This release adds an optional feature to mitigate DNS rebinding attacks (read more), as well as other hardening fixes. Security Add --allowed-hosts flag to mitigate DNS rebinding against the API Chore Update Go dependencies Update node dependencies Update Github Actions Fix Block Azure WireServer, IPv4-translated prefix and additional reserved ranges in SSRF deny-list Pass line-boundary state to d…
Feature Add deep dark theme (#728) Add debounced search refresh for filtered views on new messages Chore Make read/unread message state clearly distinguishable (WCAG AA) Add accessible names to icon-only buttons and fix sender tag mismatch Update Go dependencies Update node dependencies Update caniemail test database Update GitHub Actions Fix Include all IANA special-use IPv4 ranges in IsInternalI…
Chore Add software license information (#724) Update Go dependencies Update node dependencies Update GitHub Actions dependencies Fix Database lock when delete request contains duplicate IDs (#723) Test Add tests for requests containing duplicate & invalid IDs
This release includes several security and bug fixes Many thanks to the security researcher who responsibly disclosed a security issue, helping to improve Mailpit's security. Security Prevent WebSocket CORS origin check bypass via percent-encoded path (GHSA-8r62-w5wh-fc5m) Implement POP3 failed login tracking and disconnect after multiple attempts Redact POP3 password in debug logs to prevent cred…
This release includes a security fix, so upgrading is strongly recommended. One security vulnerability affecting publicly exposed (SMTP) instances of Mailpit has been fixed in this release. Details are provided below. Many thanks to the security researcher who responsibly disclosed this issue and helped improve Mailpit's security. Security Prevent SMTP DATA line exceeding MaxSize (GHSA-r553-m4fv-5…
This release includes two important security fixes, so upgrading is strongly recommended. Two security vulnerabilities affecting publicly exposed (SMTP) instances of Mailpit have been fixed in this release. Details are provided below. Many thanks to the security researcher who responsibly disclosed these issues and helped improve Mailpit's security. Security Enforce command line length limits in S…
Security Add link check rate limiting and caching mechanism Chore Update Go dependencies Update node dependencies Fix Correctly parse after/before datetimes with timestamp in search query (#704) Update Swagger response definitions for MessageHeadersResponse (#703) Refactor Web UI configuration definitions in Swagger documentation Handle MaxBytesError in SendMessageHandler and return JSON error res…
This release includes an important security fixes, so upgrading is strongly recommended. This release includes a security fix which closes an additional IPv6 address bypasses that could allow the Link Check API to reach internal services or cloud metadata endpoints. Security Fix incomplete SSRF protection in IsInternalIP() detection for IPv6 transition mechanisms (GHSA-w4mc-hhc6-xp28) Feature Add…
Security Extend request body size cap to all JSON API endpoints (GHSA-28pq-6qxg-wg5r) Pin Github Actions workflow versions using full commit SHA Do not use npm cache to prevent cache poisoning Disable GitHub Actions credential persistence for checkout steps Chore Enhance schema application logging (#688) Change log level to Info for database vacuuming message (#688) Update Github Action workflows…
This release includes an important security fixes, so upgrading is strongly recommended. This release introduces a default message size limit for both SMTP and api/v1/send to prevent DoS attacks via unbounded message sizes. This limit can be configured or disabled as needed, but the default is set to 50MB to provide a reasonable safeguard against abuse and align with some common email server limit…
This is just a security release to update all Go, node and docker image dependencies. Chore Bump vue-router from 4.6.4 to 5.0.4 Bump axios version to 1.15.0 Update Go dependencies Update node dependencies
Chore Bump docker/login-action from 3 to 4 (#670) Bump actions/stale from 10.1.1 to 10.2.0 (#669) Bump docker/setup-buildx-action from 3 to 4 (#668) Bump docker/setup-qemu-action from 3 to 4 (#666) Bump docker/build-push-action from 6 to 7 (#665) Update Go dependencies Update node dependencies Fix Version check logic in version command and self updater (#673)
Security Add sandbox attribute to message iframe for extra layer of security (already protected via CSP headers) Feature Add option to disable auto-VACUUMing of the SQLite database (#661) Chore Update Go dependencies Update node dependencies
[v1.29.4] Feature Add filter functionality to message headers tab Chore Update Go dependencies Update node dependencies Fix Refactor webhook delay & rate limit logic to ignore endpoint response times & prevent hardcoded 1000 message limit when set to 0 (#656)
Security Enhance CORS origin handling to respect host:port distinctions Limit proxy requests to 50MB to prevent OOM attacks Enhance HTML sanitization in message view Enhance HTML sanitization in screenshot generation Escape ContentID in HTML replacement to prevent regex injection Chore Use last release + git hash in Docker edge versions Refactor code with go fix Switch to math/rand/v2 Refactor API…
This release includes an important security fix, so upgrading is strongly recommended. This security release fixes CVE-2026-27808: users could use the Link Check API to probe internal network IPs/hostnames. The exploit required user access to both the API and the SMTP server, so the risk is limited to users who have publicly-accessible Mailpit instances with no authentication on both the API and S…