Security bulletinThe release note below contain a CVE for NervesHub. So you don't miss it: Recommend reading the release notes as it should not have any effect on most on-prem installs. But the update has a lot going for it regardless. NervesConf EU wants youIf you have things of at least mild interest to share,
submit to the CFT
. People always underestimate how interesting their work is. We know there are a lot of you out there using Nerves that we've never talked to. We hope you come join us at NervesConf EU and Goatmire Elixir. We are also looking for workshops as part of the CFT. You can look at some of the
currently available workshops
to get an idea of what that entails. And for our US folks. To my knowledge there won't be a NervesConf US this year. So this is the only NervesConf you should expect. The Gig City Elixir organizers have told me they won't be running it this year and the people organizing NervesConf US have moved on to other things. I'd be interested in helping make it happen, another year, under better circumstances. Reach out if that's something you'd like to enable. -Lars Nerves Workshop in MalagaWe like to connect with the community leading up to the major conferences. So we teamed up with the EEF to do an Elixir Unconference and a Nerves Workshop/Hack session in Malaga. Please
read more and sign up
if you'll be there. Website updates!I was doing some cleanup on the website and realized it had some very outdated ideas of what videos and
articles are available. The
video archive
is now reasonably filled out. The
articles section
now has more fun stuff in it. There used to be 2 articles. And
the Newsletter archive
should now be indexed better by Google et.al. Hope that's helpful to you all. For videos and articles, please send PRs if you are missing cool stuff in there. Nerves Meetup EUPaulo Valente, main maintainer of Nx and general numeric mastermind is bringing us a presentation on his embedded-friendly Nx backend based on the Eigen C++ library and more. I've had the pleasure of running it on a client device as part of experimentation with acceleration. It ain't slow :) There will also be social time with breakout rooms and the Meetup is turning into one of my favorite things of the month. A quick shot of community and people always share cool things. Sign up here Nerves @ ElixirConf EUThese are the known Nerves talks: Software updatesNote from the editor: If you read these updates. Please just respond to the email and let me know. It'd be interesting to know how many actually peruse this stuff. We're providing a utility here and it is only meaningful if utilized. We don't track opens so give us a little signal. Nerves Project OfficialSystem updatesnerves_system_br, v1.33.4 This is a security fix release. - Changes
- Temporarily remove Linux license hash checks until upstream Linux license hash updates land. This change works around make legal-info failing when run for v1.33.3 on Linux 6.17 and earlier.
- Package updates
nerves_system_br, v1.33.3 This is a bug and security fix release. Changes - Improve patches involved with getting Cog and Mesa3D to work together. This removes an older patch holding back the Mesa3D version with a Cog-specific fix.
- Patch Weston to support a mouse cursor on Raspberry Pis. This is a minimal patch that won’t be necessary once Weston 15.0.0 is available in Buildroot.
Package updates
Raspberry Pi systems
This is a security update. Changes - Fix crash when showing a mouse cursor on the screen
Package updates
nerves_system_rpi0, v2.0.1 nerves_system_rpi0_2, v2.0.1 nerves_system_rpi, v2.0.1 nerves_system_rpi2, v2.0.1 nerves_system_rpi3, v2.0.1 nerves_system_rpi3a, v2.0.1 nerves_system_rpi4, v2.0.1 nerves_system_rpi5, v2.0.1 kiosk_system_rpi4, v2.0.1 kiosk_system_rpi5, v2.0.1
Other systems
nerves_system_qemu_aarch64, v0.3.2 nerves_system_mangopi_mq_pro, v0.15.2 nerves_system_grisp2, v0.17.2 nerves_system_osd32mp1, v0.24.2 nerves_system_vultr, v0.30.2 nerves_system_x86_64, v1.33.2 nerves_system_bbb, v2.29.2 Other updatesssh_subsystem_fwup, v0.6.6 - Improvements
- Delay notification of exit by 500 ms to allow time for gracefuly closing the ssh connection. This reduces or hopefully prevents the client reporting an error when the upload was successful.
property_table, v0.3.3 - Fixes
- When restoring persistent properties, make sure that any missing properties take on their initialized values if they have them. (@taun-fellowes)
nerves_hub_link, v2.11.1 - Fixed
- Archives can now be downloaded successfully
again.
