vLLM
vLLM requires Python 3.11 and allows no browser origins by default
vLLM now requires Python 3.11, allows no browser origins by default and narrows its transformers range. It also fixes three security advisories.
vLLM, the open-source server for running large language models, now requires Python 3.11 and allows no browser origins by default. Anyone who calls a vLLM server from a web page has to add a flag after upgrading. The release also narrows the supported transformers range and removes several options.
The vLLM project published v0.32.0 as a stable release on GitHub, and its release notes are dated Oct. 18, 2026. They list 814 commits from 363 contributors.
Python 3.10 Support Ends and CORS Closes
vLLM no longer supports Python 3.10, and the minimum is now Python 3.11. The default for CORS, the browser rule that decides which web pages may call a server, changed from allowing every origin to allowing none. Browser clients need the --allowed-origins flag.
Dependency Ranges Tighten
vLLM now requires transformers 5.16.1 or later but below 5.20.0. It also requires tokenizers 0.23.2 or later.
Removed Options Fail or Warn
Cascade attention is removed. The --disable-cascade-attn flag still parses but only prints a warning, and the release says it will be removed in v0.33.0. The mamba_cache_mode="all" setting is also removed and now fails validation.
Several deprecated APIs are gone, including wait_for_inflight_requests, AsyncLLM.pause_generation() and the sonnet benchmark dataset. The reasoning stream events in the Responses API were renamed.
The max_tokens Setting Becomes an Upper Bound
vLLM now treats max_tokens as an upper bound on output rather than a reservation from the context window, so long prompts are no longer rejected.
Three Security Advisories Are Fixed
The release fixes GHSA-4hhp-h66f-j5j7, a chat template resource exhaustion, with static validation and render timeouts. It fixes GHSA-q97c-p368-75c4, an off-by-one in the tokenizer max_token_id. It mitigates GHSA-frvg-qw88-hww9, which let peer-to-peer ZMQ sockets be exhausted, with limits on peers, handshakes and idle time.
Memory, Runner and Model Additions
NVFP4 KV cache, a compressed format for the memory that stores attention data, now runs on more GPU generations. GLM-5.x defaults to an FP8 KV cache on SM100 GPUs, which the release says halves KV memory per rank.
Model Runner V2 adds a GPU n-gram speculator, Elastic EP and pipeline parallelism with prefill context parallelism for MLA models. It is now the default on ROCm. A new vllm download-kernels command installs FlashInfer precompiled kernels. New models are EmbeddingGemma 2, MiniCPM-V 4.7 and Nemotron 3.5 ASR.
Our View
We think the CORS default is the first change to check, because it now allows no origins where it once allowed all. A browser page that calls a server directly stops working until the operator passes --allowed-origins. The operator now chooses which origins get in. That helps only if the operator lists just the origins that need access.