> For the complete documentation index, see [llms.txt](https://docs.apryse.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.apryse.com/web/changelogs/webviewer-server/server-changelog-2025.md). # WebViewer Server 2025 Changelog Check out our Changelog for WebViewer Server 2025. ### 3.1.0 - February 18th * Updated Apache Tomcat to 10.1.52 * Updated Apryse SDK to 11.11 * Updated CAD Module to 11.11 * \[Security] The WebViewer Server option TRN\_ALLOWED\_DOMAINS has had its default value changed. Previously, it defaulted to a wildcard allowing all domains. Now, by default, no domains are allowed for security reasons. For more information please review our [documentation](/web/webviewer-server/wv-server-config.md#whitelist-domains-for-file-fetches). * \[Security] Added URL checking within HTML docs to prevent SSRF attacks via src or href entries. * \[Cloudformation] Updated Nodejs version used in the Cloudformation template to Nodejs 24. * Added improved handling around corrupt outlines in PDF documents. ### 2.4.1 - November 26th * Updated to Apache Tomcat 10.1.49 * Updated to Apryse SDK 11.9. * Fixes regression where strong ETags were lost in version 2.4.0, this could cause intermittent browser errors. * Adds missing mime-type mappings, users may experience intermittent and browser based issues without this fix. * Improved annotation load speed when working with documents with a large amount of annotations. ### 2.4.0 - October 8th * Updates Apryse SDK to 11.8. * Updates Apache Tomcat to 10.1.46 * This version includes a restructuring of how we build the product. Previously, we used Apache Tomcat separately and included our JAR files and configuration files, but now we build the product using embedded Apache Tomcat directly. To assist with this change, we've included a [migration guide](/web/get-started/faq/2-4-0-migration-guide.md) that includes changes compared to the previous version. * Improved the option `TRN_STRIP_URLS`to remove more identifying data. * Added new option `TC_TARGET_PATH` and `TRN_BIN_DIR` which control where the server looks for the .jar, .war, and accessory library files. * Corrected problem where the websocket could corrupt incoming data and cause a connection to fail. * Fixed issue where the timeout aspect of the internal health check did not fail even though the check had timed out. * Fixed issue where `TRN_DISABLE_JSESSION` did not work as expected. By default the option was disabled. * Fixed issue where the server could follow redirects excessively. * Fixed issue where Office document display comments did not show. * \[Windows Installer] Improved permission and file management in Windows installer. The application now writes to `C:/ProgramData/Apryse` instead of the install directory, allowing for more permissive setups. * \[Windows Installer] The service setup is no longer optional, as this sets up some basic requirements for the server. ### 2.3.8 - August 20th * Updates Apryse SDK to 11.7 * Updates Apache Tomcat to 10.1.44 * Fixes some issues with *malformed JSON* errors when experiencing a high frequency of requests. These would cause occasional requests to the server to fail at high load. * Fixes issue with health check where it may not always accurately represent the server. The server should now react within 5 seconds of experiencing critical failures. This is most noticed when the server is caught in an inoperable state but still reporting 200 for its health check. * Corrects erroneous null return from the GetPerfInfo API. ### 2.3.7 - July 9th * Update to SDK 11.6 * Update to Apache Tomcat 10.1.43 * \[Windows] Updated LibreOffice to 25.2.4 * Update for CAD conversion modules ### 2.3.6r2 - June 19th * Fixes issue where clicking the `Download` button in WebViewer could fail on some systems ### 2.3.6 - May 28th * Updated Apryse SDK to 11.5 * Updated Tomcat to version 10.1.41 * Published a stable Linux ARM64 version of the Docker container * **pdftron/webviewer-server:arm64-latest** * Fixed issue where weak E-tags could cause random failures on Chrome when using WebViewer. * \[Windows] Fixed issue where the installer created Windows service would not listen to stop commands without timing out. * \[Security] Addressed remote execution exploit with cache keys, these are now limited to alphanumeric characters, underscores and dashes. * \[Security] Addressed remote execution exploit with the AuxUpload API, this is now limited to only XFDF uploads. * \[Security] Addressed remote execution exploit with the internally restricted folder. * Improved internal heartbeat mechanism for better recovery on document crashes * Removed old annotation functionality causing noise via error messages ### 2.3.5 - April 9th * Updated Apryse SDK to version 11.4 * Updated Tomcat to version 10.1.40 * Updated the Apryse CAD Module * Fixed issue with authentication and converting HTML documents when using **TRN\_ENABLE\_SESSION\_AUTH** * Fixed remote execution security issue if using `cacheKey` to load documents. The cacheKey option now only works with alphanumeric characters, underscores and hypens. * Fixed security vulnerability with SVG documents being able to access a limited amount of local files on the server * Created the new Linux ARM experimental build for WebViewer Server at the DockerHub repository `pdftron/webviewer-server:nightly_arm64_experimental` ### 2.3.4 - March 4th * \[Windows] Fixes issue where in some situations the server would crash every 30 seconds due to a failed Windows API call. * \[Windows] Fixes issue where the server would fail when called as a Windows Service in some machines. * \[Windows] Updates OpenJDK 17.0.7\_7 to the Windows OpenJDK 17.0.14+7 ### 2.3.3 - February 19th * Updated Apryse SDK to version 11.3 * Updated Tomcat to 10.1.35 * Prevents rare issue which put the worker into a Heartbeat Exception loop, preventing the server from functioning. * Fixes issue when used with WebViewer that can cause non-90 degree rotations to not be respected when the output is downloaded from the server ### 2.3.2 - January 8th * Updated Apryse SDK to version 11.2 * Updated Tomcat to 10.1.34 * Updated HTML2PDF for 11.2 * Updated CAD2PDF for 11.2 * \[Security] Fixes security vulnerability involving external APIs (GetThumb, GetPDF) and passing a local file to gain access to files within the server. The access was restricted to the path `/usr/local/apache-tomcat` and only to formats supported by WVS. * Fixes issue with previous release where the `csv` format was not converting as expected. * Fixed an error where WebViewer Server was not considering cgroup memory limits while determining whether memory needed to be cleared. This could effect systems using container limits via Docker, Podman or Kubernetes. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.apryse.com/web/changelogs/webviewer-server/server-changelog-2025.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.