mkcertWeb

v4.3.1 Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

Published 10d Developer Productivity

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 2 known CVEs

Topics

authority certificate certificates development https linux

+6 more

localhost macos open-ssl root-ca tls windows

Affected surfaces

deps

ReleasePort's take

Moderate signal

editorial:auto 9d

Upgrade multer to 2.2.0 and nodemailer to 9.0.3; both releases patch denial‑of‑service vulnerabilities.

Why it matters: Multer 2.1.1 → 2.2.0 fixes two DoS issues (GHSA-72gw‑mp4g‑v24j, GHSA-3p4h‑7m6x‑2hcm); nodemailer 8.0.7 → 9.0.3 resolves a high‑severity GHSA‑p6gq‑j5cr‑w38f plus three moderate advisories—critical for preventing service interruptions.

Summary

AI summary

Security fixes: multer and nodemailer upgrades close denial‑of‑service vectors.

Changes in this release

Type	Severity	Summary	CVE
Security
Security	High	Upgrade multer from 2.1.1 to 2.2.0, fixing two denial-of-service vulnerabilities (GHSA-72gw-mp4g-v24j, GHSA-3p4h-7m6x-2hcm). Upgrade multer from 2.1.1 to 2.2.0, fixing two denial-of-service vulnerabilities (GHSA-72gw-mp4g-v24j, GHSA-3p4h-7m6x-2hcm). Source: llm_adapter@2026-07-17 Confidence: high	—
Security	High	Upgrade nodemailer from 8.0.7 to 9.0.3, clearing high‑severity GHSA-p6gq-j5cr-w38f and three moderate advisories. Upgrade nodemailer from 8.0.7 to 9.0.3, clearing high‑severity GHSA-p6gq-j5cr-w38f and three moderate advisories. Source: llm_adapter@2026-07-17 Confidence: high	—
Security	High	Upgrade form-data from 4.0.5 to 4.0.6 (dev‑only), fixing CRLF injection vulnerability (GHSA-hmw2-7cc7-3qxx). Upgrade form-data from 4.0.5 to 4.0.6 (dev‑only), fixing CRLF injection vulnerability (GHSA-hmw2-7cc7-3qxx). Source: llm_adapter@2026-07-17 Confidence: high	—

Full changelog

A dependency-security release clearing all seven open Dependabot alerts. No application code changes.

Security

multer 2.1.1 → 2.2.0 — fixes two denial-of-service vectors in multipart parsing: crash via deeply nested field names (GHSA-72gw-mp4g-v24j, high) and disk exhaustion from incompletely cleaned-up aborted uploads (GHSA-3p4h-7m6x-2hcm, moderate). These were the only alerts with real exposure: /api/upload is reachable with a fetchable CSRF token when authentication is disabled (the Docker default).
nodemailer 8.0.7 → 9.0.3 — clears GHSA-p6gq-j5cr-w38f (high) plus three moderate advisories. None were exploitable as used (the email service never uses the raw option, jsonTransport, List-* headers, or OAuth2), but the fix for the high only exists on the 9.x line. The API surface the app uses (createTransport/sendMail/verify) is unchanged.
form-data 4.0.5 → 4.0.6 (dev-only, via axios) — CRLF injection in multipart names (GHSA-hmw2-7cc7-3qxx); test-suite exposure only.

npm audit now reports 0 vulnerabilities across all dependency scopes.

Full Changelog: https://github.com/jeffcaldwellca/mkcertWeb/compare/v4.3.0...v4.3.1

Security Fixes

multer 2.1.1 → 2.2.0 — fixes GHSA-72gw-mp4g-v24j (high) denial‑of‑service via deeply nested fields and GHSA-3p4h-7m6x-2hcm (moderate) disk exhaustion from aborted uploads
dep: nodemailer 8.0.7 → 9.0.3 — clears GHSA-p6gq-j5cr-w38f (high) and three moderate advisories

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track mkcertWeb

Get notified when new releases ship.

About mkcertWeb

Web based user interface for mkcert CLI internal CA

All releases →