Project Zomboid Build 42.20.4 Security Hotfix

Build 42.20.4 is the current public Stable string as of 26 August 2026. It is a security hotfix, not a second Big Glow Up. The Indie Stone shipped sister patches the same day: 42.19.2 on the 42.19 beta and 41.78.21 on legacy41. This page is the search landing for “42.20.4”, “loadstring”, and “why did my mods break after the August 26 patch”. Pair it with Build 42 Overview for the July map work and with Mods before you rebuild a Workshop list.

Official notes say the hotfix should not break 42.20.x saves. Confirm the main-menu build string after Steam finishes. If it still reads 42.20.3, wait for the download or check Steam → Properties → Betas and leave the branch on None for current Stable.

What 42.20.4 actually changed

The public changelog is short on purpose:

• Security vulnerabilities were fixed.
• As part of that fix, the Lua methods loadstring and loadstream were removed.
• Mod authors who used those methods must rewrite. If a mod executed code sent from a server, it now needs explicit commands and matching client methods instead of loading arbitrary strings.
• If you cannot replace the calls, The Indie Stone asks authors to report in Discord #mod_portal with how the methods were used.

Players do not get a new town, a new crop, or a new animal. You get a safer client. Treat a sudden crash-on-launch after 26 August as a mod problem first, not a ruined world.

Build 42 Stable released — context for the 42.20.x hotfix line

How to confirm you are on 42.20.4

1. Right-click Project Zomboid in Steam → Properties → Betas.
2. For current Stable, leave the branch on None (IWBUMS tracks the same 42.20.4 line).
3. Let Steam finish updating.
4. Launch and read the main-menu string. 42.20.4 is ground truth.

Dedicated hosts can also check SteamCMD build IDs when they publish. Pin the exact string in the server title so browser joiners self-filter. See Dedicated Servers and Servers and Co-op for restart order after a security patch.

What to do as a player

Update. Confirm 42.20.4. If the game errors on launch or a save will not load, disable mods and try a vanilla load. A broken Workshop list is not a broken 42.20.4 save. Wait for the author; do not roll the public branch backward to chase one favorite.

Copy your world first if you have not already. Windows lives at %UserProfile%\Zomboid\Saves. Full folder notes live on Save Backup.

What to do as a host

1. Update the dedicated server to 42.20.4 before opening slots.
2. Freeze joins until clients match the string.
3. Expect Workshop items that injected Lua via loadstring / loadstream to fail until authors ship a replacement.
4. Keep the 42.20.2 % → %% text rule. 42.20.4 did not undo it.
5. Finish 42.19 worlds on the 42.19 branch. They still do not load in 42.20.

Branch cheat sheet after 26 August 2026

Branch	Current string	Use when
Default / None (Stable)	42.20.4	New runs and most players
42.19 beta	42.19.2	Finishing pre-stable Build 42 worlds only
legacy41	41.78.21	Maintaining Build 41 saves only

Build 41 and Build 42 saves never mix. 42.19 and 42.20 saves never mix. 42.20.3 worlds should load on 42.20.4.

Why mods break on a “tiny” hotfix

Security patches remove APIs that were convenient for dynamic Lua. Any Workshop item that compiled strings at runtime—admin menus, remote command loaders, some “do anything” debug helpers—can error on enable. UI-only mods that never called those methods should keep working. If a load-order screenshot from 25 August suddenly red-screens, binary-search by disabling half the list, then report the failing ID to the author rather than editing subscribed files (Steam overwrites manual edits).

Vanilla groups can log in the same evening. Modded groups should wait for Workshop comments that mention 42.20.4 specifically, not just “B42 stable”.

What this hotfix did not change

Knox County tiles, animals, crafting stations, rain collectors, and challenge rotation stay where 42.20.0–42.20.3 left them. Server player-limit handling from 42.20.3 (up to 254, admin join-when-full) remains. Memory and map-load work from 42.20.3 remains. Read Returning Players if you skipped the July promotion entirely.

Recommended reading after you update

1. Build 42 Overview — Big Glow Up context
2. Mods — Workshop, load order, percent-sign rule
3. Save Backup — folder paths before you experiment
4. Servers and Co-op — patch-week etiquette
5. Updates Hub — where the next support notes will land

Treat 42.20.4 as the new “are we on the same build?” question in Discord. The answer is a menu string, not a Steam download percentage.