# thingsboard v4.3.1 — ThingsBoard 4.3.1 Release - Product: thingsboard (https://whatsnew.fyi/product/thingsboard) - Vendor: thingsboard - Date: 2026-03-10 - Version: v4.3.1 - Original notes: https://github.com/thingsboard/thingsboard/releases/tag/v4.3.1 - Permalink: https://whatsnew.fyi/product/thingsboard/releases/v4.3.1 What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog. Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'. --- - **security** — Fixed CVE-2026-24734 and CVE-2025-66614 - **security** — Fixed CVE-2025-7783, CVE-2026-26996 and CVE-2026-26960 - **security** — Fixed CVE-2026-27903 and CVE-2026-27904 - **security** — Added SSRF protection (must be enabled with SSRF_PROTECTION_ENABLED env) - **security** — Fixed CWE-770 in Jackson Core (GHSA-72hv-8253-57qq) - **security** — Fixed CVE-2026-27970 and CVE-2026-2391 - **security** — Fixed CVE-2026-2781, CVE-2026-25646, CVE-2026-21945 and CVE-2026-21932 for Docker images - **changed** — Migrated UI to Angular 20 - **fixed** — Fixed getTimeseries API (/{entityType}/{entityId}/values/timeseries) - **added** — Added Cassandra result set byte-size limit - **fixed** — Fixed TBEL script execution failures on repeated runs - **fixed** — Fixed blocking JPA queries on access-validator single thread - **fixed** — Fixed preservation of rule node execution counter in delay and deduplication nodes - **changed** — Improved Apple OAuth2 mapper and refactored OAuth2 client validation - **fixed** — Fixed infinite loop when rule chain input node forwards to its own rule chain - **changed** — Made max WS message size configurable - **fixed** — Fixed Redirect Url encoding - **fixed** — Fixed loading and placement of Material icons - **fixed** — Fixed Popover placement for Marker, Polygon and Circle overlay config - **fixed** — Fixed adaptive in mail server configuration ##### What's Changed ###### Security * Fixed CVE-2026-24734 and CVE-2025-66614 by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15076 * Fixed CVE-2025-7783, CVE-2026-26996 and CVE-2026-26960 by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15079 * Fixed CVE-2026-27903 and CVE-2026-27904 by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15109 * Added SSRF protection (must be enabled with SSRF_PROTECTION_ENABLED env) by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15123 * Fixed CWE-770 in Jackson Core (GHSA-72hv-8253-57qq) by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15124 * Fixed CVE-2026-27970 and CVE-2026-2391 by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15128 * Fixed CVE-2026-2781, CVE-2026-25646, CVE-2026-21945 and CVE-2026-21932 for Docker images by @ViacheslavKlimov and @smatvienko-tb ###### Major UI * Angular 20 migration by @ikulikov in https://github.com/thingsboard/thingsboard/pull/14944 ###### Core & Rule Engine * Fixed getTimeseries API (/{entityType}/{entityId}/values/timeseries) by @dashevchenko in https://github.com/thingsboard/thingsboard/pull/15054 * Added Cassandra result set byte-size limit by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15058 * Fixed TBEL script execution failures on repeated runs by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15078 * Fixed blocking JPA queries on access-validator single thread by @dskarzh in https://github.com/thingsboard/thingsboard/pull/15101 * Fixed preservation of rule node execution counter in delay and deduplication nodes by @dskarzh in https://github.com/thingsboard/thingsboard/pull/15100 * Improved Apple OAuth2 mapper and refactored OAuth2 client validation by @ViacheslavKlimov in https://github.com/thingsboard/thingsboard/pull/15120 * Fixed infinite loop when rule chain input node forwards to its own rule chain by @smatvienko-tb in https://github.com/thingsboard/thingsboard/pull/15102 * Made max WS message size configurable by @DmytroKhylko in https://github.com/thingsboard/thingsboard/pull/15116 ###### UI * Fixed Redirect Url encoding by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/14985 * Fixed loading and placement of Material icons by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/14959 * Fixed Popover placement for Marker, Polygon and Circle overlay config by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/14978 * Fixed adaptive in mail server configuration by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15018 * Fixed Range and Bar chart limits setup by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/14964 * Fixed RGBA and HSLA inputs in color picker by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15031 * Fixed Entity key autocomplete change check by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15080 * Fixed a race condition causing the toast component by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15071 * Fixed a race condition when init image map by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15097 * Fixed default timewindow config in widget editor page by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15108 * Removed pattern validation from name field on CF by @mtsymbarov-del in https://github.com/thingsboard/thingsboard/pull/15142 * Updated Ukrainian locale by @vvlladd28 in https://github.com/thingsboard/thingsboard/pull/15096 * Extend modules map: moment-timezone, canvas-gauges and ngx-hm-carousel added by @ChantsovaEkaterina in https://github.com/thingsboard/thingsboard/pull/15130 ###### Transport * Fixed Sparkplug BIRTH message validation for metrics with _[Truncated at 4000 characters — full notes: https://github.com/thingsboard/thingsboard/releases/tag/v4.3.1]_