# mitmproxy changelog > An interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers. - Vendor: mitmproxy - Category: Developer Tools - Platforms: Desktop - Official site: https://mitmproxy.org - Tracked by: What's New (https://whatsnew.fyi/product/mitmproxy) - Harvested from: GitHub (mitmproxy/mitmproxy) - Entries below: 10 (newest first) What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog. Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'. ## Releases ### v12.2.3 — mitmproxy 12.2.3 - Date: 2026-05-12 - Version: v12.2.3 - Original notes: https://github.com/mitmproxy/mitmproxy/releases/tag/v12.2.3 - Permalink: https://whatsnew.fyi/product/mitmproxy/releases/v12.2.3 - Labels: Platforms: Desktop - **changed** — Reduce generated leaf certificate validity from 199 to 197 days so the 2-day notBefore backdate remains below Chromium's 200-day limit - **fixed** — Fix a bug where mitmweb would not pick up its XSRF cookie - **fixed** — Fix authority and subject key identifier mismatch errors when mitmproxy is configured with a custom CA whose SubjectKeyIdentifier was not derived as SHA-1 of the public key - **fixed** — Fix IndexError in is_mostly_bin when exporting flows to HAR with payloads that have a UTF-8 continuation byte at the 100-byte cutoff - Reduce generated leaf certificate validity from 199 to 197 days so the 2-day `notBefore` backdate remains below Chromium's 200-day limit. ([#8203](https://github.com/mitmproxy/mitmproxy/pull/8203), @emanuele-em) - Fixed a bug where mitmweb would not pick up its XSRF cookie. ([#8224](https://github.com/mitmproxy/mitmproxy/pull/8224), @mhils) - Fix `authority and subject key identifier mismatch` errors when mitmproxy is configured with a custom CA whose SubjectKeyIdentifier was not derived as SHA-1 of the public key. ([#8214](https://github.com/mitmproxy/mitmproxy/pull/8214), @unique-jakub) - Fix `IndexError` in `is_mostly_bin` when exporting flows to HAR with payloads that have a UTF-8 continuation byte at the 100-byte cutoff. ([#8196](https://github.com/mitmproxy/mitmproxy/pull/8196), @juliosuas) ### v12.2.2 — mitmproxy 12.2.2 - Date: 2026-04-12 - Version: v12.2.2 - Original notes: https://github.com/mitmproxy/mitmproxy/releases/tag/v12.2.2 - Permalink: https://whatsnew.fyi/product/mitmproxy/releases/v12.2.2 - Labels: Platforms: Desktop - **security** — Fix LDAP injection vulnerability - **changed** — Reduce CERT_EXPIRY to 199 days - **changed** — Switch all content-encoding compression algorithms to use fastest settings by default, significantly improving addon runtime performance when assigning to message.content - **fixed** — Fix addon options not being included in --options output - **fixed** — Fix view.settings.setval.toggle command to correctly use the provided key parameter instead of hardcoded "key" string - **fixed** — Fix 400 Bad Request for HTTP requests with uppercase scheme - **fixed** — Fix console command panel losing focus due to incoming traffic - **fixed** — Fix failed CONNECT requests not being displayed in mitmdump - **changed** — Reduce mitmweb FlowTable Redux subscriptions from O(rows) to O(1) - **fixed** — Fix mitmweb editors not allowing content to be cleared to an empty string - **changed** — Update optmanager value parsing exceptions to include the option name - **changed** — Show intercept filter tag at the bottom for default options in mitmweb - **fixed** — Fix mitmweb showing a blank page on Windows - **changed** — Add number of selected flows in the mitmweb footer - **fixed** — Fix modify_body crash when replacement strings contain backslash sequences - **added** — Support adding and editing comments on individual flows in the mitmproxy console - **added** — Allow hiding the Quick Help UI in the mitmproxy console with the 'H' key - **removed** — Remove several dead functions - [GHSA-527g-3w9m-29hv](https://github.com/mitmproxy/mitmproxy/security/advisories/GHSA-527g-3w9m-29hv): Fix LDAP injection vulnerability reported by @yueyueL. ([#8178](https://github.com/mitmproxy/mitmproxy/pull/8178), @mhils) - Reduce `CERT_EXPIRY` to 199 days. ([#8142](https://github.com/mitmproxy/mitmproxy/pull/8142), @opstic) - Switch all content-encoding compression algorithms to use fastest settings by default. This significantly improves addon runtime performance when assigning to `message.content`. ([#8055](https://github.com/mitmproxy/mitmproxy/pull/8055), @Prinzhorn) - Fix addon options not being included in `--options` output. ([#4423](https://github.com/mitmproxy/mitmproxy/issues/4423), @emanuele-em) - Fix `view.settings.setval.toggle` command to correctly use the provided key parameter instead of hardcoded "key" string. ([#8167](https://github.com/mitmproxy/mitmproxy/pull/8167), @nameearly) - Fix 400 Bad Request for HTTP requests with uppercase scheme (e.g. `HTTP://`). ([#8174](https://github.com/mitmproxy/mitmproxy/pull/8174), @emanuele-em) - Fix console command panel losing focus due to incoming traffic (e.g. websocket messages). ([#8173](https://github.com/mitmproxy/mitmproxy/pull/8173), @emanuele-em) - mitmdump: Fix failed CONNECT requests not being displayed. ([#7083](https://github.com/mitmproxy/mitmproxy/issues/7083), @Prinzhorn) - mitmweb: Reduce FlowTable Redux subscriptions from O(rows) to O(1). ([#8104](https://github.com/mitmproxy/mitmproxy/pull/8104), @ariel42) - mitmweb: Fix editors not allowing content to be cleared to an empty string ([#8149](https://github.com/mitmproxy/mitmproxy/pull/8149), @ariel42) - Update optmanager value parsing exceptions to include the option name ([#8016](https://github.com/mitmproxy/mitmproxy/pull/8016), @zdwg42) - mitmweb: show intercept filter tag at the bottom for default options ([#8026](https://github.com/mitmproxy/mitmproxy/pull/8026), @xBZZZZ) - Fix a bug where mitmweb would show a blank page on Windows. ([#8041](https://github.com/mitmproxy/mitmproxy/pull/8041), @Prinzhorn) - mitmweb: Add number of selected flows in the footer ([#8057](https://github.com/mitmproxy/mitmproxy/pull/8057), @skrattara) - Fix `modify_body` crash when replacement strings contain backslash sequences. ([#8046](https://github.com/mitmproxy/mitmproxy/pull/8046), @HueCodes) - Added support for adding and editing comments on individual flows in the mitmproxy console. ([#7944](https://github.com/mitmproxy/mitmproxy/pull/7944), @lups2000) - Allow hiding the Quick Help UI in the mitmproxy console with the 'H' key. ([#8095](https://github.com/mitmproxy/mitmproxy/pull/8095), @seroperson) - Removed several dead functions using [Skylos](https://github.com/duriantaco/skylos). ([#8136](https://github.com/mitmproxy/mitmproxy/pull/8136), @duriantaco) ### v12.2.1 — mitmproxy 12.2.1 - Date: 2025-11-24 - Version: v12.2.1 - Original notes: https://github.com/mitmproxy/mitmproxy/releases/tag/v12.2.1 - Permalink: https://whatsnew.fyi/product/mitmproxy/releases/v12.2.1 - Labels: Platforms: Desktop - **added** — Make TCP inactivity timeout configurable through a new tcp_timeout option with a default of 600 seconds - **added** — Add example addon to spoof DNS responses - **changed** — Flush flow file after each flow to allow further processing - **changed** — Fallback to UTF-8 for more content types in infer_content_encoding - **changed** — Improve is_mostly_bin check to support Chinese characters - **changed** — mitmweb is now built with Vite - **fixed** — Remove bless from hex editors to avoid issues with macOS - **fixed** — Fix various issues in infer_content_encoding - **fixed** — Gracefully handle decoding of raw binary payloads that previously caused errors - **fixed** — Show query parameters for empty-body requests in the mitmproxy console - **fixed** — Fix URL of mitmweb when --web-host is an IPv6 address - **fixed** — Fix event loop leak when running tests - **fixed** — Fix TypeScript build by adding React types and removing obsolete directives - Make TCP inactivity timeout configurable through a new `tcp_timeout` option (default: 600 seconds). Previously, the timeout was hardcoded to 10 minutes for all TCP connections. ([#7909](https://github.com/mitmproxy/mitmproxy/pull/7909), @keshavkrishnadav) - Flush flow file after each flow to allow further processing. ([#7967](https://github.com/mitmproxy/mitmproxy/pull/7967), @caiquejjx) - infer_content_encoding: Fallback to UTF-8 for more content types ([#7961](https://github.com/mitmproxy/mitmproxy/pull/7961), @xu-cheng) - Remove `bless` from hex editors to avoid issues with macOS ([#7937](https://github.com/mitmproxy/mitmproxy/pull/7937), @caiquejjx) - Improves `is_mostly_bin` check to support chinese characters ([#7933](https://github.com/mitmproxy/mitmproxy/pull/7933), @caiquejjx, @mhils) - Fix various issues in infer_content_encoding ([#7928](https://github.com/mitmproxy/mitmproxy/pull/7928), @xu-cheng) - Add example addon to spoof DNS responses. ([#7973](https://github.com/mitmproxy/mitmproxy/pull/7973), @mhils) - Gracefully handle decoding of raw binary payloads that previously caused "Raw cannot decode" or "failed to parse as JSON" errors ([#7940](https://github.com/mitmproxy/mitmproxy/pull/7940), @AdityaPatadiya) - Show query parameters for empty-body requests in the mitmproxy console. ([#7923](https://github.com/mitmproxy/mitmproxy/pull/7923), @lups2000) - mitmweb is now built with Vite, improving the development workflow. ([#7971](https://github.com/mitmproxy/mitmproxy/pull/7971), @sleeyax, @mhils) - Fix URL of mitmweb when --web-host is an IPv6 address. ([#7963](https://github.com/mitmproxy/mitmproxy/pull/7963), @Julien00859) - Fix event loop leak when running tests ([#7982](https://github.com/mitmproxy/mitmproxy/pull/7982), @DNEGEL3125) - Fix TypeScript build by adding React types and removing obsolete `@ts-expect-error` directives. ([#7988](https://github.com/mitmproxy/mitmproxy/pull/7988), @DNEGEL3125) ### v12.2.0 — mitmproxy 12.2.0 - Date: 2025-10-15 - Version: v12.2.0 - Original notes: https://github.com/mitmproxy/mitmproxy/releases/tag/v12.2.0 - Permalink: https://whatsnew.fyi/product/mitmproxy/releases/v12.2.0 - Labels: Platforms: Desktop - **added** — mitmproxy now supports Python 3.14, with binary releases shipping with 3.14 by default - **changed** — Replace htpasswd file parser with a custom implementation to migrate off unmaintained passlib dependency, supporting only bcrypt and SHA-1 hashing - mitmproxy now supports Python 3.14. Binary releases ship with 3.14 by default. ([#7918](https://github.com/mitmproxy/mitmproxy/pull/7918), @mhils) - Replace `htpasswd` file parser with a custom implementation to migrate off unmaintained `passlib` dependency. The new parser only supports bcrypt and SHA-1 hashing. Contributions for additional formats are welcome as long as they don't introduce new dependencies. ([#7906](https://github.com/mitmproxy/mitmproxy/pull/7906), @mhils) ### v12.1.2 — mitmproxy 12.1.2 - Date: 2025-08-24 - Version: v12.1.2 - Original notes: https://github.com/mitmproxy/mitmproxy/releases/tag/v12.1.2 - Permalink: https://whatsnew.fyi/product/mitmproxy/releases/v12.1.2 - Labels: Platforms: Desktop - **changed** — Docker images are now built with Debian Trixie - **fixed** — Fix mitmweb auth cookie always using the default web_port option - **fixed** — Add missing content-length header in curl export - **fixed** — Update log message with correct header name - **changed** — Do not escape non-ascii characters in the JSON contentview - **fixed** — Fix crash in mitmweb when no explicit Server-Connection is logged - **added** — Add syntax highlighting for CSS and JavaScript contentviews - **changed** — Display local timezone