSE 4.12.1 is built with Java 17 and runs on Java 17 or 21.
  • The unused cloudstorage.fullPathURI setting has been removed. If it is still set, WSE logs a warning.
  • Legacy cloudstorage.string.<name> keys in PushPublishMap.txt are renamed to cloudstorage.<name>.
  • The WSE Docker images moved to Ubuntu 24.04 bases. If you build your own images on top of them, test your builds against the new bases.

Known issues

For a detailed list of currently known issues, see Known issues with Wowza Streaming Engine.

Bernd Backhaus
Technical Support Engineer
WOWZA | The solution you start with, the partner you scale with.

Manage your Support cases online
Bookmark our FAQ page
Bookmark our Status page

182x66.9749984741211