wg-easy shipped v15.5.0 on 24 October with a release title that doubles as its summary: “Security fixes, support AmneziaWG 3.1, configurable interface name”. The note under it is short and points outward, which is the honest way to do this: “This fixes some Node.js vulnerabilities. [See release notes]”.
That link goes to Node’s October 2026 security release page, and the page lists what has been in the news all week, including “Node.js Brotli decoder out-of-bounds write permits remote code execution (CVE-2026-111497)” and “ca-cert (eMudhra Intermediate CA Compromise)”. Those are the two threads this desk has followed: the Brotli decoder flaw is a library issue with a wide reach, and the eMudhra removal has been arriving in project after project.
So part of the reading of this release is a runtime update. wg-easy’s bundled Node.js moves to releases carrying those fixes, and the project’s note says so rather than writing its own advisory. That note says only “some Node.js vulnerabilities”, and this piece goes no further than it: there is no claim here that wg-easy decodes Brotli itself, and none that it does not.
The changelog also carries an app-level security fix of its own: “fix: omit private keys from client detail API (#2822)”. For anyone running wg-easy as their WireGuard front end, that is the more directly relevant line of the release, since private keys are the secret the whole tunnel rests on, and the fix stops a client detail endpoint returning them.
What else ships in 15.5.0
AmneziaWG support moves to 3.1, through two entries in the changelog: “feat: update AmneziaWG to 3.1 (#2804)” and the dependency bump “Update dependency amnezia-vpn/amneziawg-go to v3.1.20260828 (#2796)”. For readers whose networks do deep-packet inspection, that variant of WireGuard is the reason wg-easy stays usable there; the release confirms 3.1 support and this piece claims nothing about its behaviour beyond that.
Two smaller items are worth knowing. “feat: add trusted proxies (#2751)” matters if wg-easy sits behind a reverse proxy: it gives the app a way to know which forwarder it can believe, rather than trusting whatever address arrives. And “security: document rate limiting (#2780)” is what it says, documentation rather than a code change, so treat it as guidance to read rather than a fix that arrives on its own.
The third item in the title is in the changelog too: “feat: make the WireGuard interface name configurable (#2826)”. The entry does not name the flag or setting, so this piece will not invent one. If you have wanted wg-easy on a WireGuard interface other than its default, this is the release to check the project’s documentation for.
Who should take it
If you run wg-easy on a homelab box, this is a routine update with a security reason attached, which makes it worth doing sooner than a feature release would be. If you enabled AmneziaWG for a filtered network, 3.1 is the reason to move. If wg-easy is behind Caddy or nginx, trusted-proxy support is worth configuring once you are on this version, since it changes what the app believes about client addresses.
There is no upgrade procedure in the release notes, and this piece is not going to invent one; the release record is the announcement, and the project’s documentation is where the steps live.
Sources: the wg-easy v15.5.0 release record and the Node.js October 2026 security releases it links to.