in the Timing tab of mitmweb - **fixed** — Prevent showing the quit message in the console when no flows are available under specific configurations - **security** — Upgrade hyper-h2 to fix a request smuggling vulnerability that affects mitmproxy's HTTP/2 to HTTP/1 translation - Docker images are now build with Debian Trixie. ([#7851](https://github.com/mitmproxy/mitmproxy/pull/7851), @mhils) - Fix mitmweb auth cookie always using the default `web_port` option. ([#7827](https://github.com/mitmproxy/mitmproxy/pull/7827), @sujaldev) - fix: missing content-length header in curl export ([#7810](https://github.com/mitmproxy/mitmproxy/pull/7810), @mheguy) - fix: update log message with correct header name ([#7802](https://github.com/mitmproxy/mitmproxy/pull/7802), @kristof-mattei) - Update deprecated `windows-2019` runner to `windows-2025`. ([#7801](https://github.com/mitmproxy/mitmproxy/pull/7801), @chedieck) - Do not escape non-ascii characters in the JSON contentview. ([#7740](https://github.com/mitmproxy/mitmproxy/pull/7740), @mhils) - Fix crash in mitmweb when no explicit Server-Connection is logged. ([#7734](https://github.com/mitmproxy/mitmproxy/pull/7734), @lups2000) - Add syntax highlighting for CSS and JavaScript contentviews. ([#7749](https://github.com/mitmproxy/mitmproxy/pull/7749), @mhils) - Display local timezone in the Timing tab of mitmweb. ([#7804](https://github.com/mitmproxy/mitmproxy/pull/7804), @lups2000) - Prevent showing the quit message in the console when no flows are available under specific configurations. ([#7833](https://github.com/mitmproxy/mitmproxy/pull/7833), @lups2000) ###### Security Fixes * [GHSA-847f-9342-265h](https://github.com/python-hyper/h2/security/advisories/GHSA-847f-9342-265h): Upgrade hyper-h2 to fix a request smuggling vulnerability that affects mitmproxy's HTTP/2 -> HTTP/1 translation. (@mhils) ### v12.1.1 — mitmproxy 12.1.1 - Date: 2025-05-25 - Version: v12.1.1 - Original notes: https://github.com/mitmproxy/mitmproxy/releases/tag/v12.1.1 - Permalink: https://whatsnew.fyi/product/mitmproxy/releases/v12.1.1 - Labels: Platforms: Desktop - **fixed** — Fix a race condition when updating the flow list in mitmweb - Fix a race condition when updating the flow list in mitmweb. ([#7729](https://github.com/mitmproxy/mitmproxy/pull/7729), @mhils) ### v12.1.0 — mitmproxy 12.1.0 - Date: 2025-05-24 - Version: v12.1.0 - Original notes: https://github.com/mitmproxy/mitmproxy/releases/tag/v12.1.0 - Permalink: https://whatsnew.fyi/product/mitmproxy/releases/v12.1.0 - Labels: Platforms: Desktop - **added** — mitmweb now supports filtering by body contents using ~b, ~bq, and ~bs filters - **fixed** — Fix raw response export incorrectly zeroing non-zero Content-Length header for HEAD requests - **fixed** — Fix concurrent mitmweb instances overwrite each other's auth cookie - mitmweb now supports filtering by body contents (~b, ~bq, ~bs). ([#7704](https://github.com/mitmproxy/mitmproxy/pull/7704), @lups2000, @mhils) - Fix raw response export incorrectly zeroing non-zero `Content-Length` header for HEAD requests. ([#7701](https://github.com/mitmproxy/mitmproxy/pull/7701), @sujaldev) - Fix concurrent mitmweb instances overwrite each other's auth cookie. ([#7690](https://github.com/mitmproxy/mitmproxy/pull/7690), @turboOrange) ### v12.0.1 — mitmproxy 12.0.1 - Date: 2025-05-06 - Version: v12.0.1 - Original notes: https://github.com/mitmproxy/mitmproxy/releases/tag/v12.0.1 - Permalink: https://whatsnew.fyi/product/mitmproxy/releases/v12.0.1 - Labels: Platforms: Desktop - **fixed** — Fix a crash when editing raw messages bodies in mitmproxy - **added** — Add an option to pass the web token as Authentication: Bearer ... header - **changed** — In DNS proxy mode, user-provided addons now trigger before DNS resolution has taken place - Fix a crash when editing raw messages bodies in mitmproxy. ([#7697](https://github.com/mitmproxy/mitmproxy/pull/7697), @mhils) - Added an option to pass the web token as `Authentication: Bearer ...