mitmproxy v12.3.1 released
By SecBurg
mitmproxy is an open source HTTPS proxy for intercepting, inspecting and modifying traffic.
Version 12.3.1 follows just three days after v12.3.0 with its eMudhra changes. This one is a security-flavored bugfix release: Brotli 1.2.1 is now required to pick up the upstream decoder fix for CVE-2026-111497. Binary releases now ship with Python 3.15.
Other highlights:
OCSP and CRL requests to eMudhra and Sectigo revocation hosts are blocked when `--emudhra` or `--emudhra-old` is enabled
`set_all()` now preserves caller-provided value lists when replacing query parameters or cookies
Cookie expiration dates for empty-valued cookies are refreshed during server replay
Two error messages that were never formatted (`BiDi` attribute lookup, unsupported option types) are fixed
The full changelog is in the CHANGELOG.md, packages are available on the downloads page.
Happy proxying! :-)