github.com/axllent/mailpit

This release includes a security fix, so upgrading is strongly recommended.

A vulnerability was fixed which allowed animated image attachments (APNG, GIF, WebP) to bypass the thumbnail pixel budget, potentially causing multi-gigabyte memory allocation when the thumbnail was rendered.

Many thanks to the security researcher who responsibly disclosed this issue and helped improve Mailpit's security.

Security

• Bound thumbnail decode to single frame (GHSA-2vgv-6hcp-mf43)

Feature

• Add major version tag for Docker images in workflow (#734)

Chore

• Improve message rendering performance with envelope caching
• Update Go dependencies
• Update node dependencies
• Update caniemail test database

Fix

• Re-quote local-parts in API JSON responses (#732)

This release adds an optional feature to mitigate DNS rebinding attacks (read more), as well as other hardening fixes.

Security

• Add --allowed-hosts flag to mitigate DNS rebinding against the API

Chore

• Update Go dependencies
• Update node dependencies
• Update Github Actions

Fix

• Block Azure WireServer, IPv4-translated prefix and additional reserved ranges in SSRF deny-list
• Pass line-boundary state to drainData to prevent SMTP desync
• Allow SP inside quoted local-parts per RFC 5321 (#731)
• Bound header-rewrite scanner to header block and fail closed on missing header
• Prevent quadratic CPU in proxy CSS rewriter via O(1) asset dedup

Feature

• Add deep dark theme (#728)
• Add debounced search refresh for filtered views on new messages

Chore

• Make read/unread message state clearly distinguishable (WCAG AA)
• Add accessible names to icon-only buttons and fix sender tag mismatch
• Update Go dependencies
• Update node dependencies
• Update caniemail test database
• Update GitHub Actions

Fix

• Include all IANA special-use IPv4 ranges in IsInternalIP check
• Prevent SMTP command injection via drainData fragment-boundary bypass
• Validate Send API custom header keys per RFC 5322

Chore

• Add software license information (#724)
• Update Go dependencies
• Update node dependencies
• Update GitHub Actions dependencies

Fix

• Database lock when delete request contains duplicate IDs (#723)

Test

• Add tests for requests containing duplicate & invalid IDs

This release includes several security and bug fixes

Many thanks to the security researcher who responsibly disclosed a security issue, helping to improve Mailpit's security.

Security

• Prevent WebSocket CORS origin check bypass via percent-encoded path (GHSA-8r62-w5wh-fc5m)
• Implement POP3 failed login tracking and disconnect after multiple attempts
• Redact POP3 password in debug logs to prevent credential exposure

Chore

• Add ReadHeaderTimeout to HTTP server configuration
• Update node dependencies
• Update Go dependencies
• Update caniemail database
• Update Github Actions dependencies

Fix

• Prevent protocol desynchronization by draining oversized message data
• Prevent marking already deleted POP messages for deletion
• Ensure deleted POP3 messages are excluded from LIST and STAT commands
• Update content type handling for attachments to ensure proper file downloads
• Sanitise active Content-Type in attachment downloads
• Escape file names in Content-Disposition header for thumbnail responses
• Allow passwords with spaces in POP3 authentication
• Implement dot-stuffing for TOP commands in POP3 server
• Correct order of setting headers and writing HTTP error response
• Handle client disconnection during DATA read with appropriate logging in SMTPD server (#721)

Test

• Add brute force POP3 login protection test
• Add more WebSocket CORS tests
• Enhance CORS middleware tests for HTML preview route handling

This release includes a security fix, so upgrading is strongly recommended.

One security vulnerability affecting publicly exposed (SMTP) instances of Mailpit has been fixed in this release. Details are provided below.

Many thanks to the security researcher who responsibly disclosed this issue and helped improve Mailpit's security.

Security

• Prevent SMTP DATA line exceeding MaxSize (GHSA-r553-m4fv-5v97)

Chore

• Update Go dependencies
• Update node dependencies

This release includes two important security fixes, so upgrading is strongly recommended.

Two security vulnerabilities affecting publicly exposed (SMTP) instances of Mailpit have been fixed in this release. Details are provided below.

Many thanks to the security researcher who responsibly disclosed these issues and helped improve Mailpit's security.

