v1.4.6

Security

• Fixed Privilege Escalation (#1, CWE-276 / CWE-732). The NSIS installer now uses per-machine install — NexVPN lives in %ProgramFiles%\NexVPN\ instead of %LocalAppData%, so an unprivileged process can no longer swap sing-box.exe / xray.exe / nexvpn.exe between elevated TUN-mode launches.

UI

• Server names that ship with regional-indicator emoji (🇫🇮, 🇩🇪, etc.) no longer render as bare letters on Windows. The emoji are stripped from text and the country is shown via the bundled SVG flag instead. Affects the home server list, status panel, top connection badge, quick-connect, stats and history.
• Status panel and top connection badge now show a country flag next to the server name when connected.

Note

The portable zip is, by definition, writable by whoever has access to the folder. If you use it, keep it somewhere only you control.

v1.4.5

Bug fixes

• Fixed: refreshing a subscription while connected no longer wipes the server name from the status panel.
• Hysteria2 / TUIC servers now show real ping. Probe sends a QUIC Version Negotiation packet instead of a TCP connect, which silently failed for UDP-only protocols.

New

• "Update all" button for subscriptions (shown when more than one is configured).
• Portable Windows build: NexVPN_1.4.5_portable_x64.zip — no installer, runs from any folder.
• Server list updates ping results as each server responds instead of waiting for the full batch.

Internal

• GitHub Actions build Windows, macOS and Linux releases automatically on tag push.

v1.4.4

• Xray-core native Hysteria2 support
• TUN QUIC bypass fix (server IP pre-resolved and routed direct)
• Happ-compatible User-Agent toggle in settings
• Happ-style JSON subscription parser for all protocols
• Server cards show transport + security stack badge
• Fixed selected server visibility on minimal/glassmorphism themes

v1.4.3

• TUN mode now works with Xray core on desktop (sing-box runs as TUN bridge in front of Xray)
• App-wide logger: all Rust logs now visible in UI App tab
• Fix Android build cfg-gate

v1.4.2

What's New

Bugfixes

• macOS: confirm dialogs now work (replaced window.confirm with custom modal)
• Android: subscription card content stretches to full width
• All: dynamic User-Agent (NexVPN/1.4.2 instead of hardcoded 1.0)
• All: "Refill" renamed to "Traffic reset" for clarity

New Features

• App Logs tab: Logs page now has Core / App subtabs — app-level logs show subscription parsing results per link
• Hysteria2 parser: hy2:// and hysteria2:// links are now parsed from subscriptions

Downloads

• Windows: NexVPN_1.4.2_x64-setup.exe
• macOS (Apple Silicon): NexVPN_1.4.2_aarch64.dmg
• Android: NexVPN_1.4.2_android.apk (signed)

v1.4.1

What's New

Subscription Metadata

• Parse all subscription headers: traffic usage, expiry date, update interval, support URL, provider announcements, refill date
• Auto-update subscriptions based on Profile-Update-Interval header
• Announcements from providers shown on home page, filtered by active server tab
• Compact/expandable subscription cards with traffic progress bar

UX Improvements

• Double-click server to connect directly
• Confirm dialog before deleting subscriptions and servers
• Duplicate subscription URL detection
• Human-readable error messages (TUN without admin, port conflicts, missing binaries, etc.)

Accessibility & Polish

• SVG icons replacing all emoji
• ARIA attributes on interactive elements
• Focus-visible styles, proper touch targets on mobile
• Theme-aware colors (no more hardcoded hex values)
• Text overflow handling

Downloads

• Windows: NexVPN_1.4.1_x64-setup.exe (NSIS installer)
• Android: NexVPN_1.4.1_android.apk (signed, universal)

v1.4.0

What's New

Security (Anti-Detection)

• Randomized ports — SOCKS5/HTTP ports randomize on each connection, preventing fingerprinting via known ports (10808)
• Proxy authentication (Android) — local proxy requires credentials, blocking other apps from scanning/using it
• Clash API secured — random port + Bearer token (was hardcoded 9090 without auth)
• Xray API randomized — stats API port randomized (was hardcoded 10813)
• IPv6 leak fix — full IPv6 routing through VPN tunnel