` header ([#7681](https://github.com/mitmproxy/mitmproxy/pull/7681), @gschaer) - In DNS proxy mode, user-provided addons now trigger before DNS resolution has taken place. ([#7685](https://github.com/mitmproxy/mitmproxy/pull/7685), @Florigolo) ### v12.0.0 — mitmproxy 12.0.0 - Date: 2025-04-29 - Version: v12.0.0 - Original notes: https://github.com/mitmproxy/mitmproxy/releases/tag/v12.0.0 - Permalink: https://whatsnew.fyi/product/mitmproxy/releases/v12.0.0 - Labels: Platforms: Desktop - **changed** — Contentviews can now be interactive and re-encode prettified data, with syntax highlighting signaled off-band based on tree-sitter - **changed** — Contentview API has been drastically simplified, with contentviews now returning a plain string with prettified data - **added** — Contentviews can now be written in Rust for better performance and access to the crates ecosystem - **changed** — Replace existing gRPC and Protobuf contentviews with an interactive contentview that supports both existing proto definitions and unknown protos - **changed** — MsgPack contentview is now interactive - **added** — Add a new feature to store streamed bodies for requests and responses - **added** — Add support for TLS 1.3 Post Handshake Authentication - **added** — Add CRL entries to dummy cert when the upstream certificate has some - **fixed** — Fix a bug where mitmproxy would incorrectly send empty HTTP/2 data frames - **fixed** — Fix a bug where mitmdump would exit prematurely in server replay mode - **fixed** — Fix a bug where WebSocket Messages view jumps to top when a message is received - **added** — Create content view for Socket.IO over WebSocket transport - **fixed** — Correctly forward HTTP_1_1_REQUIRED errors in HTTP/2 streams - **fixed** — Fix a bug where HAR export would crash for malformed flows - **fixed** — Fix a bug where mitmweb would crash when viewing flows with undefined headers - **fixed** — Fix a bug where mitmproxy does not listen on IPv4 and IPv6 by default in wireguard mode - **changed** — Adjust popover placement for browsers that support anchor positioning - **fixed** — Fix mitmweb crash when searching or highlighting using ~h, ~hq, or ~hs - **changed** — mitmproxy.dns.Message has been renamed to mitmproxy.dns.DNSMessage - **added** — Add support for selecting multiple flows in mitmweb using Ctrl+Click and Shift+Click with support for deleting, duplicating, marking, reverting, replaying, resuming, and aborting flows ###### New Contentview System ([#7623](https://github.com/mitmproxy/mitmproxy/pull/7623), @mhils) - Contentviews can now be interactive and re-encode prettified data. For example, the new Protobuf view pretty-prints to YAML, which the user can edit and then re-serialize into binary representation. - Replace the existing gRPC and Protobuf contentviews with an interactive contentview that supports both existing proto definitions and completely unknown protos. - The MsgPack contentview is now interactive, too. - The contentview API has been drastically simplified. Contentviews now return a plain `str` with the prettified data. Syntax highlighting is now signaled off-band (and based on [tree-sitter]). - Docs: Add new documentation page and API reference for contentviews. - Contentviews can now be written in Rust for better performance and access to the crates ecosystem. ###### Other Changes - Add a new feature to store streamed bodies for requests and responses. ([#7637](https://github.com/mitmproxy/mitmproxy/pull/7637), @mkiami) - Add support for TLS 1.3 Post Handshake Authentication. ([#7576](https://github.com/mitmproxy/mitmproxy/pull/7576), @mhils, @cataggar) - Add search functionality to the