Valkey 9.1: 2.1M Req/s, Database-Level ACLs, and Lua Modularization — Redis Is No Longer the Default

Valkey 9.1 is the release that makes the Redis fork’s dominance official. The Linux Foundation announced it on May 19, 2026, and the headline benchmark alone makes the case: 2.1 million requests per second on 512-byte payloads, achieved through a completely redesigned I/O threading model. This is the release that consolidates Valkey’s position as the default in-memory key-value store across the major cloud platforms — AWS ElastiCache, GCP Memorystore, and Aiven have all migrated their managed offerings to Valkey.

The I/O threading rewrite is the biggest architectural change since the fork. The previous model had contention issues under sustained high-concurrency workloads. The new design reduces lock contention in the main event loop and distributes network I/O across threads more efficiently. The benchmark numbers are on canonical hardware — reproducible with the open test suite in the Valkey GitHub repository.

Security is substantially improved in 9.1. Database-level access control lists (ACLs) let operators restrict specific users to specific numbered databases, which was not possible in Redis’s flat ACL model. This is significant for multi-tenant deployments where different application namespaces share a single Valkey instance. Combined with TLS improvements and isolated authentication handling per connection, 9.1 is the first Valkey release that enterprise security teams can deploy without workarounds.

The Lua scripting engine is now a loadable module rather than a compiled-in core dependency. This sounds like an internals detail but has real consequences: you can now deploy a hardened Valkey instance with Lua disabled entirely, removing an entire attack surface that has historically been the source of sandbox escape vulnerabilities in Redis. Teams that don’t use server-side scripting should disable the module by default.

New commands in 9.1:

• HGETDEL — retrieves a hash field and deletes it atomically. Eliminates the GET + DEL race condition that has plagued distributed lock implementations.
• MSETEX — sets multiple keys with a shared expiry in one command. Useful for session data and feature flag caches with uniform TTLs.
• CLUSTERSCAN — cluster-aware key iteration that correctly handles hash slot routing. The old SCAN in cluster mode required client-side coordination; this handles it server-side.

The Valkey Registry now returns complete checksums (zh: and h1: formats) automatically during dependency resolution, closing a long-standing gap that required manual verification in Redis-compatible tooling.

If you are running Redis 7.x in self-hosted or cloud-managed environments, 9.1 is the right moment to plan migration. The API is wire-compatible — existing Redis clients work without modification. The performance gains and security hardening in 9.1 make it a straightforward upgrade decision. For teams on AWS or GCP, your managed offering may already be Valkey 9.1; check your cluster version in the console.