Mailpit

by Ralph Slootenv1.29.5

Last updated Jul 27, 2026

An email and SMTP testing tool with API for developers

Install with winget

$ winget install --id axllent.mailpit --exact --version 1.29.5

Run in Command Prompt, PowerShell, or Windows Terminal. Prompts for any agreements.

Built by Pckgr

For Intune admins

Stop chasing app updates. Pckgr patches them for you.

Automated application patching for Microsoft Intune. Pckgr keeps a curated library of 1,000+ apps continuously up-to-date in your tenant via Microsoft Graph - no manual repackaging, no chasing vendor sites.

Start free 30-day trial

No credit card required.

About

Mailpit is a small, fast, low memory, zero-dependency, multi-platform email testing tool & API for

developers.

It acts as an SMTP server, provides a modern web interface to view & test captured emails, and

includes an API for automated integration testing.

Mailpit was originally inspired by MailHog which is no longer maintained and hasn't seen active

development or security updates for a few years now.

Installers · v1.29.5

Architecture	Type	Scope	Install	Download
x64	ZIP archive	-		Direct
arm64	ZIP archive	-		Direct

Copy a command tailored to that specific architecture, type, and scope - useful when winget would otherwise pick a different default.

Security

10 known CVEs via NVD

medium5.3Fix in v1.30.1CVE-2026-48824affects before 1.30.1Jul 20, 2026
Mailpit is an email testing tool and API for developers. Prior to version 1.30.1, the fix for GHSA-fpxj-m5q8-fphw (CVE-2026-45710, "Mailpit: Set a default 50MB p/m limit to prevent DoS via unlimited SMTP DATA and /api/v1/send body sizes") wrapped only `POST /api/v1/send` with `h...
Vendor advisory
high7.5Fix in v1.30.0CVE-2026-45713affects before 1.30.0Jul 20, 2026
Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the Mailpit SMTP server has a Server.MaxSize int field that controls the maximum allowed DATA payload size, but the field is never assigned anywhere outside test code, leaving it at Go's zero value...
Vendor advisory
medium5.9Fix in v1.30.0CVE-2026-45712affects before 1.30.0Jul 20, 2026
Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the screenshot/print proxy (/proxy?data=…) maintains a package-level assets map[string]MessageAssets cache, but reads the map without holding assetsMutex while a long-running cleanup goroutine and...
Vendor advisory
medium5.9Fix in v1.30.0CVE-2026-45711affects before 1.30.0Jul 20, 2026
Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the mailpit dump --http <base-url> <out-dir> sub-command downloads every message from a remote Mailpit instance and writes each one as <id>.eml inside the user-supplied output directory. The messag...
Vendor advisory
medium5.8Fix in v1.30.0CVE-2026-45709affects before 1.30.0Jul 20, 2026
Mailpit is an email testing tool and API for developers. The fix for GHSA-6jxm-fv7w-rw5j (CVE-2026-23845, "Server-Side Request Forgery (SSRF) via HTML Check API"), shipped in mailpit `v1.28.3`, hardened `internal/htmlcheck/css.go::downloadCSSToBytes` with a 5MB size cap, a `text...
Vendor advisory
medium5.8Patched in wingetCVE-2026-27808affects before 1.29.2Feb 25, 2026
Mailpit is an email testing tool and API for developers. Prior to version 1.29.2, the Link Check API (/api/v1/message/{ID}/link-check) is vulnerable to Server-Side Request Forgery (SSRF). The server performs HTTP HEAD requests to every URL found in an email without validating ta...
Patch Vendor advisory
medium5.8Patched in wingetCVE-2026-23845affects before 1.28.3Jan 19, 2026
Mailpit is an email testing tool and API for developers. Versions prior to 1.28.3 are vulnerable to Server-Side Request Forgery (SSRF) via HTML Check CSS Download. The HTML Check feature (`/api/v1/message/{ID}/html-check`) is designed to analyze HTML emails for compatibility. Du...
Patch Vendor advisory
medium5.3Patched in wingetCVE-2026-23829affects before 1.28.3Jan 18, 2026
Mailpit is an email testing tool and API for developers. Prior to version 1.28.3, Mailpit's SMTP server is vulnerable to Header Injection due to an insufficient Regular Expression used to validate `RCPT TO` and `MAIL FROM` addresses. An attacker can inject arbitrary SMTP headers...
Patch

Showing 8 of 10. Source: NVD, updated 2h ago. Patch status is best-effort: NVD's fix version is compared against the latest version in winget, but the two version formats don't always align. Confirm with the vendor advisory before treating any specific build as safe.

See a CVE that affects your fleet? Push the patched version to Intune in one click with Pckgr - automated patching is the only way to keep up.

Related apps

O
Ollama (Portable)Ollama
Ollama.Ollama.Portablev0.20.2
Start building with open models.
C
CloudflareSpeedTestXIU2
XIU2.CloudflareSpeedTestv2.3.5
国外很多网站都在使用 Cloudflare CDN，但分配给中国内地访客的 IP 并不友好（延迟高、丢包多、速度慢）。虽然 Cloudflare 公开了所有 IP 段，但想要在这么多 IP 中找到适合自己的，怕是要累死，于是就有了这个软件。
Ente Authente.io
ente-io.auth-desktopv4.4.24
Open source 2FA authenticator, with end-to-end encrypted backups.
C
crocschollz
schollz.crocv11.0.1
Easily and securely send things from one computer to another.Easily and securely send things from one computer to another.
Ikemen GOIkemen GO
IkemenGO.IkemenGOv0.99.0
Ikemen GO is an open source fighting game engine that supports resources from the M.U.G.E.N engine, written in Google’s programming language, Go. It is a complete rewrite of a prior engine known simply as Ikemen.
S
SyftAnchore Inc
Anchore.Syftv1.49.0
CLI tool and library for generating a Software Bill of Materials from container images and filesystems

More from Ralph Slooten or browse email-testing, go, golang.

Frequently asked questions

How do I install Mailpit on Windows?

Open Windows Terminal, PowerShell, or Command Prompt and run: winget install --id axllent.mailpit --exact --version 1.29.5. winget downloads the installer from Ralph Slooten and runs it. Requires Windows 10 (1809+) or Windows 11.

How do I install Mailpit silently for unattended deployment?

Add --silent and accept the agreements upfront: winget install --id axllent.mailpit --exact 1.29.5 --silent --accept-package-agreements --accept-source-agreements. This is the variant Intune, Configuration Manager, and other deployment tools should use.

How do I uninstall Mailpit via winget?

Run: winget uninstall --id axllent.mailpit --exact. Add --silent for unattended uninstalls. winget will use the registered uninstaller from Mailpit's Apps & Features entry.

Is Mailpit free?

Mailpit is distributed under MIT. Refer to the publisher (https://github.com/axllent/mailpit) for the full license terms - Wingetly itself does not charge for installation.

Does Mailpit work on Windows 10?

Yes, as long as your Windows 10 build supports winget (1809 or newer). winget ships with App Installer on Windows 10/11 and pulls Mailpit directly from the publisher.

How do I keep Mailpit up to date?

Run winget upgrade --id axllent.mailpit --exact, or winget upgrade --all to update everything winget tracks. We index 1 version of Mailpit from microsoft/winget-pkgs.