nerves_hub_link, v2.11.0 - Added
- The network interface used by NervesHubLink.Socket is now reported to NervesHub on connect. The NervesHubLink.Downloader interface is also reported during downloads to identify whether the two components use different interfaces.
circuits_quickstart, v0.15.1 This is a security and bug fix update. - Updates
- Update Nerves systems to `nerves_system_br v1.33.4 (Erlang/OTP 28.4.1, Buildroot 2025.11.2)
nerves, v1.13.2 This release starts a process of modernizing the Nerves tooling. Most updates are behind the scenes so the plan is to roll them out incrementally to minimize the changes per release. This release focused on internal updates to HTTP request handling. - Changes
- Turn off artifact download progress for non-interactive terminals
- Show the .local hostname
with nerves.discover rather than just the hostname. This makes it better for copy/paste use.
- Download artifacts to disk rather than buffering entire contents before writing. This helps memory usage especially for large artifacts.
nerves_livebook, v0.19.0 This updates Livebook to v0.19.4 and brings in security and bug fix updates in many dependencies. nerves_livebook, v0.19.0 This updates Livebook to v0.19.4 and brings in security and bug fix updates in many dependencies. kiosk_example, v0.3.0 This is a major update to the Nerves systems used for this demo that adjusts the on-disk layout. As such, once upgraded, it’s not possible
to downgrade to v0.2.2 without reprogramming the entire MicroSD. - Changes
- Fix hardware cursor issue affecting Mesa3D on Raspberry Pis that would cause Weston to crash when using a mouse. This didn’t affect touchscreen use.
- Update Nerves systems to 2.0.1 versions. See Nerves systems for details, but the main update is that the demo now uses the Raspberry Pi tryboot feature so that early boot issues (like Linux kernel and Erlang boot script crashes) revert to previous good firmware rather than
cycling.
kiosk_demo, v0.3.0 This is a major update to the Nerves systems used for this demo that adjusts the on-disk layout. As such, once upgraded, it’s not possible to downgrade to v0.2.2 without reprogramming the entire MicroSD. - Changes
- Fix hardware cursor issue affecting
Mesa3D on Raspberry Pis that would cause Weston to crash when using a mouse. This didn’t affect touchscreen use.
- Update Nerves systems to 2.0.1 versions. See Nerves systems for details, but the main update is that the demo now uses the Raspberry Pi tryboot feature so that early boot issues (like Linux kernel and Erlang boot script crashes) revert to previous good firmware rather than cycling.
nerves_bootstrap, v1.15.1 This release doesn’t change any functionality. It contains internal changes to break a cyclic dependency
with the :nerves package and help the maintainers. This continues the prep work for bigger future Nerves tooling updates. - Changes
- Check for Nerves Bootstrap updates first (once a day) to avoid running the check after loadpaths removed bootstrap from code paths. This fixes a potential update failure.
- Move private bootstrap API to the NervesBootstrap package. The one call that’s used by older versions of Nerves is still available, but maintained
separately. I.e., nothing should break.
- Added many unit and integration tests
whenwhere, v0.3.0 This release adds a Cloudflare Workers implementation. It works almost identically with the main exception being that the TCP port number of the request isn’t returned in the address field. - Changes
- Clarified nonce field max length to be 31 characters rather than 32 since that’s what’s deployed
- Added REUSE compliance
This release comes with the discovery of CVE-2026-28806 (
read advisory
). During routine development we noticed lacking authorization checks for device bulk actions. Investigating it we found that it did allow a user to take actions on devices outside of their organization by manipulating the client-side of the application. As part of this we also discovered an API endpoint that exposed an equivalent privilege escalation and ability to escape the scope. If you run NervesHub for only your organization this issue may not affect you at all or would likely have low impact. It is privilege escalation and a tenancy violation. This is significantly more important to a multi-organization system such as NervesCloud. You should still update immediately since this may give unintended access to people in your organization. The bulk action issue goes back to 2021 and is present in NervesHub 1.x as far back as bulk actions have existed. The API issue is more recent during a rework of the API endpoints. Details are in the CVE references. Of course this has made us look very carefully at the structure of authorization and access in NervesHub. What we found was a lack of structure which increases the risk of
