Changelog

11.1.9 runs every jambonz component on Node.js 24.22.1, which stops trusting the compromised eMudhra certificate authority keys and fixes several TLS vulnerabilities (details below). It also adds Mistral Voxtral 3 as a speech-to-text and text-to-speech vendor and reports LLM token usage for agent calls, per turn and per call. Agents can now switch their text-to-speech language with any multilingual recognizer, recognizer hints reach Deepgram Nova-3, Flux and AssemblyAI as keyterms, and carrier X- headers are passed to your application when an outdial fails or the far end hangs up. The release also fixes unanswered calls that could stay in trying, unanswered DTMF-relay INFO requests, a feature-server mute that silenced the whole call, and RTP port reuse that could leak late audio from a finished call into a new one. More secrets are masked in logs. This entry covers 11.1.8 as well, which was not released separately.

Security: eMudhra CA compromise and Node.js TLS fixes

Keys belonging to eMudhra intermediate certificate authorities were compromised, so a TLS certificate chaining to them can no longer be trusted. Node.js’s October 21, 2026 security releases remove that trust from Node.js’s bundled certificate store, and fix several other vulnerabilities, including TLS hostname verification bypasses.

jambonz runs its applications on Node.js. 11.1.9 pins every place Node.js comes from to 24.22.1, the Node.js 24 release that contains these fixes:

• AWS, GCP and Azure images install Node.js 24.22.1, which runs every jambonz application on the host.
• Debian packages — jambonz-mini now installs Node.js 24.22.1. Earlier packages used Node.js 22.
• Docker images for Kubernetes deployments are built on node:24.22.1-alpine instead of the floating node:24-alpine tag; every 11.1.9 application image runs Node.js v24.22.1.
• Each application declares engines.node >= 24.22.1.

Upgrading: an existing deployment keeps the Node.js it was built with. Redeploy from the 11.1.9 images (AWS CloudFormation, GCP or Azure terraform), or upgrade the Debian packages (apt-get update && apt-get upgrade jambonz-mini). If you cannot redeploy right away, upgrade Node.js on each host to 24.22.1 or later.

New Features & Improvements

1. Mistral Voxtral 3 — mistral is available as a speech-to-text and text-to-speech vendor, with speech credentials in the portal and API. Recognizer options include verbatim transcription, and gather sends an early speechDetected event. See Mistral.
2. LLM token usage — agent calls report the tokens the LLM used, including cache reads and writes. Each turn in the session data carries its own usage, the call carries a total, and the agent actionHook receives the call’s usage. The portal’s recent-calls view shows token usage per agent turn.
3. Text-to-speech follows the detected language — autoLockLanguage now works with every recognizer that reports the language a caller spoke: AssemblyAI, Soniox, Google (Cloud Speech and Gemini), Azure, Gladia and Modulate, as well as Deepgram. For Azure, mediajam now runs continuous language identification when altLanguages is set.
4. Hints as keyterms — recognizer hints are sent as keyterms to Deepgram Nova-3 and Flux and to AssemblyAI, which do not support word boosting. Previously the hints were dropped or rejected.
5. Carrier X- headers — when an outdial fails, the final call status callback carries the response’s X- headers as sip_x_headers (for example X-Twilio-Error), and the completed event carries the X- headers from a BYE.
6. Dial music — dialMusic on the dial verb now loops until the call is answered on inbound calls too, where it previously played once. A source that fails to play stops the music instead of being retried every second.
7. Credential testing with account API keys — an account-level API key can now test LLM and speech credentials.

Bug Fixes

• Unanswered calls — when an application ended an inbound call that was still in early media, the call was rejected without a call status event, so the application only ever saw trying. A failed status is now sent with the SIP status. A call whose media endpoint could not be created is now ended instead of staying in trying, and verbs the application queued are kept.
• DTMF relay — without a sipRequestWithinDialogHook, in-dialog INFO requests carrying DTMF were never answered, so the SBC retransmitted each one until the call ended. They are now answered with 200 OK.
• Mute — a feature-server mute or unmute on rtpengine 14 blocked the whole call instead of one direction. It is now directional again.
• RTP ports — mediajam handed out the most recently released port first, so late RTP from a finished call could arrive on the next call. Ports are now allocated round-robin.
• Dial — a dial that ended on its ring timeout was reported as error instead of no-answer.
• Agents — the hangup tool waits for the goodbye prompt to finish playing; an aborted LLM prompt is no longer treated as a failure; handoff tool calls are recorded in the turn’s tool_calls; and the LLM no longer continues during a handoff transfer.
• SBC registration — the transport is stored on the registered proxy for TCP and TLS clients.
• Security — verb credentials, OAuth tokens and secrets in logged webhook and websocket URLs are masked in logs. Webhook passwords are write-only in REST responses. drachtio no longer logs credentials. For the Node.js TLS fix, see Security: eMudhra CA compromise above.
• Account management — fixes for billing (half-deleted accounts, orphaned subscriptions and a legacy price item), for changing the authentication method, which could orphan enterprise users, and for email activation, which could delete other users.
• Database upgrade — tables created by an upgrade now inherit the database charset.

Upgrade Notes (self-hosted)

• Database — 11.1.8 and 11.1.9 make no schema changes; the upgrade only records the new version.
• Webhook passwords — the REST API no longer returns webhook passwords. Clients that read a password back must keep their own copy.

Component Versions

Availability

jambonz.cloud - coming soon

self-hosted on GCP - images for all nine variants (mini, fs, sip-rtp, sip, rtp, web, monitoring, web-monitoring, recording), amd64 and arm64, are public in drachtio-cpaas. GCP images are global. The terraform examples in terraform/gcp/provision-vm-{mini,medium,large} pin the 11.1.9 images.

self-hosted on AWS - AMIs for all nine variants, amd64 and arm64, are public in 30 regions, with public snapshots so generate-cf.sh can copy them into your account. The CloudFormation AMI mappings point at the 11.1.9 AMIs.

self-hosted on Azure - images for all nine variants are in the jambonz community gallery (jambonz-8962e4f5-da0f-41ee-b094-8680ad38d302): amd64 replicated to 30 regions, arm64 to 29. The terraform in terraform/azure/provision-vm-{mini,medium,large} defaults to 11.1.9.

self-hosted Debian packages - jambonz-mini 11.1.9 installs from the jambonz bookworm apt distribution on amd64 and arm64, with Node.js 24.22.1.