vmess in shadowTLS Can't make connetion in New version

Operating system

Linux

System version

manjaro and gentoo kernel 6.12

Installation type

Original sing-box Command Line

If you are using a graphical client, please provide the version of the client.

No response

Version

sing-box version 1.13.0-beta.7

Environment: go1.25.5 X:nodwarf5 linux/amd64
Tags: with_gvisor,with_clash_api,with_grpc,with_utls,with_quic,with_tailscale,with_wireguard,with_acme,with_naive_outbound,with_purego,badlinkname,tfogo_checklinkname0
Revision: 5d67c131fac58cb6be86b55c0f6bc552b205e796
CGO: enabled

Description

vmess detour to shadowtls from client can't connect to server in version newer than 1.12.12

Reproduction

client config

{
  "type": "vmess",
  "tag": "vmess-detor",
  "detour": "shadowtls-out",
  "server": "",
  "server_port": 0,
  "uuid": "UUID",
  "security": "auto",
  "alter_id": 0,
  "multiplex": {
    "enabled": true,
    "protocol": "smux",
    "max_connections": 8,
    "min_streams": 4,
    "padding": true
  }
},
{
  "type": "shadowtls",
  "tag": "shadowtls-out",
  "server": "ServerIP",
  "server_port": 12345,
  "version": 3,
  "password": "PSSWD",
  "tls": {
    "enabled": true,
    "server_name": "www.bing.com",
    "utls": {
      "enabled": true,
      "fingerprint": "chrome"
    }
  }
},

server config

{
  "type": "shadowtls",
  "listen": "::",
  "listen_port": 12345,
  "detour": "vmess-in",
  "version": 3,
  "users": [
    {
      "name": "shadowtls",
      "password": "PASSWD"
    }
  ],
  "handshake": {
    "server": "www.bing.com",
    "server_port": 443
  },
  "strict_mode": true
},

{
  "type": "vmess",
  "tag": "vmess-in",
  "listen": "127.0.0.1",
  "listen_port": 54321,
  "users": [
    {
      "name": "Vmess",
      "uuid": "UUID,
      "alterId": 0
    }
  ],
  "multiplex": {
    "enabled": true,
    "padding": true
  }
},

Same config file, if sing-box version is 1.12.12, vemss detour shadowtls can run correctly. But if sing-box version is newer than 1.13, the error will occur.

Logs

**client log:**
ERROR [1352531608 434ms] connection: connection download handshake: read payload: read tcp 192.168.x.xxx:60818->ServerIP:12345: read: connection reset by peer


**server log:**
+0000 2026-01-19 06:35:55 INFO [855092830 147ms] inbound/shadowtls[3]: [shadowTLS] inbound connection to :0
+0000 2026-01-19 06:35:55 INFO [855092830 148ms] inbound/vmess[vmess-in]: [Vmess] inbound connection to 192.73.248.83:443
+0000 2026-01-19 06:35:55 INFO [855092830 148ms] outbound/direct[direct]: outbound connection to 192.73.248.83:443
+0000 2026-01-19 06:35:55 INFO [2385247550 141ms] inbound/shadowtls[3]: [shadowTLS] inbound connection to :0
+0000 2026-01-19 06:35:55 INFO [2385247550 141ms] inbound/vmess[vmess-in]: [Vmess] inbound connection to 185.34.3.207:443
+0000 2026-01-19 06:35:55 INFO [2385247550 141ms] outbound/direct[direct]: outbound connection to 185.34.3.207:443

Supporter

• I am a sponsor

Integrity requirements

• I confirm that I have read the documentation, understand the meaning of all the configuration items I wrote, and did not pile up seemingly useful options or default values.
• I confirm that I have provided the server and client configuration files and process that can be reproduced locally, instead of a complicated client configuration file that has been stripped of sensitive data.
• I confirm that I have provided the simplest configuration that can be used to reproduce the error I reported, instead of depending on remote servers, TUN, graphical interface clients, or other closed-source software.
• I confirm that I have provided the complete configuration files and logs, rather than just providing parts I think are useful out of confidence in my own intelligence.

Start by reproducing the failure with the client and server configurations in the issue, comparing sing-box 1.12.12 with 1.13.0-beta.7 and reviewing the client reset and server connection logs. Done means the vmess detour through shadowTLS connects successfully on the newer version with the supplied configuration.