introducing issues like this. In preparation for the CVE fixes we introduced a scoping mechanism to have a consistent way of passing around authorization scopes. This makes it more obvious when authorization is being checked and reduces the risk of introducing new issues. We have branches and PRs in the wings for enforcing authorization checks in LiveViews and API endpoints. Those should land shortly as well. We take security very seriously. Finding a serious problem is never fun. Not finding it is significantly worse. This was discovered by us, fixed by us and released by us. We are thankful to the Erlang Ecosystem Foundation’s CNA for their great help in the CVE process. If you discover flaws in your Elixir project we highly encourage you to learn the correct process and the EEF CNA will help you through it. Themes- New UI Completion
: Removed old UI entirely, implemented remaining pages in the new design
- Deployment Releases
: Improved release management significantly with new releases concept
- Sentry Improvements
: Upgraded to Sentry 12, added opt-in logging and tracing support
- Device Network Info
: Store and display device network interface data, still
needs work in nerves_hub_link
- Code Quality
: Enforced Credo in CI, consolidated tests, removed dead code
Community projectsWatch out for the
massive
AtomVM release. I usually edit massive changelogs but AtomVM doesn't release very often so let's enjoy it :) bb_servo_robotis, v0.2.2 - controller: replace message-based writes
with ETS-backed fixed-rate control loop (#21) by James Harton
bb_servo_feetech, v0.2.2
AtomVM, v0.7.0-alpha.0
This is an alpha release
, the first pre-release on the road to v0.7.0. It represents over two year of development and introduces several groundbreaking features. While we have taken care to test thoroughly, APIs may still evolve before the stable release. If you need maximum stability for production deployments, we recommend staying on
v0.6.x
. That said, we encourage you to try v0.7.0-alpha.0 and
report any issues
you encounter, your feedback is invaluable in shaping the stable release. OTP-28 and OTP-29 are now supported.
This is a major improvement over v0.6.6 which did not include OTP-28 support. On macOS,
Homebrew
and
MacPorts
default to OTP-28 or later, so this
release works out of the box with default system installations. You can use
asdf
or
mise
to manage multiple Erlang/OTP versions if needed. Please read
the getting started guide
for flashing instructions. HighlightsDistributed Erlang AtomVM now supports the Erlang distribution protocol, allowing AtomVM nodes running on microcontrollers to connect to standard BEAM nodes or other AtomVM instances via message passing. This release includes: - A pure Erlang erl_epmd client implementation
- Support for external pids, ports, and refs in external terms
- Remote shell support (with the
necessary io and io_lib functions)
- Cookie-based authentication
- The distribution protocol supports alternative transport carriers beyond TCP/IP, opening up communication paths specific to embedded systems
This enables powerful use cases: debugging an MCU directly from a standard OTP shell, coordinating multiple microcontrollers via message passing, and building mixed clusters of BEAM and AtomVM nodes. TLS distribution is not yet available. JIT Compilation and Multiple Execution Modes AtomVM now supports four execution strategies: - Emulated
- interprets BEAM bytecode (default, small and portable)
- JIT
- runtime compilation to native code
- Native (AoT)
- pre-compiled native code deployment
- Hybrid
- native code with bytecode fallback for unsupported opcodes
The JIT compiler is itself written in Erlang. Supported JIT architectures include RISC-V32, ARM v6-M (Cortex-M0+), x86_64, and aarch64. Big Integer Support AtomVM now supports integers up to 256-bit (sign + 256-bit magnitude). All arithmetic operations (+, -, *, div, rem, abs, etc.) and all bitwise operations (band, bor, bxor, bnot, bsl, bsr) work with big integers. Serialization via binary_to_term/1 and term_to_binary/1,2 is also supported. Cryptographic Operations A comprehensive crypto module has been added: - Key generation and exchange (crypto:generate_key/2, crypto:compute_key/4)
- Digital signatures
(crypto:sign/4, crypto:verify/5)
- Streaming hashes and MACs (crypto:hash_init/update/final, crypto:mac_init/update/final)
