Update 10/17/25: Microsoft fixes the bug using a KIR (Known Issue Rollback) update. More information added to end of story.
Microsoft's October Windows 11 updates have broken the "localhost" functionality, making applications that connect back to 127.0.0.1 over HTTP/2 no longer function properly.
Localhost refers to the local computer or device you're currently using, which can be accessed through the special IP address 127.0.0.1.
Developers commonly use localhost to test websites or debug applications, but it can also be used by applications that need to connect to a locally running service to perform some action or query.
After installing the Windows 11 KB5066835 Patch Tuesday, and even September's KB5065789 preview update, users are finding that their applications are no longer able to complete HTTP connections to the localhost (127.0.0.1) IP address.
When attempting to do so, they received errors like "ERR_CONNECTION_RESET" or "ERR_HTTP2_PROTOCOL_ERROR".
These issues have been reported by Windows users on the Microsoft forums, Stack Exchange, and Reddit, all stating they are no longer able to make HTTP connections to 127.0.0.1.
The bug has impacted widely used applications, including Visual Studio debugging, SSMS Entra ID authentication, and the Duo Desktop app, which verifies device security posture and requires connections back to web servers running on the localhost.
"After performing Windows Updates for Windows 11 24H2 and 25H2, you may experience an issue where the Duo Prompt is unable to reach Duo Desktop," reads the Duo support bulletin.
"This may prevent successful authentication (or result in limited functionality) in situations where the following are in use: Trusted Endpoints, Policies such as the Duo Desktop & Device Health policy, Duo Desktop as an Authentication Method. Duo Passport. Verified Duo Push with Bluetooth Autofill or Proximity Verification."
BornCity suggests the following Registry entries help resolve the problem by disabling the HTTP/2 protocol but BleepingComputer has not been able to independently confirm this fix.
[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\HTTP\Parameters]
"EnableHttp2Tls"=dword:00000000
"EnableHttp2Cleartext"=dword:00000000
Another method that some claim resolved the problem was to install the latest Microsoft Defender intelligence update. However, others report that it has not fixed the issue on their Windows devices.
Instead, the only sure way to resolve the bug has been to uninstall the October KB5066835 update and September's KB5065789 preview update.
Windows users can uninstall the updates using the following commands:
wusa /uninstall /kb:5066835
wusa /uninstall /kb:5065789
After uninstalling the updates and restarting Windows, the loopback interface should once again allow HTTP/2 connections, resolving the issues using applications.
BleepingComputer contacted Microsoft about this bug and will update our story if we receive a response.
Update 10/17/25: Microsoft has confirmed they are aware of the issue and have released a Known Issue Rollback (KIR) update to fix the bug.
"We are actively working on mitigations and recommend customers follow our guidance available here," a Microsoft spokesperson told BleepingComputer.
In the support bulletin, Microsoft explains that the flaw is related to applications that rely on the HTTP.sys driver.
"Following installation of updates releases on or after September 29 (KB5066835), server-side applications that rely on HTTP.sys may experience issues with incoming connections. As a result, IIS websites might fail to load, displaying a message such as "Connection reset - error (ERR_CONNECTION_RESET)", or similar error. This includes websites hosted on http://localhost/, and other IIS connections," explains Microsoft.
"This issue is caused by a variety of conditions which can be influenced by the device's internet connectivity, as well as timing of recent update installation and device restarts. For this reason, it is possible that it may not be observed in some environments despite having installed the update mentioned above."
To fix the flaw, Microsoft says Windows users can open Windows Update and check for new updates to receive the KIR update:
- On the affected device, open "Windows Update" in the "Windows Settings" app.
- This can be accomplished by opening the start menu, typing "check for updates", and selecting from the results to the right
- Click on "Check for updates". Allow any updates to install.
- Restart your device.
- Note: please restart your device even if no updates are installed in the previous step.
Once you restart Windows, the localhost connection issues should be resolved.
Break down IAM silos like Bitpanda, KnowBe4, and PathAI
Broken IAM isn't just an IT problem - the impact ripples across your whole business.
This practical guide covers why traditional IAM practices fail to keep up with modern demands, examples of what "good" IAM looks like, and a simple checklist for building a scalable strategy.
Comments
jmwoods - 2 months ago
Gunter Born of Born City published a different registry workaround...
Temporary fix without uninstalling KB5066835:
In the registry, navigate to:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\HTTP\Parameters
Under the Parameters folder, right-click in the right-hand pane and select New > DWORD (32-bit) Value.
Name the value EnableHttp2Tls and set its data to 0 (zero).
Repeat the process to add another value named EnableHttp2Cleartext and set its data to 0.
Restart the machine.
Lawrence Abrams - 2 months ago
Is this confirmed to work?
Lawrence Abrams - 2 months ago
Thanks. Switched to Gunter's solution, which was also shared on StackOverflow. The previous registry key disables IIS support for HTTP/2. This one disables it on the Windows device, which makes it a better fix.
Widen1775 - 2 months ago
Thank you guys for this, you're saving us a lot of trouble with this info.
lewig28716 - 2 months ago
Windows 11 really is vibe-coded ai slop lol...
So glad I can use Windows 10 LTSC IoT until 2032.
h_b_s - 2 months ago
Not a viable long term solution. While LTSC does get security updates, it doesn't get necessary feature or mainstream driver updates. Not everything can be fixed with security updates. It's designed for kiosks, single application devices, and air-gapped systems where the software run is tightly controlled and not directly exposed to the Internet and untrusted code which is literally ANY webpage in a browser. Recommending and crowing about using 10 LTSC for GP computing willy nilly just shows one's ignorance, not knowledge, of IT topics.
Microsoft is increasingly inclined to break backwards compatibility and software vendors are increasingly inclined to ignore compatibility with out-of-service Windows versions, including LTSC versions of previous releases whether they're EOL or not because the general population doesn't use them (for good reason). LTSC users are paying for that service either through in-house software teams or contract services for LTSC software and hardware support. Regular consumers (incl. enthusiasts) won't get that from the likes of Google, Adobe, Mozilla, Dell, Lenovo, Asus, MSI, etc.
Also find it amusing that the people screaming about being forced to move from 7 to 10 are now clawing at keeping 10 instead of 11. Move to a Mac or Linux already and shut up with the incessant bitching. 10 LTSC is not keeping your information or work habits private, its not going to keep your system safe from adversaries, and you'll eventually run afoul of compatibility problems, especially when OEMs drop driver support and the installed drivers are discovered to have remotely exploitable flaws - WHEN NOT IF.
GoAwayH1B - 2 months ago
GP computing users are sick and tired of Windows Updates breaking systems and Copilot AI bloat and telemetry bloat that LTSC does not have, so it's fair game when users want to take back control over their systems instead of having big corporations dictate what they can or cannot do with their systems
LowLevelisAllitTakes - 2 months ago
Wow what a surprise, you remove comments and censor people even here on a cyber security forum, humanity is in good hands with you !