Security Update: Check Your Version Branch

The Indie Stone released security fixes on August 26, 2026 for 42.20.4 Stable, 42.19.2 Unstable, and 41.78.21 Legacy. Choose the patch for your existing branch. A security update is not a reason to move a Build 41 world to Build 42 without checking it first.

The fix removes the Lua functions loadstring and loadstream. Mods that use them need to be updated. A successful server start alone therefore doesn't confirm that your mod features are working.

  1. Note down the branch, server version, and mod list; back up the world and configuration while the server is stopped.
  2. Update within the same branch and align the clients.
  3. Test joining, saving, and the mod features you actually use. Search the log for errors related to the removed Lua functions.
  4. If you run into problems, test on a separate, fresh world without mods. Don't overwrite your community's save for this.
  5. Only bring an affected mod back into service after it's been updated. Rolling back to a version before the security fix is not a suitable long-term fallback.

Source: The Indie Stone: Security Hotfixes from August 26.

Build 42 Is Stable — and It Breaks Your Old Saves

As of July 29, 2026, Build 42 of Project Zomboid is officially Stable. After roughly 19 months of development, this is the biggest shift since Build 41 — and for server operators, it's above all a compatibility question: Build 41 saves don't run under Build 42. If you switch, you start the world fresh. If you'd rather not, you can deliberately keep your server on Build 41.

This guide shows both paths, covers the changes relevant to servers, and the later security fix from August 26.

The Compatibility Situation at a Glance

Starting Point Runs Under 42.20? What to Do
Build 41 save No Start a new world or stay on legacy41
Unstable 42.19 save No Start a new world or stay on beta 42.19
New world on 42.20 Yes
42.20.0 → Hotfix 42.20.1 Yes According to the developer, the hotfix doesn't break any saves

The fact that 42.19 worlds also can't be carried over is due to the extensive new map areas in 42.20 — the world data simply no longer matches up.

Option 1: Stay on Build 41

If your community is in the middle of a long-running game, staying put is the lowest-risk option. The Indie Stone keeps Build 41 available as its own beta branch:

  1. Right-click Project Zomboid in your Steam library
  2. Open Properties
  3. Under Betas, select the legacy41 branch

Important: All players on your server need to select the same branch. A Build 42 client can't connect to a Build 41 server. So announce the switch before you make it.

For games on Unstable 42.19, there's a corresponding beta branch, 42.19.

Option 2: Switch to Build 42

Switching means starting a new world. A sensible order:

  1. Create a backup of your current world. In the game-serverhosting panel, back up your server before you change anything — that way the old game stays preserved in case you want to go back.
  2. Coordinate a date with your community. A wipe without warning costs you players.
  3. Check your mods (see below) — Build 42 is a breaking change, and many mods need an update.
  4. Update the server to 42.20 and generate a new world.
  5. Reset your sandbox settings — some options have changed.

Don't have your own server yet? Rent a Project Zomboid Server

What Specifically Changes for Multiplayer Servers

Build 42.20 brings several changes that affect servers exclusively:

  • Anti-cheat overhauled and active again. The check now runs server-side; the former antiCheatItem setting has been removed since it became redundant. Logging has been improved. According to the developer, two sub-areas (NoClip, PacketException) are still a work in progress.
  • New server option "Show coordinates." This lets you show or hide the coordinate line for all connected clients — useful for roleplay servers that want to enforce map-based navigation.
  • Per-player ping values now appear in the "Players" and "Users List" tabs. This finally makes it possible to tell whether a player has a connection issue or the server itself is lagging.
  • Zombie limit significantly raised. The sandbox option "Zombie count before deletion" now goes up to 5000 instead of the previous 500. For densely populated, high-traffic servers, that's a noticeable degree of freedom — but also a lever that costs performance.
  • Shorter loading times between "Click to Start" and spawning.
  • Stackable items are transferred faster.
  • Network behavior during vehicle collisions with zombies has been improved.

Your Old Sandbox File: What Build 42 Quietly Changes

It's well known that saves don't carry over. Less well known — and more annoying in practice — is the second part: the settings file SandboxVars.lua can be carried over without any problem. It just no longer means the same thing under Build 42. There's no error message and no note in the log. The server starts, but it plays differently.

We run servers on both builds and have to read both formats in parallel. The following differences therefore don't come from a wiki, but from comparing real server files.

Eight Options Now Have Different Names

Setting Build 41 Build 42
Food FoodLoot FoodLootNew
Medical MedicalLoot MedicalLootNew
Survival gear SurvivalGearsLoot SurvivalGearsLootNew
Melee weapons WeaponLoot WeaponLootNew
Ranged weapons RangedWeaponLoot RangedWeaponLootNew
Ammo AmmoLoot AmmoLootNew
XP multiplier XpMultiplier MultiplierConfig.Global
Loot respawn LootRespawn HoursForLootRespawn

If you carry over the old file, Build 42 ignores the old keys and applies the default value for the new ones. That means your painstakingly tuned loot rarity is gone — without anyone telling you.

