CVE-2026-54649

punchin-email is a Cloudflare Email Worker that provides two-way role aliases while relaying mail to a private inbox. Prior to 1.5.0, handleInbound delivers inbound alias mail with message.forward, which silently drops the added Reply-To header intended to route responses through the relay. When ...

CVE-2026-54649

punchin-email is a Cloudflare Email Worker providing two-way role aliases while relaying mail to a private inbox. Prior to 1.5.0 , the handleInbound handler delivers inbound alias mail via message.forward(), which silently drops the Reply-To header intended to route responses through the relay. W...

CVE-2026-54649 punchin-email: Operator inbox (FORWARD_TO) disclosed to correspondents on reply — Cloudflare forward() drops the relay Reply-To

punchin-email is a Cloudflare Email Worker that provides two-way role aliases while relaying mail to a private inbox. Prior to 1.5.0, handleInbound delivers inbound alias mail with message.forward, which silently drops the added Reply-To header intended to route responses through the relay. When ...

EUVD-2026-82386

punchin-email is a Cloudflare Email Worker that provides two-way role aliases while relaying mail to a private inbox. Prior to 1.5.0, handleInbound delivers inbound alias mail with message.forward, which silently drops the added Reply-To header intended to route responses through the relay. When ...

PT-2026-95067

Name of the Vulnerable Software and Affected Versions punchin-email versions prior to 1.5.0 Description punchin-email is a Cloudflare Email Worker that provides two-way role aliases while relaying mail to a private inbox. The handleInbound function delivers inbound alias mail using message.forwar...