This is a security release. It fixes several vulnerabilities reported privately to us, and everyone running the self-hosted image should upgrade. Security advisories with full details will follow.
⚠️ Self-hosters: read before upgrading
If you use our Docker Compose file, download the new docker/prod/compose.yml. It passes the new settings below through to the container.
Admin page: only the instance admin can open it now. Before this release, every signed-in user on a self-hosted instance had full admin access (SES settings, teams, waitlist). Now only the first user who signed up is the admin. To choose someone else, set ADMIN_EMAIL to their account email (exact match). If no account has that email, the first user stays admin and a warning is logged, so you can't lock yourself out (#479).
SES events are now verified. Delivery, bounce, open and click events that arrive at /api/ses_callback must carry a valid AWS SNS signature, and subscription confirmations are only accepted from AWS SNS hosts. Forged events are rejected (#466). If your email statuses stop updating after the upgrade:
- set
SNS_SIGNATURE_VERIFICATION=log-onlyto accept events while logging failures, and open an issue - if you use an SNS emulator such as LocalStack, set
AWS_SNS_ENDPOINT(andAWS_SES_ENDPOINT) together withlog-only(#485)
Webhooks to internal addresses. Self-hosted instances still allow webhooks to private hosts by default (for example http://n8n:5678 on the same Docker network). If you don't trust every user who can create webhooks, set WEBHOOK_ALLOW_PRIVATE_URLS=false to only allow public URLs. Redirects from webhook endpoints are no longer followed (#467).
SMTP proxy: renewed certificates load on their own. The proxy used to keep serving its old TLS certificate after certbot renewed it, until the container restarted, so clients eventually saw "certificate verify failed". It now re-reads the certificate every 5 minutes (TLS_RELOAD_INTERVAL_MS) and swaps it in without a restart. It also logs a warning when the certificate is within 14 days of expiry (#488).
Other changes you might notice:
- Deleting a domain revokes the API keys restricted to it. Before, those keys silently became unrestricted (#490).
- Domain-restricted API keys can only read and manage campaigns sent from their own domain, can only send batches from their own domain, and can't create domains (
403) (#490). - Team invites can only be seen and accepted by the email address they were sent to (#489).
Security
- Self-hosted admin access restricted to the instance admin (#479).
- SES callback verifies AWS SNS signatures (#466, #485).
- Webhooks: non-public and cloud-metadata addresses are rejected on cloud and optionally on self-hosted, with the address checked at connect time (#467).
- Templates are scoped to the sending team, and template variables are substituted literally (#478).
- Team invites are bound to the invited email (#489).
- Domain-restricted API keys are enforced on campaign routes, batch sends, domain creation and domain deletion (#490).
- Next.js 15.5.28 → 15.5.29, the November 3 security release (#491).
Fixes
- No more jsx-email "Butan" deprecation warning on every email render (#469).
Thanks
- The security researchers who reported these issues privately. You'll be credited in the advisories.
- @rubixvi for flagging the Next.js 15.5.29 release in #487.
What's Changed
- fix: stop jsx-email Butan deprecation warning on every email render by @KMKoushik in #469
- fix(ses): verify AWS SNS signatures on the SES callback by @polylane in #466
- fix(email): scope templates to the sending team and substitute variables literally by @KMKoushik in #478
- fix(smtp): reload renewed TLS certificates without a restart by @KMKoushik in #488
- fix(ses): let self-hosters use SNS emulators and the log-only switch by @KMKoushik in #485
- fix(webhooks): reject internal and metadata addresses in webhook delivery by @polylane in #467
- fix(admin): restrict admin routes to the instance admin on self-hosted by @KMKoushik in #479
- fix(teams): only let the invited email see and accept a team invite by @KMKoushik in #489
- fix(api): enforce domain-restricted API keys on campaign routes and domain creation by @KMKoushik in #490
- fix(deps): bump Next.js to 15.5.29 for the November security release by @KMKoushik in #491
Full Changelog: v1.10.0...v1.10.1