Security

• Enforce command line length limits in SMTP and POP3 handlers (GHSA-w878-pj84-3j5v)
• Reject oversized image dimensions in thumbnail handler before full decode (GHSA-75mr-qw9x-3r39)

Chore

• Refactor browser storage settings for consistency (#715)
• Update Go dependencies
• Update node dependencies
• Update caniemail test database
• Update Github Action requirements

Fix

• Exclude supported clients in HTML check results (#716)

Security

• Add link check rate limiting and caching mechanism

Chore

• Update Go dependencies
• Update node dependencies

Fix

• Correctly parse after/before datetimes with timestamp in search query (#704)
• Update Swagger response definitions for MessageHeadersResponse (#703)
• Refactor Web UI configuration definitions in Swagger documentation
• Handle MaxBytesError in SendMessageHandler and return JSON error response

This release includes an important security fixes, so upgrading is strongly recommended.

This release includes a security fix which closes an additional IPv6 address bypasses that could allow the Link Check API to reach internal services or cloud metadata endpoints.

Security

• Fix incomplete SSRF protection in IsInternalIP() detection for IPv6 transition mechanisms (GHSA-w4mc-hhc6-xp28)

Feature

• Add wait support to readyz (#697)

Chore

• Compress websocket messages once per broadcast to improve performance (#695)
• Toggle websocket compression using HTTP compression setting (#695)
• Update Github Actions dependencies
• Update Go dependencies
• Update node dependencies

Fix

• Adjust header setting order in error response functions (#699)

Test

• Add readyz tests

Security

• Extend request body size cap to all JSON API endpoints (GHSA-28pq-6qxg-wg5r)
• Pin Github Actions workflow versions using full commit SHA
• Do not use npm cache to prevent cache poisoning
• Disable GitHub Actions credential persistence for checkout steps

Chore

• Enhance schema application logging (#688)
• Change log level to Info for database vacuuming message (#688)
• Update Github Action workflows
• Update Go dependencies
• Update node dependencies
• Update caniemail test database

This release includes an important security fixes, so upgrading is strongly recommended.

This release introduces a default message size limit for both SMTP and api/v1/send to prevent DoS attacks via unbounded message sizes. This limit can be configured or disabled as needed, but the default is set to 50MB to provide a reasonable safeguard against abuse and align with some common email server limits.

A big thanks to the security researchers who reported these issues and helped improve Mailpit's security!

Security

• Set a default 50MB per message limit to prevent DoS via unlimited SMTP DATA and /api/v1/send body sizes (GHSA-fpxj-m5q8-fphw)
• Include CGNAT (Carrier-Grade NAT) in internal IP checks (GHSA-j3fj-qppj-fmmc)
• Block internal IP access by default in HTML check (GHSA-j3fj-qppj-fmmc)
• Fix for path traversal & arbitrary file write in mailpit dump --http <instance> via attacker-controlled message IDs (GHSA-qx5x-85p8-vg4j)
• Fix concurrent map read & write in proxy CSS rewriter (GHSA-w4vj-r5pg-3722)

Feature

• New UI loading indicator, reduce flash during message transitions (#682)

Chore

• Bump vue-router from 4.6.4 to 5.0.4
• Bump axios version to 1.15.0
• Update Go dependencies
• Update node dependencies
• Remove gorilla/mux dependency and replace with stdlib routing
• Remove logrus dependency and implement slog-based logging
• Remove go-telnet dependency and implement TCP/Unix socket handling for SMTP
• Replace lithammer/shortuuid with custom shortuuid implementation and update tests
• Improve iframe height adjustment with optional chaining
• Bump axios version to v1.16.0
• Refactor Prometheus metrics implementation and remove unused dependencies
• Refactor MarkRead and MarkUnread functions to only broadcast changes of modified messages
• Optimize tag retrieval by batching message IDs in List and Search functions
• Enhance SetMessageTags function to improve tag handling and batch deletions
• Optimize MarkRead and MarkUnread functions to reduce database calls and improve performance
• Refactor pruneMessages function to eliminate duplicate ID checks using a map
• Refactor addMessageTag function to remove mutex and ensure safe concurrent inserts
• Refactor Hub to use atomic clientCount for safe concurrent client tracking
• Ensure websocket connection is closed on client unregistration
• Simplify writePump by using WriteMessage and remove unnecessary newline handling
• Add message dump --max-message-size flag and refactor message handling
• Add message ingest --max-message-size flag and refactor message handling
• Update Go dependencies
• Update node dependencies
• Update caniemail test database

Fix

• Validate SMTP XCLIENT args before processing

Build

• Update CI actions to use npm ci
• Tag Docker edge build with next patch versions

This is just a security release to update all Go, node and docker image dependencies.