documentation. ([#7603](https://github.com/mitmproxy/mitmproxy/pull/7603), @mhils) - Introduce a new theme for docs.mitmproxy.org. ([#7593](https://github.com/mitmproxy/mitmproxy/pull/7593), @mhils) - Add CRL entries to dummy cert when the upstream certificate has some. ([#7609](https://github.com/mitmproxy/mitmproxy/pull/7609), @Yepoleb, @JordanPlayz158) - Fix a bug where mitmproxy would incorrectly send empty HTTP/2 data frames. ([#7574](https://github.com/mitmproxy/mitmproxy/pull/7574), @mhils, @Dieken) - Enhance homebrew installation command for Brewfile users. ([#7566](https://github.com/mitmproxy/mitmproxy/pull/7566), @AntoineJT) - Fix a bug where mitmdump would exit prematurely in server replay mode. ([#7571](https://github.com/mitmproxy/mitmproxy/pull/7571), @mhils) - Fix a bug where WebSocket Messages view jumps to top when a message is received ([#7572](https://github.com/mitmproxy/mitmproxy/pull/7572), @DenizenB) - Create content view for Socket.IO over WebSocket transport ([#7570](https://github.com/mitmproxy/mitmproxy/pull/7570), @DenizenB) - Correctly forward HTTP_1_1_REQUIRED errors in HTTP/2 streams. ([#7575](https://github.com/mitmproxy/mitmproxy/pull/7575), @mhils) - Fix a bug where HAR export would crash for malformed flows. ([#7666](https://github.com/mitmproxy/mitmproxy/pull/7666), @mhils) - Fix a bug where mitmweb would crash when viewing flows with undefined headers. ([#7595](https://github.com/mitmproxy/mitmproxy/pull/7595), @emanuele-em) - Fix a bug where mitmproxy does not listen on IPv4 and IPv6 by default in wireguard mode. ([#7589](https://github.com/mitmproxy/mitmproxy/pull/7589), @errorxyz) - Adjust popover placement for browsers that support anchor positioning (Chrome, Edge) ([#7642](https://github.com/mitmproxy/mitmproxy/pull/7642), @lups2000) - Fix mitmweb crash when searching or highlighting using ~h, ~hq, or ~hs. ([#7652](https://github.com/mitmproxy/mitmproxy/pull/7652), @lups2000) - `mitmproxy.dns.Message` has been renamed to `mitmproxy.dns.DNSMessage` ([#7670](https://github.com/mitmproxy/mitmproxy/pull/7670), @mhils) - Added support for selecting multiple flows in mitmweb using Ctrl+Click and Shift+Click. Multi-selection is now supported for deleting, duplicating, marking, reverting, replaying ,resuming, and aborting flows. ([#7319](https://github.com/mitmproxy/mitmproxy/pull/7319), @lups2000, @mhils) [tree-sitter]: https://tree-sitter.github.io/tree-sitter/ ### v11.1.3 — mitmproxy 11.1.3 - Date: 2025-02-17 - Version: v11.1.3 - Original notes: https://github.com/mitmproxy/mitmproxy/releases/tag/v11.1.3 - Permalink: https://whatsnew.fyi/product/mitmproxy/releases/v11.1.3 - Labels: Platforms: Desktop - **fixed** — Fix several bugs in local capture mode by updating mitmproxy_rs dependency - **added** — Add documentation for local capture mode - **changed** — Revise documentation on proxy modes - **added** — Add a log message to point Docker mitmweb users towards web_password - **fixed** — Fix a bug where UTF-8 surrogates would crash the export addon - **added** — Add help entries for all options in mitmweb that didn't have them - Update mitmproxy_rs dependency to fix several bugs in local capture mode. ([#7564](https://github.com/mitmproxy/mitmproxy/pull/7564), @mhils) - Add documentation for local capture mode. ([#7540](https://github.com/mitmproxy/mitmproxy/pull/7540), @mhils) - Revise documentation on proxy modes. ([#7545](https://github.com/mitmproxy/mitmproxy/pull/7545), @mhils) - Add a log message to point Docker mitmweb users towards `web_password`. ([#7554](https://github.com/mitmproxy/mitmproxy/pull/7554), @mhils) - Fix a bug where UTF-8 surrogates would crash the export addon. ([#7562](https://github.com/mitmproxy/mitmproxy/pull/7562), @mhils) - Add help entries for all options in mitmweb that didn't have them. ([#7563](https://github.com/mitmproxy/mitmproxy/pull/7563), @mhils)