/ 
Mojolicious-9.52
⭐ Starred 2674
Security Advisories (1)
CVE-2024-58134 (2025-05-03)

Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default. These predictable default secrets can be exploited by an attacker to forge session cookies.  An attacker who knows or guesses the secret could compute valid HMAC signatures for the session cookie, allowing them to tamper with or hijack another user’s session.

Changes for version 9.52 - 2026-10-24

  • Improved multipart/form-data performance in Mojo::Message.
  • Improved Mojo::Server::Daemon performance by up to 27% for keep-alive requests, by finishing static responses without an extra write cycle and caching socket addresses per connection.
  • Improved header parsing performance in Mojo::Headers by up to 2x.
  • Improved route matching performance in Mojolicious::Routes by up to 8x for real world applications, routes are now indexed by the text their patterns start with, so the cost no longer grows with the number of routes.
  • Improved encode and decode performance in Mojo::Util by up to 3x for ASCII strings, which speeds up parameter parsing by up to 35%.
  • Improved url_for performance in Mojolicious::Controller by up to 15%.
  • Improved xor_encode performance in Mojo::Util by up to 3x, which speeds up WebSocket frame masking.
  • Fixed a bug in Mojo::Util where gzip did not accept Mojo::ByteStream objects, causing compressed responses rendered from them to fail.
  • Fixed a bug in Mojo::Log where messages from nested contexts were not written to the log file.
  • Fixed a bug in Mojo::Util where html_unescape did not replace numeric character references to NUL, surrogates and code points beyond Unicode with U+FFFD, and did not remap the C1 control range through windows-1252, as required by the WHATWG HTML standard.
  • Fixed a bug in Mojo::Server::Daemon where destroying the server while a response was being written could cause an exception.

Documentation

README.md
SECURITY.md
Mojolicious::Guides
The Mojolicious Guide to the Galaxy
Mojolicious::Guides::Contributing
Contributing to Mojolicious
Mojolicious::Guides::Cookbook
Cooking with Mojolicious
Mojolicious::Guides::FAQ
Frequently Asked Questions
Mojolicious::Guides::Growing
Growing Mojolicious applications
Mojolicious::Guides::Rendering
Rendering content
Mojolicious::Guides::Routing
Routing requests
Mojolicious::Guides::Testing
Web Application Testing Made Easy
Mojolicious::Guides::Tutorial
Get started with Mojolicious
hypnotoad
Hypnotoad HTTP and WebSocket server
mojo
The Mojolicious command system
morbo
Morbo HTTP and WebSocket development server