Chore

• Bump vue-router from 4.6.4 to 5.0.4
• Bump axios version to 1.15.0
• Update Go dependencies
• Update node dependencies

Chore

• Bump docker/login-action from 3 to 4 (#670)
• Bump actions/stale from 10.1.1 to 10.2.0 (#669)
• Bump docker/setup-buildx-action from 3 to 4 (#668)
• Bump docker/setup-qemu-action from 3 to 4 (#666)
• Bump docker/build-push-action from 6 to 7 (#665)
• Update Go dependencies
• Update node dependencies

Fix

• Version check logic in version command and self updater (#673)

Security

• Add sandbox attribute to message iframe for extra later of security (already protected via CSP headers)

Feature

• Add option to disable auto-VACUUMing of the SQLite database (#661)

Chore

• Update Go dependencies
• Update node dependencies

Feature

• Add filter functionality to message headers tab

Chore

• Update Go dependencies
• Update node dependencies

Fix

• Refactor webhook delay & rate limit logic to ignore endpoint response times & prevent hardcoded 1000 message limit when set to 0 (#656)

Security

• Enhance CORS origin handling to respect host:port distinctions
• Limit proxy requests to 50MB to prevent OOM attacks
• Enhance HTML sanitization in message view
• Enhance HTML sanitization in screenshot generation
• Escape ContentID in HTML replacement to prevent regex injection

Chore

• Use last release + git hash in Docker edge versions
• Bump minimatch from 10.2.2 to 10.2.4
• Refactor code with go fix
• Switch to math/rand/v2
• Refactor API send authentication logic
• Refactor events websocket middleware
• Set timeout for HTTP client in webhook Send function
• Use local hostname for EHLO/HELO in SMTP communication
• Simplify HTML decoding function in screenshot generation using DOMParser
• Set margin & padding to HTML screenshot to prevent transparent top/left border
• Replace localStorage retrieval with a dedicated function for default release addresses
• Limit subject length to 100 characters in browser notifications
• Improve transaction handling in pruneMessages and fix loop continuation in InitDB
• Update Content-Disposition header to use inline display and escape filename
• Refactor timezone handling in searchQueryBuilder
• Update Go dependencies
• Update node dependencies

Fix

• Update SQL query to use tenant when using is:tagged filter

Security

• Prevent Server-Side Request Forgery (SSRF) via Link Check API (GHSA-mpf7-p9x7-96r3)

Chore

• Upgrade eslint JavaScript linting
• Update Go dependencies
• Update node dependencies
• Update caniemail test database

Fix

• Update install instructions when setting INSTALL_PATH
• Include 8BITMIME in SMTPD EHLO response (#648)

Chore

• Add CORS error logging and update error messages for failed CORS requests
• Bump axios from 1.13.4 to 1.13.5
• Update Go dependencies
• Update node dependencies

Fix

• Enable "Mark all read" button (Inbox) when new message is received

Feature

• Include message attachment checksums (MD5, SHA1 & SHA254) in API message summary
• Option to display/hide attachment information in message view in web UI including checksums, content type & disposition

Chore

• Add support for multi-origin CORS settings and apply to events websocket (#630)
• Add support for webhook delay (#627)
• Update Go dependencies
• Update node dependencies

Test

• Add CORS tests
• Add message summary attachment checksum tests

Chore

• Increase allowed SMTP email address length to 1024 chars & return clearer SMTP responses for failures (#620)
• Update Go dependencies
• Update node dependencies

Fix

• Ensure SMTP HELO/EHLO command is issued before MAIL FROM as per RFC 5321 (#621)
• Prevent nested MAIL command during an active SMTP transaction (#623)
• Avoid error on image type assertion in thumbnail generation

