# LocalAI v4.12.1 releases security patch for external URL handling

> **Key takeaway:** LocalAI v4.12.1 introduces security hardening for user-supplied URLs to prevent unauthorized access via redirects.

**Published:** 2026-10-23T10:29:51+00:00 
**Source:** LocalAI Open Source Self-Hosted AI 
**Category:** ai-local-edge 
**Canonical URL:** https://fosswire.org/news/localai-v4121-releases-security-patch-for-external-url-handl.html 

## Summary
LocalAI has released patch version 4.12.1, which focuses exclusively on security improvements. The update hardens the external URL policy used for various endpoints, including chat vision and audio/video URLs. This change ensures that redirect targets are validated at every hop to prevent potential exploits.

## Security hardening details
- Redirect targets are now **validated on every hop**.
- The IP ranges **100.64.0.0/10** and **0.0.0.0/8** are now treated as **non-public**.
- Connections are strictly routed to the specific address that was validated.
- The fix addresses vulnerabilities related to user-supplied URLs in image, audio, and video endpoints.