Ghostty 1.4.0 Released With Security Fixes and Graphics Protocol Upgrades
Ghostty 1.4.0 introduces improved Kitty graphics support, significant memory optimizations, and critical security patches addressing ten vulnerabilities.
Ghostty 1.4.0 shipped on October 27, 2026, after seven months of work spanning 2,889 commits from 172 contributors.
The release resolves ten security advisories. Two vulnerabilities, GHSA-hcr9-7hcr-mjm8 and GHSA-hp9c-qp4q-cpw3, let malicious terminal output crash the app through tmux control mode. Additional fixes address malicious Kitty graphics commands, zsh shell integration escape sequence injection via crafted directory names, and four macOS issues. CVE numbers are requested but unassigned.
Complete support for the Kitty graphics protocol now includes animation and relative placements. Image payload parsing uses SIMD and runs about 16x faster on 64 MiB of x86_64 Linux data. The Kitty clipboard protocol (OSC 5522) lands on macOS and GTK.
Idle scrollback compression cuts physical memory usage by 70% to 90%, raising the default limit from 10 MB to 50 MB. An empty terminal on macOS now uses roughly 16 KiB of page memory. Separating pty reading and parsing threads on macOS bumped end-to-end throughput by 25% to 55% on an M4 Max.
New platform requirements bump GTK to 4.18 and libadwaita 1.7, dropping Ubuntu 24.04 LTS support. A new ghostty +ssh command wraps ssh to install terminfo and forward environment variables.