Android

• Per-app VPN — choose which apps go through VPN with app icons, search, include/exclude modes
• Kill switch — TUN stays open on crash, auto-restarts tun2socks (up to 5 attempts)
• Home screen widget — VPN status + one-tap toggle
• Stealth mode (root) — hides local ports from other apps via iptables
• Background stability — WakeLock, battery optimization exemption, survives app swipe

Transport

• xHTTP (splithttp) — new transport for sing-box and Xray-core
• HTTPUpgrade — new transport type
• Link export — generate shareable vless/vmess/ss/trojan/hy2/tuic links

Other

• VPN ping measurement through tunnel
• Auto/manual port mode with persistence fix
• Routing page improvements
• Updated README (EN/RU)

NexVPN v1.3.1 — Onboarding, Admin Elevation & Fixes

What's New

Onboarding

• Interactive guided tour — first-time users get a step-by-step walkthrough of the app
• Language selection — choose English or Russian before the tour starts
• Smooth animations — spring-based enter/leave transitions between steps

Admin Elevation for TUN

• "Run as Administrator" button — appears in Settings → VPN Mode → TUN when the app is running without admin rights
• Windows: triggers UAC prompt and restarts elevated
• macOS: uses system authorization prompt

Fixes

• Terminal flash fix — opening Settings no longer flashes a console window on Windows
• NSIS uninstaller — now properly cleans app data (%APPDATA%\nexvpn) so onboarding resets on reinstall
• Onboarding tooltip positioning — viewport clamping, scroll reset, no more clipping on steps 2-3
• Page animations — onboarding overlay no longer affected by page transition animations

Other

• Improved Russian translations (natural conversational style)
• Routing presets fetched from GitHub for easy updates

Downloads

Platform	File
Windows x64	NexVPN_1.3.1_x64-setup.exe
macOS Apple Silicon	NexVPN_1.3.1_aarch64.dmg
Android	nexvpn-v1.3.1-signed.apk

macOS TUN Mode

TUN mode on macOS requires elevated privileges. You can either:

• Click "Run as Administrator" in Settings → VPN Mode → TUN, or
• Launch from terminal:

sudo /Applications/NexVPN.app/Contents/MacOS/NexVPN

In Proxy mode (default), no sudo is needed — just open the app normally.

Note: On first launch macOS may block the app. Go to System Settings → Privacy & Security and click "Open Anyway".

---

Full Changelog: v1.3.0...v1.3.1

NexVPN v1.3.0 — Routing Rules & Split Tunneling

What's New

Routing Rules & Split Tunneling

• Domain-based routing rules — proxy, direct, or block any domain
• Split tunneling — choose default route: Proxy All (normal VPN) or Direct All (only selected domains go through VPN)
• Quick presets — one-click "Block Ads" and "RU sites direct"
• Per-rule toggle — enable/disable individual rules without deleting them
• Auto-apply — rules apply instantly; if VPN is active, it reconnects automatically

Other

• Updated screenshots

Downloads

Platform	File
Windows x64	NexVPN_1.3.0_x64-setup.exe
macOS Apple Silicon	NexVPN_1.3.0_aarch64.dmg
Android	nexvpn-v1.3.0-signed.apk

macOS TUN Mode

TUN mode on macOS requires elevated privileges. Launch from terminal:

sudo /Applications/NexVPN.app/Contents/MacOS/NexVPN

In Proxy mode (default), no sudo is needed — just open the app normally.

---

Full Changelog: v1.2.0...v1.3.0

NexVPN v1.2.0

What's New

macOS Support

• Full macOS support (Apple Silicon / M1+)
• System proxy via networksetup
• Hardware ID via IOPlatformUUID
• TUN mode works with sudo
• Distributed as .dmg

All Platforms

• Windows, macOS, Android from a single codebase
• SVG icons on all platforms
• Updated README with screenshots for each platform

Downloads

• Windows: NexVPN_1.2.0_x64-setup.exe or .msi
• macOS: NexVPN_1.2.0_aarch64.dmg (Apple Silicon)
• Android: NexVPN_1.2.0_android.apk