github.com/axllent/mailpit

Feature

• Add deep dark theme (#728)
• Add debounced search refresh for filtered views on new messages

Chore

• Make read/unread message state clearly distinguishable (WCAG AA)
• Add accessible names to icon-only buttons and fix sender tag mismatch
• Update Go dependencies
• Update node dependencies
• Update caniemail test database
• Update GitHub Actions

Fix

• Include all IANA special-use IPv4 ranges in IsInternalIP check
• Prevent SMTP command injection via drainData fragment-boundary bypass
• Validate Send API custom header keys per RFC 5322

Chore

• Add software license information (#724)
• Update Go dependencies
• Update node dependencies
• Update GitHub Actions dependencies

Fix

• Database lock when delete request contains duplicate IDs (#723)

Test

• Add tests for requests containing duplicate & invalid IDs

This release includes several security and bug fixes

Many thanks to the security researcher who responsibly disclosed a security issue, helping to improve Mailpit's security.

Security

• Prevent WebSocket CORS origin check bypass via percent-encoded path (GHSA-8r62-w5wh-fc5m)
• Implement POP3 failed login tracking and disconnect after multiple attempts
• Redact POP3 password in debug logs to prevent credential exposure

Chore

• Add ReadHeaderTimeout to HTTP server configuration
• Update node dependencies
• Update Go dependencies
• Update caniemail database
• Update Github Actions dependencies

Fix

• Prevent protocol desynchronization by draining oversized message data
• Prevent marking already deleted POP messages for deletion
• Ensure deleted POP3 messages are excluded from LIST and STAT commands
• Update content type handling for attachments to ensure proper file downloads
• Sanitise active Content-Type in attachment downloads
• Escape file names in Content-Disposition header for thumbnail responses
• Allow passwords with spaces in POP3 authentication
• Implement dot-stuffing for TOP commands in POP3 server
• Correct order of setting headers and writing HTTP error response
• Handle client disconnection during DATA read with appropriate logging in SMTPD server (#721)

Test

• Add brute force POP3 login protection test
• Add more WebSocket CORS tests
• Enhance CORS middleware tests for HTML preview route handling

This release includes a security fix, so upgrading is strongly recommended.

One security vulnerability affecting publicly exposed (SMTP) instances of Mailpit has been fixed in this release. Details are provided below.

Many thanks to the security researcher who responsibly disclosed this issue and helped improve Mailpit's security.

Security

• Prevent SMTP DATA line exceeding MaxSize (GHSA-r553-m4fv-5v97)

Chore

• Update Go dependencies
• Update node dependencies

This release includes two important security fixes, so upgrading is strongly recommended.

Two security vulnerabilities affecting publicly exposed (SMTP) instances of Mailpit have been fixed in this release. Details are provided below.

Many thanks to the security researcher who responsibly disclosed these issues and helped improve Mailpit's security.

Security

• Enforce command line length limits in SMTP and POP3 handlers (GHSA-w878-pj84-3j5v)
• Reject oversized image dimensions in thumbnail handler before full decode (GHSA-75mr-qw9x-3r39)

Chore

• Refactor browser storage settings for consistency (#715)
• Update Go dependencies
• Update node dependencies
• Update caniemail test database
• Update Github Action requirements

Fix

• Exclude supported clients in HTML check results (#716)

Security

• Add link check rate limiting and caching mechanism

Chore

• Update Go dependencies
• Update node dependencies

Fix

• Correctly parse after/before datetimes with timestamp in search query (#704)
• Update Swagger response definitions for MessageHeadersResponse (#703)
• Refactor Web UI configuration definitions in Swagger documentation
• Handle MaxBytesError in SendMessageHandler and return JSON error response

This release includes an important security fixes, so upgrading is strongly recommended.

This release includes a security fix which closes an additional IPv6 address bypasses that could allow the Link Check API to reach internal services or cloud metadata endpoints.

Security

• Fix incomplete SSRF protection in IsInternalIP() detection for IPv6 transition mechanisms (GHSA-w4mc-hhc6-xp28)

Feature

• Add wait support to readyz (#697)

Chore

• Compress websocket messages once per broadcast to improve performance (#695)
• Toggle websocket compression using HTTP compression setting (#695)
• Update Github Actions dependencies
• Update Go dependencies
• Update node dependencies

Fix

• Adjust header setting order in error response functions (#699)

Test

• Add readyz tests

Security

• Extend request body size cap to all JSON API endpoints (GHSA-28pq-6qxg-wg5r)
• Pin Github Actions workflow versions using full commit SHA
• Do not use npm cache to prevent cache poisoning
• Disable GitHub Actions credential persistence for checkout steps

Chore

• Enhance schema application logging (#688)
• Change log level to Info for database vacuuming message (#688)
• Update Github Action workflows
• Update Go dependencies
• Update node dependencies
• Update caniemail test database

This release includes an important security fixes, so upgrading is strongly recommended.

This release introduces a default message size limit for both SMTP and api/v1/send to prevent DoS attacks via unbounded message sizes. This limit can be configured or disabled as needed, but the default is set to 50MB to provide a reasonable safeguard against abuse and align with some common email server limits.

A big thanks to the security researchers who reported these issues and helped improve Mailpit's security!

Security

• Set a default 50MB per message limit to prevent DoS via unlimited SMTP DATA and /api/v1/send body sizes (GHSA-fpxj-m5q8-fphw)
• Include CGNAT (Carrier-Grade NAT) in internal IP checks (GHSA-j3fj-qppj-fmmc)
• Block internal IP access by default in HTML check (GHSA-j3fj-qppj-fmmc)
• Fix for path traversal & arbitrary file write in mailpit dump --http <instance> via attacker-controlled message IDs (GHSA-qx5x-85p8-vg4j)
• Fix concurrent map read & write in proxy CSS rewriter (GHSA-w4vj-r5pg-3722)

Feature

• New UI loading indicator, reduce flash during message transitions (#682)

Chore

• Bump vue-router from 4.6.4 to 5.0.4
• Bump axios version to 1.15.0
• Update Go dependencies
• Update node dependencies
• Remove gorilla/mux dependency and replace with stdlib routing
• Remove logrus dependency and implement slog-based logging
• Remove go-telnet dependency and implement TCP/Unix socket handling for SMTP
• Replace lithammer/shortuuid with custom shortuuid implementation and update tests
• Improve iframe height adjustment with optional chaining
• Bump axios version to v1.16.0
• Refactor Prometheus metrics implementation and remove unused dependencies
• Refactor MarkRead and MarkUnread functions to only broadcast changes of modified messages
• Optimize tag retrieval by batching message IDs in List and Search functions
• Enhance SetMessageTags function to improve tag handling and batch deletions
• Optimize MarkRead and MarkUnread functions to reduce database calls and improve performance
• Refactor pruneMessages function to eliminate duplicate ID checks using a map
• Refactor addMessageTag function to remove mutex and ensure safe concurrent inserts
• Refactor Hub to use atomic clientCount for safe concurrent client tracking
• Ensure websocket connection is closed on client unregistration
• Simplify writePump by using WriteMessage and remove unnecessary newline handling
• Add message dump --max-message-size flag and refactor message handling
• Add message ingest --max-message-size flag and refactor message handling
• Update Go dependencies
• Update node dependencies
• Update caniemail test database

Fix

• Validate SMTP XCLIENT args before processing

Build

• Update CI actions to use npm ci
• Tag Docker edge build with next patch versions

This is just a security release to update all Go, node and docker image dependencies.

Chore

• Bump vue-router from 4.6.4 to 5.0.4
• Bump axios version to 1.15.0
• Update Go dependencies
• Update node dependencies