OpenTofu v1.12.8 Fixes HTTP2 CPU Issue in tofu init

OpenTofu v1.12.8 landed on October 14 2026 as a small patch release. The headline item is a security advisory: earlier versions could hit excessive CPU usage when tofu init connected to an attacker controlled HTTP2 server while installing dependencies. There is one bug fix on top.

The full release notes and downloads are on the GitHub release page.

The HTTP2 security advisory

The advisory, tracked in #4700, describes a case where a connection to an attacker controlled HTTP2 server could cause excessive CPU consumption. The trigger path is tofu init installing dependencies, meaning provider or module downloads. If your init runs against registries or proxies you do not control, this release is worth applying.

Destroy lifecycle crash fixed

The single bug fix, #4648, stops a crash in lifecycle destroy. The crash happened when the destroy lifecycle block contained an expression with references. Configs with precondition or postcondition style expressions referencing other values could hit this during destroy. If you have seen a crash during a destroy plan or apply, v1.12.8 is the version to test against.

Not a prerelease

This is a stable patch release, not a beta or release candidate. It carries no new features, only the advisory fix and the crash fix. That makes the risk of upgrading low for anyone already on the 1.12 line.

Where to get it

← All updates