> This page is for Applications Protection.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.humansecurity.com/llms.txt.

# Changelog

## June 21, 2026

## Version 0.3.2

### Added

* Custom block on error message: New `px_custom_block_on_error_message` configuration to display a custom message on block pages served due to an error

### Fixed

* URL host replacement in `NextJSIncomingRequest` now preserves the raw URL path without normalization (fixes raw URL tracking for paths containing dots or extra slashes)
* Form URL-encoded body parsing now clones the request before reading to allow the body stream to be consumed multiple times

## May 4, 2026

## Version 0.3.1

### Added

* MCP Protection support: New configurations `px_agentic_trust_enabled` and `px_agentic_trust_mcp_endpoint_path` to protect MCP server endpoints
* Proxy support: New `px_proxy_url` configuration to route outbound requests through an HTTP proxy
* Added Hardblock support
* Response custom parameters 11–20: `px_enrich_response_custom_parameters` can now populate custom parameters 11 through 20, extracted from the origin response
* Data enrichment header: New `px_data_enrichment_header_name` configuration to specify the header used for data enrichment
* Async timeout: New `px_async_timeout` configuration that applies to async activities, telemetry, remote logger, and remote configuration requests
* Regex-formatted route strings: Route configurations (e.g. `px_sensitive_routes`, `px_enforced_routes`, `px_filter_by_route`, etc.) now accept strings in regex format (e.g. `"/^\/api\/.*$/i"`) in addition to plain strings and `RegExp` objects

## February 10, 2026

## Version 0.3.0

### Added

* Support for Next.js ^16.0.0. Use `proxy.ts` and `export const proxy = perimeterx(pxConfig)` (or `export default`) on Next.js 16+; `middleware.ts` remains supported but is deprecated there.

## December 4, 2025

## Version 0.2.3

### Fixed

* `onResponse` signature updated for accuracy (changed response parameter to be type `NextResponse`)
* Fixed Next.js critical vulnerability by bumping version to 15.5.7

## February 24, 2025

## Version 0.2.2

### Changed

* Upgraded JS Core to v0.24.2
* Updated to support NextJS versions ^14.2.7 || ^15.0.0
* Changed NextJS to be a peer dependency

## August 28, 2024

## Version 0.2.1

### Changed

* Using CryptoJS to read `_px3`
* Supporting NextJS

## August 7, 2024

## Version 0.2.0

### Changed

* Upgraded to js-core `0.21.4`
* Added ci e2e tests
* Upgraded next js to `13.4.4`

## May 31, 2023

## Version 0.1.6

### Fixed

* Fixed context overriding between two different requests.

## May 24, 2023

## Version 0.1.5

### Fixed

* Using host header to construct url, the default implementation (by Next.js) does not do that.

## May 18, 2023

## Version 0.1.4

### Changed

* js-core version

## April 10, 2023

## Version 0.1.3

### Fixed

* README

## Version 0.1.2

### Changed

* Using `ConsoleLogger`, which uses `console.error` to log the error messages instead of `DefaultLogger`.

## April 4, 2023

## Version 0.1.1

### Fixed

* Package json
* Configuration type instead of interface

## April 3, 2023

## Version 0.1.0

### Added

* First version.