Two of these renames are more than cosmetic: XpMultiplier is no longer its own value — it's moved into the MultiplierConfig container. And the tiered selector LootRespawn has become HoursForLootRespawn, a value given in hours — a 4 used to mean a tier, now it means four hours.

DayLength: Same Number, a Different Day

This is the least conspicuous change and, at the same time, the most impactful one. The list of values has been renumbered:

Value Build 41 Build 42
4 2 hours 1.5 hours
5 3 hours 2 hours
6 4 hours 3 hours
7 5 hours 4 hours
26 23 hours (new)
27 Real time (new)

If you played Build 41 with DayLength = 4, you had two-hour days. Under Build 42, the exact same file produces days of an hour and a half — noticeably shorter, without anything looking broken. If your server feels more frantic after the switch, this is usually the reason.

What Build 42 Newly Allows

Some of this wasn't even configurable before:

  • Turn off zombies completely (Zombies = 6) — for building and roleplay servers
  • Random values for speed, strength, and toughness (ZombieLore.Speed, .Strength, .Toughness)
  • Disable infection (Transmission = 4) and never die from infection (Mortality = 7)
  • Keep power and water on permanently — or only shut them off after 6 to 12 months
  • No spoilage in the fridge (FridgeFactor = 6)
  • Very high or very slow as a new tier for temperature, erosion, nature regrowth, food decay, and vehicle spawn rate

How to Configure This With Us

With us, you don't need to edit any file for this. In the server panel, under Sandbox, there's a guided form that reads your world's settings directly from the file — it automatically shows the value list for your build, including the new tiers under Build 42. The game's presets (Apocalypse, Survivor, Outbreak, Rising, Six Months Later) can be applied with a single click.

Two things matter here. Saving only works while the server is stopped — Project Zomboid rewrites the file on shutdown and would otherwise overwrite your changes. And if you need the complete file, you can access it via the file manager at .cache/Server/<Servername>_SandboxVars.lua.

Recap: Performance Fixes in 42.20.1

The hotfix from August 5 fixes exactly the issues that show up on well-populated servers as "the server is lagging":

  • Chunk unloading fixed. A bug caused significant performance problems when unloading world areas. According to the developer, the fix resolves most of the issues players experienced from server lag on servers with high player counts — the most important point in the patch.
  • Memory leak closed. A memory leak caused performance to decline over time and eventually led to crashes. Exactly the pattern that shows up as "the server needs a restart after a few days."
  • Memory usage improved by reusing discarded world data.
  • Broken B41 worlds could incorrectly be hosted on B42 servers — this has been prevented.
  • Vehicles disappearing after a fellow player disconnects has been fixed.
  • Lua checksum validation for the anti-cheat has been improved.

42.20.1 was an early performance hotfix. For the current security status, refer to the 42.20.4 fix within the Stable branch explained above.

Mods: Expect Breakage

Build 42 is a version jump that affects mods. In addition, The Indie Stone points out that a security patch released alongside 42.20 (the underlying vulnerability was responsibly disclosed by Jorge Escabias) can, in individual cases, also affect mods.

In practice, that means:

  • Check before switching whether your Workshop mods have a Build 42 version.
  • Test on a new world without mods before reporting bugs — the developer explicitly recommends this.
  • Relevant for mod authors: mods can now write .json files, and translation files need %% to display a percent sign.

We explain how to install mods on your server and keep them up to date here:

Frequently Asked Questions

Is there any way to save my Build 41 save? Not on Build 42. The world data isn't compatible. However, you can keep playing your game indefinitely on the legacy41 branch — still create a backup beforehand.

Do my players need to do anything? Yes. The server and client need to run the same version. If you stay on Build 41, everyone needs to select the legacy41 branch; if you switch, everyone needs to be on the default version.

Is Build 42 stable enough for a community server? The "Unstable" notice has been removed from the main menu, and 42.20.1 fixed the two most serious server issues (chunk unloading, memory leak). That makes a much stronger case for switching than it did at the end of July.

Is a higher zombie limit worth it? It's available, but costly. More active zombies mean more computational load per tick. Ease into it gradually and keep an eye on your server load in the panel.

Where can I find the complete list of changes? The developers provide a feature overview for Build 42. It's explicitly a selection, not a complete changelog.


Sources: official Steam announcements "Build 42.20.0 Stable Released" (July 29, 2026), "B42 CHECKLIST" (July 28, 2026), and "42.20.1 STABLE Hotfix Released" (August 5, 2026).