CVE-2026-45709

Mailpit is an email testing tool and API for developers. The fix for GHSA-6jxm-fv7w-rw5j CVE-2026-23845, "Server-Side Request Forgery SSRF via HTML Check API", shipped in mailpit "v1.28.3", hardened "internal/htmlcheck/css.go::downloadCSSToBytes" with a 5MB size cap, a "text/css" content-type...