Miniflux 2.3.1

Release date: May 29, 2026

Changes

Security

Fixed an OAuth account binding vulnerability that could allow users to associate arbitrary OAuth identities with their account.
Fixed an open redirect vulnerability caused by backslashes in relative redirect URLs.
Fixed a potential SQL injection vulnerability in dynamically generated ORDER BY clauses.
Hardened metrics endpoint authentication by using constant-time credential comparisons.

Bug Fixes

Fixed an issue where the stdlib cross-origin protection middleware could block legitimate requests in certain self-hosted environments. The middleware has been reverted.

Improvements

Added Korean language support.
Improved HTML truncation performance and reduced memory allocations.
Optimized feed discovery, subscription detection, date parsing, and tag filtering.
Simplified and refactored several storage and query-building components for better maintainability.

Dependencies

Updated several dependencies, including:

github.com/go-webauthn/webauthn 0.17.4
golang.org/x/crypto 0.52.0
golang.org/x/image 0.41.0
golang.org/x/net 0.55.0

As always, thank you to all contributors who helped improve Miniflux in this release.

Attachments