Version 2.18.5 (January 2026)

Welcome to the Zowe Version 2.18.5 release!

See Bug fixes for a list of issues addressed in this release.

Download v2.18.5 build: Want to try new features as soon as possible? You can download the v2.18.5 build from Zowe.org.

New features and enhancements

Zowe Version 2.18.5 contains the enhancements that are described in the following topics.

Server Install

• Added the zowe.network.allowedDomains property in the allowlist to validate all service registration metadata against a trusted domain allowlist, helping to prevent unauthorized services from onboarding. (#4813)
• Improved the handling of temporary files and directories to reduce resource leaks and ensure a better cleanup during operations of Zowe. (#4825)

Zowe Application Framework

zlux-server-framework

• Enabled the app-server to now use separate certificates for inbound server TLS and outbound client TLS connections. When zowe.certificate.keystore.clientCertificateAlias (keyring) or both zowe.certificate.pem.clientCertificate and zowe.certificate.pem.clientKey (PEM) are defined, those are used for all outbound client connections while the main certificate is used only for serving HTTPS. When not defined, the behavior is unchanged. (#673)
• Improved TLS options; getTlsOptions() now returns client TLS options by default, while getServerTlsOptions() explicitly returns server TLS options. (#673)

zlux-app-server

• Added support for separate server and client TLS certificates in the app-server; defined zowe.certificate.keystore.clientCertificateAlias (keyrings) or zowe.certificate.pem.clientCertificate and zowe.certificate.pem.clientKey (PEM) to use a dedicated client certificate for outbound connections. (#375)

Zowe API Mediation Layer

• Implemented the zowe.network.allowedDomains allowlist property for URL domains. This feature validates all service registration metadata against a trusted domain allowlist. Current feature implementation in version 2.18.5 only issues warnings for unlisted domains by default. Full feature implementation is scheduled for subsequent v2.18.x versions to prevent unauthorized services from onboarding. (#4689)

Bug fixes

Zowe Version 2.18.5 contains the bug fixes that are described in the following topics.

Zowe Launcher

• Fixed an issue where backslash characters in environment variables did not properly escape, which caused incorrect values to be passed at runtime. (#169)
• Fixed an issue where the array size of zowe.launcher.restartIntervals was not validated, which could cause unexpected restart behavior when an invalid configuration was provided. (#188)

Server Install

• Restricted the read/write permissions for log files created by the zwe command to prevent unauthorized access and improve security of Zowe log output. (#4812)
• Fixed an issue where zwe init mvs did not copy the ZWESIP00 member when the target and source data sets were identical, and corrected an incorrect ACF2 data set protection statement used by zwe init security. (#4776)
• Fixed an incorrect keyword in the ACF2 key ring statement to ensure proper key ring configuration and avoid security setup failures. (#4680)
• Updated the cleanup-ipc.mq.sh script to reflect changes in the ipcs command output, ensuring the cleanup process works correctly with the current command format. (#4690)

Zowe Application Framework

zlux-server-framework

• Improved SSH connection performance restoring use of Node.js built-in diffie-hellman logic. (#673)
• The app server no longer prints codes ZWED0036I, ZWED0054I, ZWED0055I, ZWED0062I-68I. These are now only shown in bootstrap or install debug logs, to clean up the job log. (#673)
• Fixed error ZWED0149E from occurring when using AT-TLS. This error did not mean something was wrong, so the message is no longer printed in that condition to avoid confusion. (#673)
• Fixed an issue so that the components.app-server.zowe.network.client.tls.attls property takes first priority instead of the zowe.network.client.tls.attls property. Before the fix, zowe.network.client.tls.attls took first priority. (#673)

zlux-app-server

• Fixed an issue so that the components.app-server.zowe.network.server.tls.attls property takes priority, ensuring the correct setting applies. Before the fix, the zowe.network.server.tls.attls incorrectly took priority over the component-specific components.app-server.zowe.network.server.tls.attls property. (#375)

zlux-app-manager

• Removed the web-browser-app (org.zowe.zlux.ng2desktop.webbrowser) to prevent a vulnerability in its proxy service.(#676)

Zowe Common C

• Fixed zosResolveSymbol() to use the bounded %.*s form of snprintf, that prevents string overreads that can trigger an ABEND and also improve runtime stability. (#595)

Zowe API Mediation Layer

• Restricted caching to items originating exclusively from trusted proxies. (#4706)
• Fixed Server-Sent Events (SSE) data corruption issues. (#4530)
• Resolved an issue preventing all headers from being written in HTTP responses. (#4522)
• Downgraded the domain allowlist enforcement to issue warnings by default in version 2.18.5. (#4733)
• Applied relaxed firewall rules strictly to routed requests (v2). (#4666)
• Standardized the host verification scheme to align with the rest of the Gateway. (#4667)

Zowe CLI

Zowe CLI (Core)

• Updated tar dependency to resolve technical currency. (#2668)

Zowe CLI Imperative Framework

• Removed large dependency pacote for fetching package metadata when installing plug-ins. (#2668)
• Fixed truncation that could occur when the AbstractRestClient request method downloads gzip-encoded data. (#2661)

Zowe Explorer

Zowe Explorer (Core)

• See the Zowe Explorer changelog for updates included in this release.

Zowe Explorer API

• See the Zowe Explorer API changelog for updates included in this release.

Zowe Explorer for IBM z/OS FTP

• See the Zowe® Explorer for IBM® z/OS® FTP changelog for updates included in this release.

Zowe Explorer ESLint Plug-in

• See the Zowe Explorer ESLint Plug-in changelog for updates included in this release.

Vulnerabilities fixed

Zowe discloses fixed vulnerabilities in a timely manner giving you sufficient time to plan your upgrades. Zowe does not disclose the vulnerabilities fixed in the latest release as we respect the need for at least 45 days to decide when and how you upgrade Zowe. When a new release is published, Zowe publishes the vulnerabilities fixed in the previous release. For more information about the Zowe security policy, see the Security page on the Zowe website.

The following security issues were fixed by the Zowe security group in version 2.18.4:

• BDSA-2025-4006
• BDSA-2025-5248
• BDSA-2025-6881
• BDSA-2025-11547
• BDSA-2025-7426
• BDSA-2024-9866
• BDSA-2024-9861
• BDSA-2025-12973
• BDSA-2025-13945
• BDSA-2024-10785
• BDSA-2024-5686
• BDSA-2025-3548
• BDSA-2025-2271