4.3.1

4.3.1 follows 4.3.0 and is a security patch. The Mail, DNS and S3 portal apps bundled Next.js 15.5.27, which has an unauthenticated remote code execution in image optimization and a denial of service in App Router Server Actions; 4.3.1 updates them to Next.js 15.5.28. The portal apps ship to servers, so servers get the fix on update and no action is needed. The DNS portal's API description no longer advertises the ALIAS record type, which the server never served.

Security​

• Next.js updated for an unauthenticated remote code execution and a denial of service. The Mail, DNS and S3 portal apps bundled Next.js 15.5.27, which has an unauthenticated remote code execution in its image optimization (GHSA-2464-fhr4-w9xw, critical) and a denial of service in App Router Server Actions (GHSA-p3m5-59mp-jv5r, high). 4.3.1 updates the portal apps to Next.js 15.5.28, which fixes both. The portal apps ship to customer servers, so 4.3.0 installs are affected; servers get the fix on update and no action is needed. (HiTechCloud-Panel#1891)
• Webmail dependency updates for two denial-of-service issues. The bundled webmail's Node dependencies are updated: body-parser to 1.20.9 (GHSA-27r3-jxmh-p828) and undici to 6.29.1 (GHSA-4qv8-2p9j-2685, GHSA-xjj6-f33q-929c), both denial of service, with nodemailer 10.1.4 and ip-address 10.7.4 for address-parser hardening. The webmail ships to servers, so servers get the fix on update; no action needed. (hitechcloudmail#95)
• Engine: a PostgreSQL client dependency updated for a constant-time advisory. The panel engine's ctutils (used for SCRAM authentication through the Postgres client) is updated to 0.4.4, clearing RUSTSEC-2026-0385 (non-constant-time mask generation). Low practical exploitability. (HiTechCloud-Panel#1892)

Fixed​

• DNS portal: the portal's API description (OpenAPI spec) no longer lists the ALIAS record type. The server has never served ALIAS and already rejects it; this removes it from the published contract. (HiTechCloud-Panel#1889)