HedgeDoc

Security fixes

• GHSA-93w7-49m2-cqwg reports possible corruption of permission values due to missing validation. This should not impact permission checks, except when the note owner intentionally set their note permission to something invalid.

Enhancements

• Added external link warning setting (externalLinkWarning in config.json or CMD_EXTERNAL_LINK_WARNING) to disable the external link warning page entirely
• Added external link whitelist setting (externalLinkWhitelist in config.json or CMD_EXTERNAL_LINK_WHITELIST) to skip warning page for certain domains
• Added support for webp file uploads (for all backends except imgur, since that does not support these)

Bugfixes

• Fixed external link warning for subpath instances
• Restore native browser zoom-in keyboard shortcuts in the editor
• Nested list items render properly again in the preview pane for slides

Refactoring / Clean-up

• Removed the old Temp database object and related API endpoints. This was used by a very old way of migrating the history and is no longer needed.
• Removed unused allowOrigin (environment variable CMD_ALLOW_ORIGIN) config option.
• Removed unnecessary/duplicate entries in the XSS filtering whitelist

Contributors

• Shivam Shukla
• Tobi

Security fixes

This release contains four security fixes:

• GHSA-6c2w-8w96-3pcv reports a possible HTML injection via the localpart of an email address.
• GHSA-qj78-mjch-wwrv reports a possible Denial-of-Service attack using the YAML frontmatter parsing.
• GHSA-8v9p-5j95-826j reports a possible CSRF attack vector in the GitHub Gist export.
• GHSA-2f9f-w8xq-276v reports a rate-limiting bypass by abusing the CF-Connecting-IP header.

Thanks to Chandler Johnson, taylorodell and alanturing881 for reporting!

Important notices

• When using Cloudflare in front of HedgeDoc, you should set rateLimitUsingCloudflare in the config.json or CMD_RATE_LIMIT_USING_CLOUDFLARE as environment variable to true.

Enhancements

• Added a warning page when clicking external links
• Improve the config.json.example file, which is used by bin/setup
• Allow configuration of login / signup rate-limits
• Allow configuration of Cloudflare usage in regards of rate-limits
• Several improvements in the documentation at https://docs.hedgedoc.org

Bugfixes

• Fix data loss when 5+ users edit a document concurrently, caused by the OT client discarding operations during revision gap recovery (#6342)
• Add defensive null checks to hex2rgb to prevent crashes from non-hex color values

Maintenance

• Dependency updates

Contributors

• Dex Devlon

Bugfixes

• Random colors for user's cursors and selections are now always in hex format to avoid conversion errors
• Correctly close realtime connections if they disconnect during connection creation
• manage_users CLI does not silently drop errors

Security fixes

This release contains two medium severity security fixes:

• CVE-2026-25642 reports a bug where security headers for upload files were not set correctly.
• GHSA-672m-p72w-gw28 reports potential security issues with limited script execution in uploaded SVG files.

Thanks to @HUSEYNKHANLI and @drkim-dev for reporting!

Maintenance

• Dependency updates
• Enhancements in the documentation at docs.hedgedoc.org

Contributors

• xenein (#6322)

This release is just a fix for the docker container. It does not contain any changes to HedgeDoc itself.

Bugfixes

• Fix the bundled healthcheck in the docker container

Security fixes

This release contains two low severity security fixes:

• GHSA-gmgw-rcmh-7x47 reports potential cross-site side-effects due to not applying sandboxing to iframes.
• CVE-2025-66629 reports a possible CSRF vulnerability when using certain social login providers because the state parameter is not used and checked.

Enhancements

• Add enableUploads (CMD_ENABLE_UPLOADS) config option to restrict uploads to registered users, all users or none to completely disable uploads.
• Allow links to protocols such as xmpp, webcal or geo
• Switch from deprecated shortid to nanoid module, with 10 character long aliases in "public" links
• Ensure compatibility with Node 24
• Protect user history from accidental or malicious deletion by adding a CSRF-like token
• Many enhancements in the documentation at docs.hedgedoc.org

Bugfixes

• Ignore the healthcheck endpoint in the "too busy" limiter
• Send the referrer origin for YouTube embeddings due to their requirement
• Force kill the server after a timeout when waiting for the realtime server to close connections on shutdown
• Secure iframes with credentialless and sandbox attributes
• Fix regexes for [time=...], [name=...] and [color=...] shortcodes in lists
• Use state parameter for OAuth2 flows and PKCE where applicable

Node compatibility

• Support for Node 24 was verified. The docker image now uses Node 24 as its base image.

Contributors

• Nora Matthias Schiffer (#6096)
• 4censord (#6102)
• Zachery Faria (#6105)
• pl7ofit (#6106)
• Lars Kiesow (#6107)
• Kim Brose (#6114)
• Achilleas Pipinellis (#6119)
• Andreas Boesen (#6148, #6149)
• Thary (#6155)

Security fixes

This release fixes a security issue of a possible XSS exploit which can be planted via a malicous SVG file upload.

See CVE-2025-32391 for more details

Enhancements

• Add config options CMD_SAML_WANT_ASSERTIONS_SIGNED and CMD_SAML_WANT_AUTHN_RESPONSE_SIGNED for SAML auth, since some instances didn't comply with the new defaults of @node-saml/passport-saml

PLEASE CHECK THIS IF YOU USE SAML AUTHENTICATION: This release had to set default values for the username and email address attribute mapping for SAML authentication for security reasons. If you use SAML authentication, please make sure to update your SAML configuration accordingly. See: https://docs.hedgedoc.org/configuration/#saml-login CMD_SAML_ATTRIBUTE_USERNAME or CMD_SAML_ATTRIBUTE_EMAIL

Bugfixes

• Check if a valid user id is present when using OAuth2
• Abort SAML login if NameID is undefined instead of logging in with a user named "undefined" (Thanks @Haanifee)
• Set default values for username and email attribute mapping in SAML configuration

This release fixes a security issue where brute-forcing local email/passwords is possible because of missing rate-limits. We recommend upgrading as soon as possible, if you use local logins.

See also https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-6w39-x2c6-6mpf

This release changes the default configuration of the HSTS preload attribute to false for compliance with the HSTS preload list requirements. This shouldn't impact any instance. However, if you intend to use HSTS preloading you should enable the config setting hsts.preload to true or set environment variable CMD_HSTS_PRELOAD=true.

This release deprecates support for Node 18. As the LTS support for 18 runs out in April 2025, the next release will only work with Node 20 and upwards. Consider this your early warning to upgrade any running instances to at least Node 20.

Enhancements

• Add fixed rate-limiting to the login and register endpoints
• Add configurable rate-limiting to the new notes endpoint

Bugfixes

• Fix a crash when cannot read user profile in OAuth (#5850 by @lautaroalvarez)
• Fix CSP Header for mermaid embedded images (#5887 by @domrim)
• Change default of HSTS preload to false for compliance with the HSTS preload list requirements (#5913 by @SvizelPritula)

Contributors

• Dominik Rimpf
• Lautaro Alvarez