curl 8.22.0 Detects Environment-Driven Proxy Changes and Resets Digest State

curl 8.22.0, released on September 2, 2026, includes a proxy-specific bug fix: libcurl now detects when the effective proxy selected from environment variables changes and clears the cached proxy Digest authentication state. The curl project’s associated regression test switches environment-selected proxies across two transfers and verifies that Digest state from the first proxy is not reused for the second.

This is a narrow fix with practical importance for long-running applications that reuse a libcurl easy handle while changing HTTP_PROXY, HTTPS_PROXY, ALL_PROXY, or their lowercase variants between transfers. It does not mean that every application should mutate environment variables at runtime. It means applications that already do so should include this transition in their curl 8.22.0 upgrade test.

What changed

Before the fix, proxy settings read from the environment could change between transfers, but cached proxy Digest state associated with the earlier endpoint was not necessarily treated as stale. curl 8.22.0 tracks the last environment-derived proxy string. When the new effective proxy differs, libcurl clears the previous proxy Digest state before continuing.

Digest authentication is a challenge-response exchange. Its state can include values associated with a particular proxy challenge, such as realm and nonce information. That state belongs to the proxy that issued it. Carrying it into a request to another proxy is operationally incorrect even when both endpoints use the same credentials or belong to the same provider.

The release note describes detection and state clearing; it does not promise that all application-level proxy failover behavior is automatically correct. DNS resolution, connection reuse, credential scope, NO_PROXY, uppercase-versus-lowercase variable behavior, and application concurrency still need testing.

Who should prioritize the test

Review this change if your application:

• reuses one easy handle for multiple transfers;
• obtains proxy configuration from environment variables;
• changes those variables without restarting the process;
• rotates between proxy gateways, regions, or providers;
• uses proxy Digest authentication;
• runs as a worker, agent, desktop process, or embedded service for a long time.

A short-lived command that starts with a fixed environment and exits after one transfer is less exposed to the transition. Applications that set a proxy explicitly through the libcurl API follow a different configuration path, but should still maintain their own endpoint and credential-boundary tests.

Why a proxy endpoint change is an authentication boundary

Two proxy URLs that look similar may represent different trust and policy domains. They can return different Digest realms, challenges, algorithms, or access decisions. A load balancer may also direct names to distinct gateway pools.

Treat these changes as boundaries:

• hostname or port changes;
• scheme changes between HTTP and HTTPS proxy endpoints;
• username or credential scope changes;
• region or provider changes;
• a variable becomes unset and another variable takes precedence;
• a destination begins or stops matching NO_PROXY.

When any boundary changes, verify the selected route, authentication exchange, connection identity, and observed exit. Do not infer success from a single HTTP status alone.

A safe upgrade test

Use two authorized test proxies with separate identities and a harmless internal or controlled destination. Keep the test free of real customer data.

1. Start with curl 8.22.0 in a staging process.
2. Configure the first proxy through the same environment variable used in production.
3. Perform a transfer that completes the proxy Digest challenge and record only non-secret evidence.
4. Change the environment-derived proxy to the second endpoint without recreating the easy handle.
5. Force a fresh connection for the transition test so a pooled connection cannot hide the endpoint change.
6. Perform the second transfer and confirm it authenticates against the second proxy’s challenge.
7. Verify the second gateway and expected exit were actually used.
8. Repeat with the variable precedence and NO_PROXY cases relevant to the deployment.

Useful evidence includes timestamps, proxy hostname or opaque gateway ID, response class, authentication method, connection reuse state, and expected region. Do not log proxy passwords, authorization headers, cookies, full Digest responses, or customer payloads.

For a broader reuse check, see HTTP/2 proxy connection reuse audit. For controlled secret changes, use the proxy credential rotation guide.

Do not confuse environment change with process isolation

Environment variables are process-wide on many platforms. Updating them while multiple threads or transfers are active can introduce application-level races that a curl library fix cannot solve. One transfer may read a different value than another, and unrelated code may depend on the same variables.

Prefer immutable process configuration when possible. If dynamic selection is required, an explicit per-handle proxy setting is generally easier to reason about than mutating global process state. Whichever model you use, define ownership, synchronize changes, and test concurrent transfers.

Regression matrix

Cover more than the happy path:

Run the matrix on the oldest supported runtime and TLS backend, not only a developer laptop. Container, service-manager, desktop, and CI environments can normalize or inherit proxy variables differently.

Rollout guidance

Upgrade a canary worker group first. Compare proxy authentication failures, connection creation, latency, retry volume, route selection, and useful results with the existing version. A temporary change in connection creation may be expected during endpoint transitions; repeated 407 responses or wrong-gateway evidence is not.

Keep rollback simple: restore the previous application image and its known configuration while retaining the curl 8.22.0 test evidence. Never work around an authentication-state problem by disabling proxy authentication, placing secrets in URLs or logs, or expanding access rules.

Operator checklist

• curl 8.22.0 is tested before fleet rollout.
• The application’s effective proxy-variable precedence is documented.
• A same-handle Proxy A to Proxy B transition is included.
• The second proxy uses an independent authorized challenge.
• A fresh connection proves the new endpoint is reached.
• NO_PROXY, unset variables, ports, IPv4, and IPv6 are covered where relevant.
• Concurrent environment mutation is avoided or synchronized.
• Logs exclude credentials and authentication material.
• Canary metrics include useful outcomes, not only transport success.
• Rollback does not weaken authentication or routing controls.

FAQ

Does curl 8.22.0 force applications to use environment variables?

No. The fix applies when libcurl obtains proxy configuration from the environment. Explicit API configuration remains available and may be preferable for dynamic per-handle routing.

Is this only relevant to the curl command-line tool?

The change is in libcurl’s URL and proxy state handling, so embedded applications that reuse handles can be relevant. Test the exact build and integration you ship.

Does the fix rotate proxy credentials?

No. It clears cached proxy Digest state when the environment-selected proxy changes. Credential lifecycle and storage remain application responsibilities.

Should we change production proxy variables live to test it?

Use staging or a small authorized canary first. Process-wide environment mutation can affect concurrent work, so design the test to isolate traffic and bound impact.

Source note

Source: curl project, “Changes in 8.22.0” and “url: detect proxy changes read from environment,” released September 2, 2026. Source details and research URLs are retained internally.

Compliance note

Test only proxy gateways and destinations you are authorized to use. Protect credentials and challenge material, minimize retained request data, respect destination policies and rate limits, and do not use proxy switching to bypass access controls.