- AEAD encryption (crypto:crypto_one_time_aead)
- PBKDF2 key derivation (crypto:pbkdf2_hmac/5)
- Ed25519 support via optional libsodium integration (AVM_USE_LIBSODIUM=ON)
ETS A limited but functional implementation of the OTP ets interface is now available, including support for set, bag, and duplicate_bag table types with operations such
as insert, lookup, delete, member, update_counter, update_element, and more. Expanded Hardware Support - ESP32C5 and ESP32C61
: initial support for these new Espressif chips
- ESP32P4 WiFi
: WiFi connectivity via esp-wifi-external (requires ESP-IDF v5.4+)
- 10 new STM32 families
: enabled by switching to the official ST HAL/LL SDK
- ESP-IDF v5.5
: release images are now built with ESP-IDF v5.5
Elixir Improvements - Native GenServer and Supervisor support
- Added Function.ex and Protocol.ex for improved Elixir 1.18 support
- Process.link/1 and Process.unlink/1
- Base64 encode/decode functions in the Base module
- ESP32 builds can now enable Elixir support with a simple cmake flag: -DATOMVM_ELIXIR_SUPPORT=on
WebAssembly AtomVM’s Emscripten/WASM port continues to improve. Pre-built binaries are available for both Node.js and browser environments. This release powers projects like Popcorn, which runs Elixir directly in the browser, including the Elixir Language Tour. POSIX File and Directory Operations New POSIX functions for file I/O (seek, pread, pwrite, fsync, ftruncate, rename, stat, fstat) and directory operations (mkdir, rmdir) are now available on supported platforms. Upgrade NotesIf upgrading from v0.6.x,
please review the
UPDATING.md
file. Key changes: - Entry point change
: init:boot/1 is now used as the entry point if it exists. It automatically starts the kernel application and calls start/0 from the identified startup module. Users who were manually starting the kernel application (typically for distribution) must stop doing so. Starting net_kernel is still required.
- Ports replace pids for native processes
: Port
drivers should now return ports instead of pids. Socket matching code may need to change from is_pid/1 to is_port/1.
- bsl overflow checking
: Bitshift left now checks for overflows. Mask values before shifting: e.g. (Value band 0xF) bsl 252.
- binary_to_integer/list_to_integer
: No longer raise overflow: they raise badarg when the result exceeds 256 bits.
- ESP32 Elixir builds
: Can now be configured with idf.py -DATOMVM_ELIXIR_SUPPORT=on set-target ${CHIP} instead of copying partition files.
- C API
: The externalterm module
has been renamed to external_term with a completely new API.
- Removed
: The deprecated network_fsm module has been removed.
Pre-built BinariesPre-built binaries are available for download from this release page: - ESP32
: flashable images for esp32, esp32c2, esp32c3, esp32c5, esp32c6, esp32c61, esp32s2, esp32s3, esp32h2, and esp32p4 (standard and Elixir flavors)
- Raspberry Pi Pico
: UF2 firmware for pico, pico_w, pico2, and pico2_w (including RP2350 RISC-V variants)
- WebAssembly
: JS+WASM bundles for Node.js and browser environments
All binaries include SHA256 checksums for verification. Added- Added a limited implementation of the OTP ets interface
- Added code:all_loaded/0 and code:all_available/0
- Added erlang:loaded/0
- Added erlang:split_binary/2
- Added inet:getaddr/2
- Added support for external pids and encoded pids in external terms
- Added support for external refs and encoded refs in external terms
- Introduce ports to represent native processes and added support for external ports and encoded ports in external terms
- Added atomvm:get_creation/0, equivalent to erts_internal:get_creation/0
- Added menuconfig option for enabling USE_USB_SERIAL, eg. serial over USB for certain ESP32-S2 boards etc.
- Partial support for erlang:fun_info/2 and erlang:fun_info/1
- Added support for registered_name in erlang:process_info/2 and Process.info/2
- Added net:gethostname/0 on platforms with gethostname(3).
- Added socket:getopt/2
- Added supervisor:terminate_child/2, supervisor:restart_child/2 and supervisor:delete_child/2
- Added
support for ‘erlang:–/2’.
- Added esp:partition_read/3, and documentation for esp:partition_erase_range/2/3 and esp:partition_write/3
- Added support for list insertion in ‘ets:insert/2’.
- Support to OTP-28
- Added atomvm:subprocess/4 to perform pipe/fork/execve on POSIX platforms
- Added erl_epmd client implementation to epmd using socket module
- Added support for socket asynchronous API for recv, recvfrom and accept.
- Added support for UDP multicast with socket API.
- Added support for ets:update_counter/3 and ets:update_counter/4.
