# Miniflux 2.3.1 — Miniflux 2.3.1

- Product: Miniflux (https://whatsnew.fyi/product/miniflux)
- Vendor: Frédéric Guillot
- Date: 2026-05-29
- Version: 2.3.1
- Original notes: https://github.com/miniflux/v2/releases/tag/2.3.1
- Permalink: https://whatsnew.fyi/product/miniflux/releases/2.3.1

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Fixed an OAuth account binding vulnerability that could allow users to associate arbitrary OAuth identities with their account
- **security** — Fixed an open redirect vulnerability caused by backslashes in relative redirect URLs
- **security** — Fixed a potential SQL injection vulnerability in dynamically generated ORDER BY clauses
- **security** — Hardened metrics endpoint authentication by using constant-time credential comparisons
- **fixed** — Fixed an issue where the stdlib cross-origin protection middleware could block legitimate requests in certain self-hosted environments by reverting the middleware
- **added** — Added Korean language support
- **changed** — Improved HTML truncation performance and reduced memory allocations
- **changed** — Optimized feed discovery, subscription detection, date parsing, and tag filtering

###### Security

* Fixed an OAuth account binding vulnerability that could allow users to associate arbitrary OAuth identities with their account. 
* Fixed an open redirect vulnerability caused by backslashes in relative redirect URLs. 
* Fixed a potential SQL injection vulnerability in dynamically generated `ORDER BY` clauses. 
* Hardened metrics endpoint authentication by using constant-time credential comparisons. 

###### Bug Fixes

* Fixed an issue where the stdlib cross-origin protection middleware could block legitimate requests in certain self-hosted environments. The middleware has been reverted.

###### Improvements

* Added Korean language support. 
* Improved HTML truncation performance and reduced memory allocations. 
* Optimized feed discovery, subscription detection, date parsing, and tag filtering. 
* Simplified and refactored several storage and query-building components for better maintainability. 

###### Dependencies

Updated several dependencies, including:

* `github.com/go-webauthn/webauthn` 0.17.4
* `golang.org/x/crypto` 0.52.0
* `golang.org/x/image` 0.41.0
* `golang.org/x/net` 0.55.0

---

As always, thank you to all contributors who helped improve Miniflux in this release.