bulwarkmail/webmail 1.9.2

v1.9.2 - Security Fix for DNS-Rebinding SSRF (GHSA-24w9-8r42-8jwm) & Spam-Free Push Notifications

on GitHub

1.9.2 (2026-08-26)

Thank you for your donations:

• You? Become a sponsor!

One-time

• Anonymous
• @elsbrock
• @getpankajyadav

Monthly

• @NABarnes
• @felixzieger
• @pr0ton11
• @zeddD1abl0
• @fpauser
• @proxforge
• @spss20
• @elgringoYan
• @pauladams8
• @djpriest
• @umakers
• @zplizzi
• @jeremiah
• @Theoretisch1337
• @svandive
• @HiltMundell

Security

• Calendar / Auth: Pin the resolved IP address at socket-connect time when fetching caller-supplied URLs (iCalendar subscriptions, JMAP login and TOTP token-exchange servers). The public-host check used to run before fetch() opened its socket, so an attacker who controlled DNS for a hostname could rebind it to loopback, RFC-1918 or cloud-metadata addresses between the check and the connect and read up to 10 MB of the internal response through the unauthenticated /api/fetch-ical endpoint. Redirect targets are now validated the same way (GHSA-24w9-8r42-8jwm, thanks @Tike00)

Features

• Push: Re-sync existing push registrations in the background on app start, so registrations created before the delivery filter existed — or whose Junk mailbox id went stale — get repaired without re-enabling notifications

Fixes

• Push: Stop sending notifications for spam — the push subscription now carries a JMAP emailPush delivery filter that excludes $junk and the Junk mailbox (needs a server advertising the emailPush capability, e.g. Stalwart ≥ 0.16.16; older servers keep the previous behaviour)