- Added erlang:+/1
- Added lists:append/1 and lists:append/2
- Added erlang:spawn_monitor/1, erlang:spawn_monitor/3
- Added lists:dropwhile/2.
- Support for float/1 BIF.
- Added erlang:get/0 and erlang:erase/0.
- Added erlang:unique_integer/0 and erlang:unique_integer/1
- Added support for ‘ets:delete/1’.
- Added lists:flatmap/2
- Added io:fwrite/1,2,3 and io:format/3 as well as few io functions required by remote shell
- Added code:is_loaded/1 and code:which/1
- Added several io_lib functions including io_lib:fwrite/2 and io_lib:write_atom/1
- Added init:get_argument/1, init:get_plain_arguments/0 and init:notify_when_started/1
- Added application:get_env/2
- Added CodeQL analysis to esp32, stm32, pico, and wasm workflows
- Added Function.ex and Protocol.ex improving Elixir 1.18 support
- Added WiFi support for ESP32P4 via esp-wifi-external for build with ESP-IDF v5.4 and later
- Added Process.link/1 and unlink/1 to Elixir Process.ex
- Added erlang:module_loaded/1
- Added binary:longest_common_prefix/1
- Added binary:replace/3, binary:replace/4
- Added binary:match/2 and binary:match/3
- Added supervisor:which_children/1 and supervisor:count_children/1
- Added monitored_by in process_info/2
- Added mock implementation for current_stacktrace in process_info
- Added erlang:list_to_bitstring
- Reimplemented lists:keyfind, lists:keymember and lists:member as NIFs
- Added AVM_PRINT_PROCESS_CRASH_DUMPS option
- Added lists:ukeysort/2
- Added support for big integers up to 256-bit (sign + 256-bit magnitude)
- Added support for big integers in binary_to_term/1 and term_to_binary/1,2
- Added proc_lib
- Added gen_server support for timeout tuples in callback return actions introduced in OTP-28.
- Added sys
- Added esp:timer_get_time/0
- Added esp_dac module, exposing DAC oneshot mode on ESPs that support it
- Added support for resource managed binaries (enif_make_resource_binary)
- Added initial support for ESP32C5 and ESP32C61
- Added Range:size/1
- Added missing ledc functions for esp32 platform
- Added support for Elixir GenServer and Supervisor.
- Added
support for 10 new STM32 families by switching to STM32 official SDK
- Added network:sta_connect/0,1 and network:sta_disconnect/0 to ESP32 network driver.
- Added option to set a custom callback for esp32 network driver disconnected events
- Added network:sta_status/0 to get the current connection state of the sta interface.
- Added ESP32 -DATOMVM_ELIXIR_SUPPORT=on configuration option
- Added support for ESP32 development builds to include NVS partition data at build time
- Added
missing inet functions: ntoa/1, parse_address/1, parse_ipv4_address/1, parse_ipv4strict_address/1
- Added support for new is_integer/3 BIF, introduced with OTP-29
- Support for OTP-29
- Added base64:encode/2 and base64:decode/2 functions, that take in addition also a map with encoding/decoding options, also Elixir (url_)encode64/(url_)decode64 have been added to Base.
- Added nanosecond and native time unit support to erlang:system_time/1, erlang:monotonic_time/1, and calendar:system_time_to_universal_time/2
- Added erlang:system_time/0, erlang:monotonic_time/0, and os:system_time/0,1 NIFs
- Added filename:join/1 and filename:split/1
- Added crypto:generate_key/2, crypto:compute_key/4, crypto:sign/4 and crypto:verify/5
- Added crypto:hash_init/1, crypto:hash_update/2 and crypto:hash_final/1
- Added crypto:crypto_init/3, crypto:crypto_init/4, crypto:crypto_update/2 and crypto:crypto_final/1
- Added crypto:crypto_one_time_aead/6 and crypto:crypto_one_time_aead/7
- Added crypto:pbkdf2_hmac/5 and crypto:hash_equals/2
- Added crypto:mac/4, crypto:mac_init/3, crypto:mac_update/2, crypto:mac_final/1 and crypto:mac_finalN/2
- Added crypto:info_lib/0
- Added erlang:crc32/1, erlang:crc32/2 and erlang:crc32_combine/3
- Added support for Ed25519 curve when libsodium support is enabled at build time (AVM_USE_LIBSODIUM=ON)
- Added support
for bag and duplicate_bag table types in ets
- Added ets:insert_new/2, ets:member/2, ets:lookup_element/4, ets:delete_object/2, ets:take/2, ets:update_element/3 and ets:update_element/4
- Added POSIX file functions: atomvm:posix_seek/3, atomvm:posix_pread/3, atomvm:posix_pwrite/3, atomvm:posix_fsync/1, atomvm:posix_ftruncate/2, atomvm:posix_rename/2, atomvm:posix_stat/1, atomvm:posix_fstat/1
- Added POSIX directory functions: atomvm:posix_mkdir/1, atomvm:posix_rmdir/1
Changed- Release images for ESP32 chips are built with ESP-IDF v5.5
- Only support ESP32P4 on ESP-IDF v5.5.2, v5.4.4 and later.
