Nixpkgs security tracker

Try the new UI
Login with GitHub

Suggestion detail

Untriaged
Permalink CVE-2026-41259
created 4 months, 4 weeks ago Activity log
  • Created suggestion 4 months, 4 weeks ago
Mastodon: Insufficient verification of email addresses

Mastodon is a free, open-source social network server based on ActivityPub. Prior to v4.5.9, v4.4.16, and v4.3.22, Mastodon allows restricting new user sign-up based on e-mail domain names, and performs basic validation on e-mail addresses, but fails to restrict characters that are interpreted differently by some mailing servers. This vulnerability is fixed in v4.5.9, v4.4.16, and v4.3.22.

Affected products

mastodon
  • ==>= 4.4.0-beta.1, < 4.4.16
  • ==>= 4.5.0-beta.1, < 4.5.9
  • ==< 4.3.22

Matching in nixpkgs

pkgs.mastodon

Self-hosted, globally interconnected microblogging software based on ActivityPub

  • nixos-unstable -
    • nixos-unstable-small 4.6.8
  • nixos-26.05 -
    • nixos-26.05-small 4.6.8

pkgs.bitlbee-mastodon

Bitlbee plugin for Mastodon

  • nixos-unstable -
    • nixos-unstable-small 1.4.5
  • nixos-26.05 -
    • nixos-26.05-small 1.4.5

pkgs.mastodon-archive

Utility for backing up your Mastodon content

  • nixos-unstable -
    • nixos-unstable-small 1.4.8
  • nixos-26.05 -
    • nixos-26.05-small 1.4.8

Package maintainers