vLLM 0.32.0 is out: ask models questions, get probabilities — and your server stops trusting every website

• Who: the vLLM project (open-source LLM inference engine), release published on GitHub on October 18, 2026.
• What: version 0.32.0 — 814 commits from 363 contributors, 121 of them new to the project.
• Headline feature: POST /v1/systemone answers choice, noul (yes/no), and score questions with a probability per label — nothing is generated or parsed.
• Speed: GLM-5.x defaults to an FP8 KV cache on SM100 GPUs (halves KV memory per rank, +2.3–5.5% throughput); fp8_ds_mla on SM90 gives GLM-5.3-Flash up to 31% more output throughput; ROCm gains a 4-bit KV cache with about 2× the density of FP8.
• Security: fixes for GHSA-4hhp-h66f-j5j7, GHSA-q97c-p368-75c4 and GHSA-frvg-qw88-hww9; CORS defaults no longer reply Access-Control-Allow-Origin: *; JSON schemas nested deeper than 64 levels are rejected.
• Breaking changes: Python 3.10 dropped; transformers ≥5.16.1,<5.20.0 and tokenizers ≥0.23.2; cascade attention, torch.compile SP/AsyncTP passes, and mamba_cache_mode="all" removed; max_tokens no longer reserved from the context window.

The inference server that powers most open-weight LLM deployments got its biggest release of the quarter this morning. vLLM 0.32.0 went live on GitHub with a feature that changes what the software is: not just a token server, but a decision engine. Alongside it come the usual performance gains, a hard security fix for browser-based attacks, and a few breaking changes operators will want to read before upgrading.

Decisions, not tokens

The new POST /v1/systemone endpoint answers typed questions — choice, noul (yes/no), and score — over a structured state. Send it a support ticket and ask "which team should handle this?" with criteria for billing, shipping, and security, and it returns probabilities for each option plus a confidence score. Nothing is generated and nothing is parsed, so an answer can never come back off-schema.

This is the "system one" pattern: fast, calibrated scoring for routing, guardrails, and classification, sitting next to the slower generative "system two". Instead of prompting an LLM and regex-parsing its reply, developers get numbers they can threshold. The endpoint is served by default in this release and also runs on Cloudflare's Clef Omni, LiquidAI's d1-3B, and DiffusionGemma models.

Faster, cheaper, wider

The performance story is mostly about the KV cache. NVFP4 KV caching now runs on SM8x, SM12x, and SM90 GPUs (with XQA decode on SM12x), while GLM-5.x defaults to an FP8 KV cache on SM100, halving KV memory per rank with 2.3–5.5% more throughput at a 7–11% time-to-first-token cost, per the pull request's benchmarks. ROCm users get a 4-bit ultraquant_4bit KV cache with roughly twice the density of FP8. Model Runner V2 brings a GPU n-gram speculator, elastic expert parallelism, and pipeline parallelism with prefill context parallelism for MLA models — and becomes the default on ROCm.

Startup and serving also got faster: vllm download-kernels installs FlashInfer's precompiled kernels, and routing connections to the least-loaded API worker with --api-server-count yields 43–85% more requests per second on short requests in the project's benchmark. New model support includes EmbeddingGemma 2 (omni-modal embeddings), MiniCPM-V 4.7, and NVIDIA's Nemotron 3.5 streaming ASR, plus video input through the Transformers modeling backend.

The security half of the release

Buried in the changelog is a fix that matters more than most features. Since v0.6, vLLM's server answered browser requests with Access-Control-Allow-Origin: * — meaning JavaScript on any website could send chat requests to a vLLM server running on your laptop or office network and read the answers. Version 0.32.0 flips the default: --allowed-origins now defaults to an empty list, so browser preflights get a 400 and the request never happens. Non-browser clients — curl, the OpenAI SDK, gateways, agents — are unaffected.

The release also patches three GHSA advisories (chat-template resource exhaustion, a tokenizer max_token_id issue, and P2P ZMQ socket exhaustion), limits untrusted images to raster formats, signs shared-memory multimodal cache handles, and rejects JSON schemas nested deeper than 64 levels.

What breaks

Operators should read the breaking-changes list before upgrading: Python 3.10 is dropped, transformers>=5.16.1,<5.20.0 and tokenizers>=0.23.2 are now required, and cascade attention, the torch.compile sequence-parallelism and AsyncTP passes, and mamba_cache_mode="all" are removed. max_tokens is no longer reserved from the context window, and Responses API reasoning stream events were renamed.

The bigger picture: with 363 contributors and 814 commits, vLLM is maturing from a fast inference engine into the control plane for agentic systems — one where routing, gating, and tool decisions can run on calibrated probabilities inside the same server that generates the tokens. AI news trackers flagged it as the day's top open-source release, and for anyone running agents on open weights, the systemone endpoint is the part to evaluate first.