- ESP32: SPI peripheral defaults to "spi2" instead of deprecated hspi
- Added zlib:compress/1
- Entry point now is init:boot/1 if it exists. It starts the kernel application and calls start/0 from the identified startup module. Users who started kernel application (typically for
distribution) must no longer do it. Starting net_kernel is still required.
- All arithmetic operations (+, -, *, div, rem, abs, etc.) now support integers up to 256-bit
- All bitwise operations (band, bor, bxor, bnot, bsl, bsr) now support integers up to 256-bit
- Float conversion functions now support converting to/from big integers
- bsl now properly checks for overflow
- binary_to_integer/1 no longer accepts binaries such as <<"0xFF">> or <<" 123">>
- binary_to_integer and list_to_integer do not raise anymore overflow error, they raise instead badarg.
- Resources are now references instead of empty binaries.
- Badarg error return from calling crypto:crypto_one_time with invalid arguments now matches OTP24+.
- When function head doesn’t match, function arguments are now in stacktrace
- Function arguments are added to stacktrace also for some NIFs, when one of the arguments is badarg
- Using a custom callback for STA disconnected events in esp32
network driver will stop automatic re-connect, allowing applications to use scan results or other means to decide when and where to connect.
- ESP32 cmake build options are now also exposed in idf.py menuconfig.
- ESP32 Elixir support is determined automatically from the offset of boot.avm in the partition table.
- ESP32 ports now flash a complete working image using the idf.py flash task.
- ESP32 platform now uses reproducible builds.
- C API: externalterm module was renamed to external_term and it has a completely new API
Fixed- ESP32: improved sntp sync speed from a cold boot.
- Fixed gen_server internal messages to match OTP so it works across erlang distribution
- Utilize reserved phy_init partition on ESP32 to store wifi calibration for faster connections.
- Support for zero count in lists:duplicate/2.
- packbeam: fix memory leak preventing building
with address sanitizer
- Fixed a bug where empty atom could not be created on some platforms, thus breaking receiving a message for a registered process from an OTP node.
- Fix a memory leak in distribution when a BEAM node would monitor a process by name.
- Fix list_to_integer, it was likely buggy with integers close to INT64_MAX
- Added missing support for supervisor one_for_all strategy.
- Supervisor now honors period and intensity options.
- Fix supervisor crash if a one_for_one child fails to
restart.
- Fix collision in references created with make_ref/0 on 32 bits platforms.
- Fixed a bug in OP_BS_CREATE_BIN
- Fix re-raise behavior by implementing erlang:raise/3 3rd argument support
Removed- Removed deprecated network_fsm
You can buy an official Nerves shirt from
oswag
. Fair trade, organic and high-quality. Family-scale business. Got questions?Trouble-shooting is best done on
the Nerves Forum
over at Elixir's Forum. But if you have big-picture questions you would like to ask around Nerves, feel free to send them in and we might just have ourselves a column here. How you can help NervesContribute in the way that works for you: - Send corrections or improvements for documentation wherever it fails to help you.
- Write about Nerves, give talks about Nerves. Make videos about Nerves. It is all good.
- Write or port a new hardware library and include it in
the Elixir Circuits collection
.
- Get in touch about taking over maintenance duties for some libraries, we might be able to provide you hardware.
- Apply for an EEF stipend
on something Nerves-related and build it. We can help if you have questions about this.
Finally, if you have questions about the newsletter or want to suggest something you can simply respond to this email. - Lars |