Mailpit 1.31.1 Security Release!

Security release!

Security

  • Add --allowed-hosts flag to mitigate DNS rebinding against the API

Chore

  • Update Go dependencies
  • Update node dependencies
  • Update Github Actions

Fix

  • Block Azure WireServer, IPv4-translated prefix and additional reserved ranges in SSRF deny-list
  • Pass line-boundary state to drainData to prevent SMTP desync
  • Allow SP inside quoted local-parts per RFC 5321 (#731)
  • Bound header-rewrite scanner to header block and fail closed on missing header
  • Prevent quadratic CPU in proxy CSS rewriter via O(1) asset dedup

Our Supporters

Joomdonation
OCH
AM Graphix
Simplify your web
Tassos gr
Bear

Sorry, this website uses features that your browser doesn't support. Upgrade to a newer version of Firefox, Chrome, Safari, or Edge and you'll be all set.