Contact us

The Gluon Team

October 2026 Critical Patch Update: Security and Stability Fixes for OpenJFX

Today we are publishing the October 2026 Critical Patch Update (CPU) for OpenJFX. This quarterly release delivers security fixes, updated third-party dependencies, and stability improvements across our current release line and all three active Long-Term Support (LTS) streams: OpenJFX 27.0.1, 25.0.5 (LTS), 21.0.13 (LTS), and 17.0.21 (LTS).

A Major WebKit Update

One of the changes in this release cycle is a WebKit update to version 625.1 in all LTS streams. It also includes the additional fixes from WebKitGTK 2.52.5 and 2.52.6. If you use WebView, this brings a more recent web engine and the security fixes that come with it. We also fixed a WebView crash triggered by document.startViewTransition(), a relatively new web API that more and more sites use.

Updated Dependencies

The following native libraries bundled with JavaFX also got updates:

  • Web: libxml2 updated to 2.15.3. JavaFX 21 and 17 also move to ICU4C 77.1.
  • Media: GStreamer updated to 1.28.3. JavaFX 21 and 17 also move to GLib 2.84.3.

Stability Fixes

  • A memory leak in the Windows media pipeline, where decoded buffers were never released, has been fixed.
  • A crash in the native glass toolkit during Timer shutdown has been resolved.
  • JavaFX 21.0.13 also fixes random characters appearing when pasting from the Windows clipboard.

Security Updates

Alongside these public fixes, this release includes security patches for recently identified vulnerabilities. For details on the security fixes addressed in this cycle, please refer to the release notes.

Release Notes

For the full list of changes, see the JavaFX Release Notes.

Get the Release

All releases, 27.0.1, 25.0.5, 21.0.13 and 17.0.21, can be downloaded from our website or used via the Maven artifacts. These public LTS releases are made possible by our LTS subscribers. Their support funds the engineering work behind every backport and security fix, so the entire JavaFX community benefits. Thank you!

Given the WebKit update and the security fixes in this cycle, we strongly recommend that all teams move production deployments to the appropriate October 2026 CPU release.

End of JavaFX 17 Updates

JavaFX 17.0.21 is the last release of JavaFX 17. If your applications still run on JavaFX 17, now is the time to plan your move to a newer LTS release such as JavaFX 21 or 25. Contact us to discuss your options and how we can help with the migration.

Keep Your JavaFX Applications Secure

Timely, reliable security updates are a core part of Gluon’s stewardship of OpenJFX. If your business relies on JavaFX, we can help:

  1. Gluon LTS Subscriptions: Long-term stability, backported security patches, and direct access to the engineers who lead the OpenJFX project.
  2. Time & Materials Support: Bring OpenJFX maintainers into your team to resolve native crashes, performance issues, or migration hurdles.

Contact the Gluon Team to discuss how we can support your JavaFX deployments.