Security

• Ensure SMTP TO & FROM addresses are RFC 5322 compliant and prevent header injection (GHSA-54wq-72mp-cq7c)
• Prevent Server-Side Request Forgery (SSRF) via HTML Check API (GHSA-6jxm-fv7w-rw5j)

Chore

• Fix formatting and update reporting instructions in SECURITY.md (#614)
• Allow @ character in message tags & set max length to 100 characters per tag
• Update Go dependencies
• Update node dependencies

Fix

• Correctly render default addresses in release modal after settings change (#594)
• Correctly detect macOS group in install.sh (#619)
• Auto-tagging using SMTP username using plain auth (#617)
• Validate maximum lengths of email addresses - RFC5321 (section 4.5.3.1)

Test

• Update tag tests with length limits and @ character
• Add SMTP tests for address compliancy (RFC 5322) and header injection
• Add maximum email length validation tests - RFC5321 (section 4.5.3.1)

Security

• Prevent Cross-Site WebSocket Hijacking (CSWSH) allowing unauthenticated access to message data CVE-2026-22689

Feature

• Allow default mail addresses to be set when releasing message (#594)

Chore

• Remove webkit warnings about missing template / render functions
• Avoid empty URL query parameter when returning to inbox from message view

Security

• Restrict screenshot proxy to only support asset links contained in messages CVE-2026-21859

Chore

• Bump actions/checkout from 5 to 6 (#610)
• Bump actions/cache from 4 to 5 (#607)
• Bump actions/stale from 10.0.0 to 10.1.1 (#604)
• Bump actions/setup-node from 5 to 6 (#598)
• Bump esbuild from 0.25.12 to 0.27.2 (#611)
• Update Go dependencies
• Update node dependencies

Test

• Add inline message tests
• Increase swagger test timeout

Feature

• Optionally propagate SMTP errors (#588)

Chore

• Update Go dependencies
• Update node dependencies
• Update caniemail test database

Chore

• Update Go dependencies
• Update node dependencies
• Add type assertion for value in imaging assignment

Security

• Prevent potential information disclosure via indirect expvar library (Prometheus)

Chore

• Add tooltip to messages nav dropdown
• Update GitHub Actions
• Add tooltip to messages nav dropdown
• Update GitHub Actions
• Update Go dependencies
• Update node dependencies

Chore

• UI tweaks to pagination layout for clearer navigation (#568)
• Add margin to icons in release and delete buttons for consistent spacing
• Update navbar theme to use data-bs-theme attribute for consistency
• Update Go dependencies
• Update node dependencies

Chore

• Update Go dependencies
• Update node dependencies
• Update caniemail test database

Fix

• Move HELO/EHLO hostname setting to the correct position in SMTP client creation (#558)

Feature

• Add optional --no-release-check to version subcommand (#557)

Chore

• Set HELO/EHLO hostname when connecting to external SMTP server (#556)
• Update Go dependencies
• Update node dependencies

Chore

• Update Go dependencies
• Update node dependencies
• Update caniemail test database

Fix

• Support optional UIDL argument in POP3 server (#552)

Feature

• Allow rejected SMTP recipients to be silently dropped (#549)

Chore

• Update Go dependencies
• Update node dependencies
• Update caniemail test database

Fix

• Fix sendmail when using an --smtp-addr <ip>:<port> (#542)

Security

• Prevent integer overflow conversion to uint64
• Add ReadHeaderTimeout to Prometheus metrics server

Feature

• Add ability to generate self-signed (snakeoil) certificates for UI, SMTP and POP3 (#539)

Chore

• Allow sendmail to send to untrusted TLS server
• Update eslint config, remove neostandard
• Refactor JS functions and remove unused parameters
• Update Go dependencies
• Update node dependencies

Fix

• Use MaxMessages to determine pruning (#536)
• Support angle brackets for text/plain URLs with spaces (#535)
• Do not check latest release for Prometheus statistics (#522)

Chore

• Allow unknown href link protocols in HTML view such as myapp:// (#532)
• Update Go dependencies
• Update node dependencies

