Impact Score: 5/10
MinIO: Security Bugfix Release
Source available — automated, not human-reviewed
Component: minio · Channel: stable. Automated analysis, not a compatibility certification. How this works.
Analysis updated: 2026-11-01.
⚡ Executive Summary (TL;DR)
MinIO RELEASE.2021-12-27T07-23-18Z. Source highlight: Click here to download the latest version of MinIO.
Who Does This Impact? (Role-Based Analysis)
💻 Software Engineers & Devs
Check the source notes against the package and APIs you use before upgrading.
📊 Product & Engineering Leads
Use the documented changes to assess relevance to your product; release frequency alone is not a quality measure.
⚙️ DevOps & Security
Verify the target version, runtime requirements and rollback procedure in the official documentation.
✨ New Features & Capabilities (2)
- add configurable delta for skipping shards
- add healing for invalid shards by skipping the blocks
🔧 Bug Fixes & Patches (4)
- Priviledge escalation issue fixed in this release refer to our security advisory on this vulnerability. All users are advised to upgrade if they are public facing deployment. CVE-2021-43858
- Healing of shards that do not have aligned padding issue are fixed automatically in two locations one in "healing" and another during a "GetObject()" call - refer #13978, #13945
- fix: user privilege escalation bug
- fix: healing across pools removing dangling objects
📄 View Raw Release Notes (Original Developer Log)
## Highlights
- Click [here](https://min.io/download) to download the latest version of MinIO.
- Click [here](https://min.io/pricing) for production support.
- Similar to release [RELEASE.2021-11-24T23-19-33Z](https://github.com/minio/minio/releases/RELEASE.2021-11-24T23-19-33Z). **Downgrades are not supported in this release** for erasure-coded clusters, due to on-disk data format version bump - once upgraded erasure-coded clusters cannot be downgraded to the previous release. Please upgrade **staging** or **testing** environments first.
- Priviledge escalation issue fixed in this release refer to our security advisory on this vulnerability. All users are advised to upgrade if they are public facing deployment. [CVE-2021-43858](https://github.com/minio/minio/security/advisories/GHSA-j6jc-jqqc-p6cx)
- Healing of shards that do not have aligned padding issue are fixed automatically in two locations one in "healing" and another during a "GetObject()" call - refer #13978, #13945
- Multi-pool setup should purge the dangling objects properly.
## What's Changed
* Move last remaining IAM notification calls into IAMSys methods by @donatello in https://github.com/minio/minio/pull/13941
* skip inconsistent shards if possible by @harshavardhana in https://github.com/minio/minio/pull/13945
* return a meaningful error for disabled users by @harshavardhana in https://github.com/minio/minio/pull/13968
* Limit mySQL key size to 3K by @klauspost in https://github.com/minio/minio/pull/13974
* add configurable delta for skipping shards by @harshavardhana in https://github.com/minio/minio/pull/13967
* fix: user privilege escalation bug by @donatello in https://github.com/minio/minio/pull/13976
* simplify logger time and avoid possible crashes by @harshavardhana in https://github.com/minio/minio/pull/13986
* add healing for invalid shards by skipping the blocks by @harshavardhana in https://github.com/minio/minio/pull/13978
* fix: healing across pools removing dangling objects by @harshavardhana in https://github.com/minio/minio/pull/13990
* trim values from environment files by @harshavardhana in https://github.com/minio/minio/pull/13991
**Full Changelog**: https://github.com/minio/minio/compare/RELEASE.2021-12-20T22-07-16Z...RELEASE.2021-12-27T07-23-18Z