punchin-email vulnerabilities

CVEs whose affected-version data names the punchin-email package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-54649Low· 2.1

1w ago

punchin-email is a Cloudflare Email Worker that provides two-way role aliases while relaying mail to a private inbox

punchin-email is a Cloudflare Email Worker that provides two-way role aliases while relaying mail to a private inbox. Prior to 1.5.0, handleInbound delivers inbound alias mail with message.forward(), which silently drops the added Reply-…

▾ SunlitPunchIn-App · punchin-emailEPSS 0.47%via NVD