WireGuard Easy 15.5: AmneziaWG 3.1 Support and Security Fixes
WireGuard Easy 15.5 is out. It is a maintenance-and-security release for the popular web interface that makes running a self-hosted WireGuard VPN simple, and it is worth a close look if you run it on a public server.
The headline change is support for AmneziaWG 3.1, a WireGuard-based protocol designed to be harder to detect with deep packet inspection. The release also updates Node.js to address known vulnerabilities and stops the client details API from returning private keys. On the admin side you get a configurable interface name, trusted proxy settings, richer Prometheus metrics and several fixes. This guide explains each change, what to check before upgrading, and how to harden your installation.
⚡ Quick Summary
- Release: WireGuard Easy 15.5 (tag
v15.5.0), reported on October 24, 2026. - AmneziaWG 3.1: updated AmneziaWG components, including amneziawg-go, for compatibility with the newer protocol version.
- Security: Node.js updated for known vulnerabilities, and the client details API no longer includes private keys in its responses.
- Admin features: custom WireGuard interface name, trusted proxy configuration for reverse proxies, rate-limiting documentation, and peer endpoint data in Prometheus metrics.
- Fixes and extras: IPv6 client endpoints are now bracketed correctly, plus new Swedish and Azerbaijani translations and VoidAuth OIDC documentation.
What is WireGuard Easy?
WireGuard Easy (often written wg-easy) is an open-source tool that lets you create and manage a WireGuard VPN server through a web interface. From the dashboard you can add and remove clients, download configurations and scan QR codes for phones, instead of editing config files by hand.
Version 15 was a ground-up rewrite of the setup process. It added two-factor authentication with time-based one-time passwords for the dashboard, and anyone who had been running it natively outside Docker needed to move to the containerised approach. Release 15.5 builds on that foundation rather than changing it. If you have never deployed it, the official documentation and Linuxiac’s Docker guide linked in the sources are good starting points.
AmneziaWG 3.1 support
AmneziaWG is a modified form of WireGuard that adds traffic obfuscation, so VPN traffic is harder to identify through deep packet inspection (DPI). That helps in networks that block or throttle standard WireGuard. Release 15.5 updates the underlying AmneziaWG components, including amneziawg-go, which improves compatibility with protocol version 3.1.
EXPERIMENTAL_AWG environment variable, and as needing the AmneziaWG kernel module on the host, with fallback to standard WireGuard if it is missing. Settings can change between releases, so confirm the current behaviour in the official docs for 15.5.Client compatibility matters
Obfuscation protocols only work when both ends agree on the version. Amnezia’s own client changelog notes added support for AmneziaWG 3.0 and 3.1 in Amnezia VPN 5.0.1.5, so make sure your client apps are new enough before you roll out 3.1 settings to users.
# Optional: only if you want AmneziaWG (verify in the official docs first)
services:
wg-easy:
image: ghcr.io/wg-easy/wg-easy:15
container_name: wg-easy
environment:
- EXPERIMENTAL_AWG=trueSecurity fixes
🔧 Node.js updated
The developers updated Node.js to address known vulnerabilities in the runtime that powers the web interface.
🔑 No private keys in the API
The client details API no longer includes private keys in its responses, reducing the risk of exposing VPN credentials through API requests.
The second change is the more interesting one for admins. A private key in an API response is a credential sitting in a place logs, proxies and scripts can touch. Removing it limits the damage if someone gains access to an API token or a response is captured.
New admin and configuration features
| Change | What it does | Why it helps |
|---|---|---|
| Custom interface name | You can set the WireGuard interface name instead of using a fixed one. | Useful with multiple interfaces or naming standards. |
| Trusted proxy configuration | Tells the app which proxies to trust when it runs behind a reverse proxy. | Correct client IP and scheme handling behind Nginx, Traefik or Caddy. |
| Rate limiting guidance | The documentation now explains how to configure rate limiting. | Protects publicly reachable logins from brute force. |
| Peer endpoints in Prometheus | Metrics now expose peer endpoint information. | Better visibility into who is connecting from where. |
| IPv6 endpoint fix | IPv6 addresses used as client endpoints are enclosed in brackets. | Prevents malformed endpoints in generated configs. |
| Translations and docs | New Swedish and Azerbaijani translations, plus VoidAuth integration via OpenID Connect docs. | Wider language support and SSO options. |
Many smaller dependency updates and maintenance fixes round out the release. For the complete list, read the official changelog on GitHub.
How to upgrade safely
These steps assume you run WireGuard Easy with Docker Compose, which is the supported route for version 15.
- Check what you run now. Confirm the image tag and look at recent logs.
- Back up your data. Copy the volume or folder that holds your WireGuard Easy configuration before changing anything.
- Read the 15.5 changelog for anything that affects your setup, especially if you use a reverse proxy or AmneziaWG.
- Pull the new image and recreate the container.
- Verify: log in, confirm a test client connects, and check the container logs.
# 1) See which image and recent logs you have
docker inspect wg-easy --format '{{.Config.Image}}'
docker logs --tail=100 wg-easy
# 2) Back up the data directory you mounted (adjust the path)
tar czf wg-easy-backup-$(date +%F).tgz /path/to/wg-easy-data
# 4) Pull and recreate
docker compose pull
docker compose up -d
# 5) Check the logs after the restart
docker logs --tail=100 wg-easy:15, so you stay on compatible v15 releases without jumping to a future major version by accident. Avoid vague tags like latest for a security-sensitive service.Hardening checklist
A VPN management panel is a high-value target, because it can create valid access to your network. After upgrading, walk through this list:
- Enable two-factor authentication for the dashboard (available since version 15).
- Do not expose the web interface openly. Prefer access over the VPN itself, an allow-listed address range, or an authenticating reverse proxy.
- Use the new trusted proxy setting if you sit behind a reverse proxy, so the app sees real client details.
- Add rate limiting in front of the login, following the project’s new guidance.
- Keep the container current. This release exists partly because the Node.js runtime had known vulnerabilities.
- Monitor connections with the Prometheus metrics, which now include peer endpoint data.
- Review and remove old clients you no longer need.
Should you upgrade now?
✅ Upgrade soon if you
- Expose the dashboard or API to the internet
- Run behind a reverse proxy
- Want Prometheus visibility into peers
- Need AmneziaWG 3.1 in restrictive networks
⚠️ Take extra care if you
- Run a custom or modified deployment
- Depend on scripts that read the old API response
- Have older client apps without AmneziaWG 3.1
- Have no recent backup
For most self-hosters the security-related fixes alone justify updating promptly, after a backup. If you use scripts that expected private keys in the client details API, expect them to need changes. More self-hosting and Linux guides are on VMoreCloud.
Sources and further reading
- Linuxiac: WireGuard Easy 15.5 Adds AmneziaWG 3.1 Support, Security Fixes
- WireGuard Easy official documentation
- GitHub: wg-easy v15.5.0 release notes
- Linuxiac: WireGuard Easy v15 launches with full rewrite
- Linuxiac: How to set up WireGuard VPN with Docker
- Amnezia: Amnezia VPN 5.0.1.5 adds AmneziaWG 3.0 and 3.1 support
This article is based on public project documentation and press coverage available on October 26, 2026. Verify settings and commands against the official WireGuard Easy documentation for your version, and always back up before upgrading. Network and VPN regulations differ by country, so use obfuscation tools lawfully.
