TYPO3 14.3.6—What’s Changed?

Released: August 11, 2026
Update type: Security release

TYPO3 14.3.6 is a security release that addresses a critical XSS vulnerability enabling local Fetch/XHR-based request forgery. This release also includes numerous bug fixes and improvements across editing, backend administration, and technical infrastructure, including enhanced session handling, database compatibility updates, and UI refinements.

Security Fixes

  • XSS-based Request Forgery Prevention — Prevents local Fetch/XHR-based request forgery attacks via cross-site scripting vulnerabilities.
  • File Dump Token Security — Ensures file dump tokens are created with SHA3–256 everywhere for improved security.
  • Failed Login Announcement — Failed login attempts are now announced when an invalid request token is detected.

Editing & UX Improvements

  • Sticky Headers in Backend — The docheader navigation row and language header in comparison view now remain sticky for better navigation.
  • Dark Mode Support — Backend error messages now properly support dark mode.
  • Upload Progress Bar — Fixed positioning of the upload progress bar for better visibility.
  • Form Editor Enhancements — Improved form editor with proper scalar map key handling and limited markup support in inspector labels.
  • Live Search Results — Files are now included in live search results for easier discovery.

Backend & Administration

  • Session Cookie Decoupling — Session cookie emission is now decoupled from user authentication for improved flexibility.
  • Page Access Permissions — Page access checks now properly include create permissions.
  • User Settings Respect — Disabled and overridden User Settings fields are now properly respected.
  • Dashboard Creation Migration — Dashboard creation has been migrated to the backend wizard.
  • Record Browser Language Filter — The record browser no longer incorrectly inherits the module language filter.
  • Workspace Language Synchronization — Enhanced workspace handling of language synchronization.

Technical Changes

  • Database Compatibility Updates — Added support for MariaDB 11.4+ and latest PostgreSQL versions with proper platform detection.
  • Dependency Updates — Updated DOMPurify to 3.4.13, PHPUnit to 11.5.56, PHPStan to 2.2.6, and various Guzzle dependencies.
  • Doctrine DBAL Improvements — Enhanced Doctrine introspection API usage and streamlined identifier quoting.
  • PSR Clock Dependency — Promoted psr/clock to an explicit core dependency.
  • PHP 8.6 Support — Execution with PHP 8.6 is now allowed in runTests.sh.
  • Extbase Query Improvements — Fixed identifier quoting in new Extbase QoM methods and improved translation handling.
  • Messenger Improvements — Wildcard routes are now properly treated as fallback and the AsMessageHandler transport property is honored.