Modules

Mojo
Web development toolkit
Mojo::Asset
HTTP content storage base class
Mojo::Asset::File
File storage for HTTP content
Mojo::Asset::Memory
In-memory storage for HTTP content
Mojo::Base
Minimal base class for Mojo projects
Mojo::BaseUtil
Common utility functions used in Mojo::Base, re-exported in Mojo::Util
Mojo::ByteStream
ByteStream
Mojo::Cache
Naive in-memory cache
Mojo::Collection
Collection
Mojo::Content
HTTP content base class
Mojo::Content::MultiPart
HTTP multipart content
Mojo::Content::Single
HTTP content
Mojo::Cookie
HTTP cookie base class
Mojo::Cookie::Request
HTTP request cookie
Mojo::Cookie::Response
HTTP response cookie
Mojo::DOM
Minimalistic HTML/XML DOM parser with CSS selectors
Mojo::DOM::CSS
CSS selector engine
Mojo::DOM::HTML
HTML/XML engine
Mojo::Date
HTTP date
Mojo::DynamicMethods
Fast dynamic method dispatch
Mojo::EventEmitter
Event emitter base class
Mojo::Exception
Exception base class
Mojo::File
File system paths
Mojo::Headers
HTTP headers
Mojo::HelloWorld
Hello World!
Mojo::Home
Home sweet home
Mojo::IOLoop
Minimalistic event loop
Mojo::IOLoop::Client
Non-blocking TCP/IP and UNIX domain socket client
Mojo::IOLoop::Server
Non-blocking TCP and UNIX domain socket server
Mojo::IOLoop::Stream
Non-blocking I/O stream
Mojo::IOLoop::Subprocess
Subprocesses
Mojo::IOLoop::TLS
Non-blocking TLS handshake
Mojo::JSON
Minimalistic JSON
Mojo::JSON::Pointer
JSON Pointers
Mojo::Loader
Load all kinds of things
Mojo::Log
Simple logger
Mojo::Message
HTTP message base class
Mojo::Message::Request
HTTP request
Mojo::Message::Response
HTTP response
Mojo::Parameters
Parameters
Mojo::Path
Path
Mojo::Promise
Promises/A+
Mojo::Reactor
Low-level event reactor base class
Mojo::Reactor::EV
Low-level event reactor with libev support
Mojo::Reactor::Poll
Low-level event reactor with poll support
Mojo::SSE
Server-Sent Events
Mojo::Server
HTTP/WebSocket server base class
Mojo::Server::CGI
CGI server
Mojo::Server::Daemon
Non-blocking I/O HTTP and WebSocket server
Mojo::Server::Hypnotoad
A production web serv...ALL GLORY TO THE HYPNOTOAD!
Mojo::Server::Morbo
Tonight at 11...DOOOOOOOOOOOOOOOM!
Mojo::Server::Morbo::Backend
Morbo backend base class
Mojo::Server::Morbo::Backend::Poll
Morbo default backend
Mojo::Server::PSGI
PSGI server
Mojo::Server::Prefork
Pre-forking non-blocking I/O HTTP and WebSocket server
Mojo::Template
Perl-ish templates
Mojo::Transaction
Transaction base class
Mojo::Transaction::HTTP
HTTP transaction
Mojo::Transaction::WebSocket
WebSocket transaction
Mojo::URL
Uniform Resource Locator
Mojo::Upload
Upload
Mojo::UserAgent
Non-blocking I/O HTTP and WebSocket user agent
Mojo::UserAgent::CookieJar
Cookie jar for HTTP user agents
Mojo::UserAgent::Proxy
User agent proxy manager
Mojo::UserAgent::Server
Application server
Mojo::UserAgent::Transactor
User agent transactor
Mojo::Util
Portable utility functions
Mojo::WebSocket
The WebSocket protocol
Mojolicious
Real-time web framework
Mojolicious::Command
Command base class
Mojolicious::Command::Author::cpanify
CPAN-ify command
Mojolicious::Command::Author::generate
Generator command
Mojolicious::Command::Author::generate::app
App generator command
Mojolicious::Command::Author::generate::dockerfile
Dockerfile generator command
Mojolicious::Command::Author::generate::lite_app
Lite app generator command
Mojolicious::Command::Author::generate::makefile
Makefile generator command
Mojolicious::Command::Author::generate::plugin
Plugin generator command
Mojolicious::Command::Author::inflate
Inflate command
Mojolicious::Command::cgi
CGI command
Mojolicious::Command::daemon
Daemon command
Mojolicious::Command::eval
Eval command
Mojolicious::Command::get
Get command
Mojolicious::Command::prefork
Pre-fork command
Mojolicious::Command::psgi
PSGI command
Mojolicious::Command::routes
Routes command
Mojolicious::Command::version
Version command
Mojolicious::Commands
Command line interface
Mojolicious::Controller
Controller base class
Mojolicious::Lite
Micro real-time web framework
Mojolicious::Plugin
Plugin base class
Mojolicious::Plugin::Config
Perl-ish configuration plugin
Mojolicious::Plugin::DefaultHelpers
Default helpers plugin
Mojolicious::Plugin::EPLRenderer
Embedded Perl Lite renderer plugin
Mojolicious::Plugin::EPRenderer
Embedded Perl renderer plugin
Mojolicious::Plugin::HeaderCondition
Header condition plugin
Mojolicious::Plugin::JSONConfig
JSON configuration plugin
Mojolicious::Plugin::Mount
Application mount plugin
Mojolicious::Plugin::NotYAMLConfig
Not quite YAML configuration plugin
Mojolicious::Plugin::TagHelpers
Tag helpers plugin
Mojolicious::Plugins
Plugin manager
Mojolicious::Renderer
Generate dynamic content
Mojolicious::Routes
Always find your destination with routes
Mojolicious::Routes::Match
Find routes
Mojolicious::Routes::Pattern
Route pattern
Mojolicious::Routes::Route
Route
Mojolicious::Sessions
Session manager based on signed cookies
Mojolicious::Static
Serve static files
Mojolicious::Types
MIME types
Mojolicious::Validator
Validate values
Mojolicious::Validator::Validation
Perform validations
Test::Mojo
Testing Mojo
ojo
Fun one-liners with Mojo

Provides

Mojo::Log::_Capture
in lib/Mojo/Log.pm
Mojo::Server::PSGI::_IO
in lib/Mojo/Server/PSGI.pm
Mojo::Util::_Guard
in lib/Mojo/Util.pm

Examples

Other files