Feature Add optional Subject prefix for SMTP relay & forward (#755) Add optional Rspamd integration for spam checking Chore Implement dynamic check tabs for HTML, Link, and Spam checks in message view Update Go dependencies Update node dependencies Update Github Actions dependencies Fix Limit envelope cache to messages with images and bound its memory (#754) Negated size and date searches miss or…
This release includes security fixes, so upgrading is strongly recommended. A maliciously crafted image attached to an email could make the thumbnail generator (used by the web UI and API) spin in an infinite loop. The exif reader has been replaced with a minimal in-tree EXIF orientation reader that only reads the first block and never follows pointers. This release also strips <base> and meta ref…
Fix Remove expired envelope cache entries and clear them on auto-prune (#748)
Chore Add gosec #nosec annotations and set explicit Content-Type on error responses Update Go dependencies Update node dependencies Fix Escape _ and % in search terms so they match literally (#742) Match & and \ in address searches (#743) Validate AUTH parameter in MAIL FROM command (#744) MAIL FROM parameters must be space-separated per RFC 5321 Test Include additional tests for MAIL FROM paramet…
Fix Prevent duplicate messages from being added in websocket handlers (#737) Set hostname for HELO/EHLO in SMTP client creation (#738) Chore Update Go dependencies Update node dependencies Update GitHub Actions dependencies
Chore Limit maximum MIME parts parsed per message to 500 Refactor regex usage for string cleaning and normalization Optimize envelope parsing by using a shared parser instance Optimize message summary construction by eliminating JSON round-trip Replace bytes.ToLower with containsFold for case-insensitive tag matching Replace inline regex for leading whitespace with a package-level variable Symlink…
This release includes a security fix, so upgrading is strongly recommended. A vulnerability was fixed which allowed animated image attachments (APNG, GIF, WebP) to bypass the thumbnail pixel budget, potentially causing multi-gigabyte memory allocation when the thumbnail was rendered. Many thanks to the security researcher who responsibly disclosed this issue and helped improve Mailpit's security.…
This release adds an optional feature to mitigate DNS rebinding attacks (read more), as well as other hardening fixes. Security Add --allowed-hosts flag to mitigate DNS rebinding against the API Chore Update Go dependencies Update node dependencies Update Github Actions Fix Block Azure WireServer, IPv4-translated prefix and additional reserved ranges in SSRF deny-list Pass line-boundary state to d…
Feature Add deep dark theme (#728) Add debounced search refresh for filtered views on new messages Chore Make read/unread message state clearly distinguishable (WCAG AA) Add accessible names to icon-only buttons and fix sender tag mismatch Update Go dependencies Update node dependencies Update caniemail test database Update GitHub Actions Fix Include all IANA special-use IPv4 ranges in IsInternalI…
Chore Add software license information (#724) Update Go dependencies Update node dependencies Update GitHub Actions dependencies Fix Database lock when delete request contains duplicate IDs (#723) Test Add tests for requests containing duplicate & invalid IDs
This release includes several security and bug fixes Many thanks to the security researcher who responsibly disclosed a security issue, helping to improve Mailpit's security. Security Prevent WebSocket CORS origin check bypass via percent-encoded path (GHSA-8r62-w5wh-fc5m) Implement POP3 failed login tracking and disconnect after multiple attempts Redact POP3 password in debug logs to prevent cred…
This release includes a security fix, so upgrading is strongly recommended. One security vulnerability affecting publicly exposed (SMTP) instances of Mailpit has been fixed in this release. Details are provided below. Many thanks to the security researcher who responsibly disclosed this issue and helped improve Mailpit's security. Security Prevent SMTP DATA line exceeding MaxSize (GHSA-r553-m4fv-5…
This release includes two important security fixes, so upgrading is strongly recommended. Two security vulnerabilities affecting publicly exposed (SMTP) instances of Mailpit have been fixed in this release. Details are provided below. Many thanks to the security researcher who responsibly disclosed these issues and helped improve Mailpit's security. Security Enforce command line length limits in S…
Security Add link check rate limiting and caching mechanism Chore Update Go dependencies Update node dependencies Fix Correctly parse after/before datetimes with timestamp in search query (#704) Update Swagger response definitions for MessageHeadersResponse (#703) Refactor Web UI configuration definitions in Swagger documentation Handle MaxBytesError in SendMessageHandler and return JSON error res…
This release includes an important security fixes, so upgrading is strongly recommended. This release includes a security fix which closes an additional IPv6 address bypasses that could allow the Link Check API to reach internal services or cloud metadata endpoints. Security Fix incomplete SSRF protection in IsInternalIP() detection for IPv6 transition mechanisms (GHSA-w4mc-hhc6-xp28) Feature Add…
Security Extend request body size cap to all JSON API endpoints (GHSA-28pq-6qxg-wg5r) Pin Github Actions workflow versions using full commit SHA Do not use npm cache to prevent cache poisoning Disable GitHub Actions credential persistence for checkout steps Chore Enhance schema application logging (#688) Change log level to Info for database vacuuming message (#688) Update Github Action workflows…
This release includes an important security fixes, so upgrading is strongly recommended. This release introduces a default message size limit for both SMTP and api/v1/send to prevent DoS attacks via unbounded message sizes. This limit can be configured or disabled as needed, but the default is set to 50MB to provide a reasonable safeguard against abuse and align with some common email server limit…
This is just a security release to update all Go, node and docker image dependencies. Chore Bump vue-router from 4.6.4 to 5.0.4 Bump axios version to 1.15.0 Update Go dependencies Update node dependencies
Chore Bump docker/login-action from 3 to 4 (#670) Bump actions/stale from 10.1.1 to 10.2.0 (#669) Bump docker/setup-buildx-action from 3 to 4 (#668) Bump docker/setup-qemu-action from 3 to 4 (#666) Bump docker/build-push-action from 6 to 7 (#665) Update Go dependencies Update node dependencies Fix Version check logic in version command and self updater (#673)
Security Add sandbox attribute to message iframe for extra layer of security (already protected via CSP headers) Feature Add option to disable auto-VACUUMing of the SQLite database (#661) Chore Update Go dependencies Update node dependencies
[v1.29.4] Feature Add filter functionality to message headers tab Chore Update Go dependencies Update node dependencies Fix Refactor webhook delay & rate limit logic to ignore endpoint response times & prevent hardcoded 1000 message limit when set to 0 (#656)
Security Enhance CORS origin handling to respect host:port distinctions Limit proxy requests to 50MB to prevent OOM attacks Enhance HTML sanitization in message view Enhance HTML sanitization in screenshot generation Escape ContentID in HTML replacement to prevent regex injection Chore Use last release + git hash in Docker edge versions Refactor code with go fix Switch to math/rand/v2 Refactor API…
This release includes an important security fix, so upgrading is strongly recommended. This security release fixes CVE-2026-27808: users could use the Link Check API to probe internal network IPs/hostnames. The exploit required user access to both the API and the SMTP server, so the risk is limited to users who have publicly-accessible Mailpit instances with no authentication on both the API and S…