Chore

• Remove unused functionality/deadcode (golangci-lint)
• Refactor error handling and resource management across multiple files (golangci-lint)
• Refactor API Swagger definitions and remove unused structs
• Bump minimum Go version to v1.24.3 for jhillyerd/enmime/v2
• Switch version checks & self-updater to use ghru/v2
• Update Go dependencies
• Update node dependencies

Fix

• Align websocket new message values with global Message Summary (no null values) (#526)

Feature

• Store username with messages, auto-tag, and UI display (#521)
• Allow version checking to be disabled (#524)

Chore

• Apply linting to all JavaScript/Vue files with eslint & prettier
• Update Go dependencies
• Update node dependencies

Fix

• Improve version polling, add thread safety and exponential backoff (#523)

Test

• Add JavaScript linting tests to CI
• Add Go linting (gofmt) to CI

Feature

• Add relay config to preserve (keep) original Message-IDs when relaying messages (#515)

Chore

• Update Go dependencies
• Update node dependencies
• Update caniemail testing database

Fix

• Add optional message_num argument in POP3 LIST command (#518)
• Use float64 for returned SQL value types for rqlite compatibility (#520)

Test

• Add small delay in POP3 test after disconnection to allow for background deletion in rqlite
• Add automated tests using the rqlite database

Feature

• Send API allow separate auth (#504)
• Add Prometheus exporter (#505)

Chore

• Add MP_DATA_FILE deprecation warning
• Update Go dependencies
• Update node dependencies

Fix

• Ignore basic auth for OPTIONS requests to API when CORS is set
• Fix sendmail symlink detection for macOS (#514)

Chore

• Switch from unnecessary float64 to uint64 API values for App Information, message & attachment sizes
• Extend latest version cache expiration from 5 to 15 minutes
• Lighten outline-secondary buttons in dark mode
• Add note to swagger docs about API date formats
• Update Go dependencies
• Update node dependencies

Fix

• Update bootstrap5-tags to fix text pasting in message release modal (#498)

Feature

• Add option to hide the "Delete all" button in web UI (#495)

Chore

• Upgrade to jhillyerd/enmime/v2
• Switch yaml parser to github.com/goccy/go-yaml
• Tweak UI to improve contrast between read & unread messages
• Adjust UI margin for side navigation
• Update Go dependencies
• Update node dependencies
• Update caniemail database

Fix

• Include SMTPUTF8 capability in SMTP EHLO response (#496)

Documentation

• Switch to git-cliff for changelog generation
• Add Message ListUnsubscribe to swagger / API documentation (#494)

Feature

• Display unread count in app badge (#485)

Chore

• Install script improvements & better error handling (#482)
• Update Go dependencies
• Update node dependencies
• Update caniemail database

Feature

• Add ability to mark all search results as read (#476)

Chore

• Bump node version to 22 for binary releases
• Improve error message for From header parsing failure (#477)
• Update Go dependencies
• Update node dependencies

Feature

• Add TLS relay support and refactor relay function (#471)
• Add TLS forwarding support and refactor forwarding function

Chore

• Update Go dependencies
• Standardize error message casing
• Update Go dependencies
• Update node dependencies

Chore

• Update node dependencies
• Use Message-ID header instead of Message-Id when generating new IDs (RFC 5322)
• Improve inline HTML Check style detection (#467)
• Update Go dependencies

Test

• Add tests for inline HTML Checks

Chore

• Replace PrismJS with highlight.js for HTML syntax highlighting
• Update Go dependencies
• Update node dependencies

Fix

• Allow searching messages using only Cyrillic characters (#450)
• Prevent cropping bottom of label characters in web UI (#457)

Feature

• Add configuration to set message compression level in db (0-3) (#447 & #448)
• Add configuration to explicitly disable HTTP compression in web UI/API (#448)
• Add configuration to disable SQLite WAL mode for NFS compatibility

Chore

• Avoid shell in Docker health check (#444)
• Handle BLOB storage for default database differently to rqlite to reduce memory overhead (#447)
• Optimize ZSTD encoder for fastest compression of messages (#447)
• Minor speed & memory improvements when storing messages
• Update Go dependencies
• Update node dependencies

Fix

• Display the correct STARTTLS or TLS runtime option on startup (#446)

Test

• Add tests for message compression levels