> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.itential.com/itential-gateway/4/release-notes/changelog/2026/9/2/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.itential.com/_mcp/server.

# Gateway 4.4.1

Itential Gateway 4.4.1 is a maintenance release containing two bug fixes and nine security fixes.

#### Bug fixes (2)

| Issue                                                                            | Description                                                                                                                                                                                                   |
| -------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Fixed module discovery cache corruption on concurrent read/write** (ENG-26211) | Fixed an issue where the module discovery cache failed to write non-JSON-serializable date fields and could become corrupted during concurrent reads and writes. The cache now handles these cases correctly. |
| **Fixed audit log persistence failures under concurrent requests** (ENG-26687)   | Fixed an issue where concurrent requests could cause audit log persistence failures due to SQLite database locks. Audit logs now persist correctly under concurrent load.                                     |

#### Security fixes (9)

| Issue                                                                                          | Description                                                                                                                                                                                                           |
| ---------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Resolved interpretation conflict vulnerability in fast-uri and axios** (ENG-26001)           | Upgraded the fast-uri and axios packages to resolve a security vulnerability.                                                                                                                                         |
| **Resolved multiple vulnerabilities in axios** (ENG-26044, ENG-26048, ENG-26049, ENG-26051)    | Updated the axios package to version 1.18.0 to resolve multiple security vulnerabilities, including prototype pollution, resource allocation, and permissive input validation issues.                                 |
| **Resolved integer overflow vulnerability in immutable** (ENG-26133)                           | Updated the immutable package to resolve an integer overflow or wraparound vulnerability.                                                                                                                             |
| **Resolved multiple vulnerabilities in nanoid** (ENG-26401, ENG-26402, ENG-26855)              | Updated the nanoid package to version 3.3.17 to resolve multiple security vulnerabilities, including infinite loop and integer overflow issues.                                                                       |
| **Resolved resource allocation vulnerability in Gateway dependencies** (ENG-26468)             | Updated the nanoid, immutable, js-yaml, brace-expansion, and dompurify packages to resolve Snyk-identified security vulnerabilities.                                                                                  |
| **Resolved use-after-free vulnerability in Gateway dependencies** (ENG-26532)                  | Updated the aiohttp, Werkzeug, requests, and python-multipart packages to resolve a security vulnerability.                                                                                                           |
| **Resolved cross-site scripting (XSS) vulnerability** (ENG-26642)                              | Resolved a cross-site scripting (XSS) vulnerability in a Gateway dependency.                                                                                                                                          |
| **Resolved inefficient algorithmic complexity vulnerability** (ENG-26643)                      | Resolved a security vulnerability related to inefficient algorithmic complexity in a Gateway dependency.                                                                                                              |
| **Resolved multiple vulnerabilities in fast-uri** (ENG-27080, ENG-27081, ENG-27082, ENG-27083) | Updated the fast-uri package to version 3.1.6 to resolve multiple security vulnerabilities, including interpretation conflict, improper URL encoding handling, improper input validation, and double decoding issues. |

#### Component version

| Component           | Version |
| ------------------- | ------- |
| automation\_gateway | 4.4.51  |