What’s new in Tornado 6.5.9¶

Sep 14, 2026¶

StaticFileHandler no longer follows symlinks outside of the static root directory. Applications that wish to continue the previous behavior may set the new argument allowed_symlink_directory to the directory (an ancestor of the static root) that should be used for symlink validation. Thanks to Yasha-ops and iaohkut-from-NightWolf-Team for reporting this issue.
curl_httpclient has a new max_body_size argument (default 100MB, same as for simple_httpclient). This limit is enforced on all requests, whether or not streaming_callback is used. curl_httpclient now also controls its memory usage when decompressing response bodies. Thanks to afldl, iaohkut-from-NightWolf-Team, and aoto-tech for reporting this issue.
simple_httpclient now correctly applies the max_body_size limit to responses using HTTP/1.0 format (no Content-Length or Transfer-Encoding). Previously it silently truncated such responses at max_buffer_size instead. Thanks to afldl for reporting this issue.
simple_httpclient now rejects responses that use more than 10 100 Continue responses, which could previously cause stack overflow errors. Thanks to afldl for reporting this issue.
The limit ParseBodyConfig.urlencoded.max_argument is now applied to URL arguments in addition to POST bodies. Thanks to iaohkut-from-NightWolf-Team, afldl, and manus-pi for reporting this issue.

.IOStream.read_until_close now reports errors correctly when a stream is closed due to an error or exceeds a memory limit. Previously it would report a successful read of whatever was in the buffer. Connection resets are still treated as a normal close (as they are elsewhere in IOStream), since some platforms report a clean shutdown by the peer this way.