# thingsboard v4.3.1.1 — ThingsBoard 4.3.1.1 Release - Product: thingsboard (https://whatsnew.fyi/product/thingsboard) - Vendor: thingsboard - Date: 2026-03-31 - Version: v4.3.1.1 - Original notes: https://github.com/thingsboard/thingsboard/releases/tag/v4.3.1.1 - Permalink: https://whatsnew.fyi/product/thingsboard/releases/v4.3.1.1 What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog. Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'. --- - **security** — Fixed XSS vulnerability in notification center - **security** — Fixed CVE-2026-24308, CVE-2026-24281 and CVE-2026-24400 - **security** — Added configurable security headers and env-var-backed CORS configuration - **security** — Fixed SSRF DNS rebinding bypass and added allow-list - **security** — Fixed CVE-2026-24281, CVE-2026-24308, CVE-2026-24400, CVE-2026-29063, CVE-2026-29087, CVE-2026-29786, CVE-2026-30827, CVE-2026-31802, CVE-2026-32141, CVE-2026-32635, CVE-2026-27904 - **security** — Fixed CVE-2026-22731, CVE-2026-22732, CVE-2026-22733, CVE-2026-22737 and upgraded to Spring Boot 3.5 - **security** — Fixed CVE-2026-33228 - **security** — Fixed CVE-2026-33870, CVE-2026-33871 and GHSA-72hv-8253-57qq - **security** — Fixed CVE-2026-33895, CVE-2026-33894, CVE-2026-33896, CVE-2026-33750, CVE-2026-4923, CVE-2026-33671 - **security** — Fixed CVE-2026-0861, CVE-2026-0915, CVE-2025-15281 for Docker images - **changed** — Sanitize database error messages - **added** — Added OTA package data cleanup - **fixed** — Fixed notification requests and RPC cleanup timeout on large datasets - **added** — Added WS update on telemetry deletion - **changed** — Updated locales da_DK, de_DE, el_GR, es_ES, fr_FR, it_IT, ja_JP, nl_NL, no_NO, pt_BR, tr_TR, uk_UA, zh_CN - **changed** — Hide "Show on widgets" button on sysadmin level - **fixed** — Fixed WS reconnect loop and notification spam when session limit is reached - **fixed** — Fixed missing translation for Polylines toggle in map settings - **fixed** — Fixed resetting of validation on storeLink property ##### What's Changed ###### Security * Fixed XSS vulnerability in notification center by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15204 * Fixed CVE-2026-24308, CVE-2026-24281 and CVE-2026-24400 by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15244 * Added configurable security headers and env-var-backed CORS configuration by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15254 * Fixed SSRF DNS rebinding bypass, added allow-list by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15253 * Fixed CVE-2026-24281, CVE-2026-24308, CVE-2026-24400, CVE-2026-29063, CVE-2026-29087, CVE-2026-29786, CVE-2026-30827, CVE-2026-31802, CVE-2026-32141, CVE-2026-32635, CVE-2026-27904 by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15251 * Fixed CVE-2026-22731, CVE-2026-22732, CVE-2026-22733, CVE-2026-22737 + Spring Boot 3.5 by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15278 * Fixed CVE-2026-33228 by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15293 * Fixed CVE-2026-33870, CVE-2026-33871 and GHSA-72hv-8253-57qq by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15315 * Fixed CVE-2026-33895, CVE-2026-33894, CVE-2026-33896, CVE-2026-33750, CVE-2026-4923, CVE-2026-33671 by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15322 * Fixed CVE-2026-0861, CVE-2026-0915, CVE-2025-15281 for Docker images by @ViacheslavKlimov ###### Core & Rule Engine * Sanitize database error messages by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15262 * Added OTA package data cleanup by @AndriiLandiak in https://github.com/thingsboard/thingsboard/pull/14775 * Fixed notification requests and RPC cleanup timeout on large datasets by @AndriiLandiak in https://github.com/thingsboard/thingsboard/pull/14762 * Added WS update on telemetry deletion by @dashevchenko in https://github.com/thingsboard/thingsboard/pull/14781 ###### UI * Updated locales da_DK, de_DE, el_GR, es_ES, fr_FR, it_IT, ja_JP, nl_NL, no_NO, pt_BR, tr_TR, uk_UA, zh_CN by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15237 * Hidden "Show on widgets" button on sysadmin level by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15203 * Fixed WS reconnect loop and notification spam when session limit is reached by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15219 * Fixed missing translation for Polylines toggle in map settings by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15252 * Fixed resetting of validation on storeLink property by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15168 * Fixed time series table widgets tab style by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15267 * Fixed proxy error handling for 502/503/504 HTTP status codes by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15292 * Fixed string-items-list autocomplete selection and blur handling by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15273 ###### Edge * Support combined PEM cert+key for Edge gRPC SSL by @smatvienko-tb in https://github.com/thingsboard/thingsboard/pull/15205 ###### Transport * MQTTS metrics and client address logging on exceptionCaught by @smatvienko-tb in https://github.com/thingsboard/thingsboard/pull/15112 * Fixed LwM2M Redis stores startup: use separate connections for SCAN and GET by @smatvienko-tb in https://github.com/thingsboard/thingsboard/pull/15143 **Full Changelog**: https://github.com/thingsboard/thingsboard/compare/v4.3.1...v4.3.1.1