Executive brief
punchin-email is a Cloudflare Email Worker that provides anonymous email aliases while forwarding messages to a private inbox. A vulnerability in versions prior to 1.5.0 causes the operator's private inbox address to be inadvertently exposed when they reply to incoming alias messages, potentially revealing their actual email address to external correspondents.
Technical details
The vulnerability is a privacy leak in the inbound mail handling path. The handleInbound function used Cloudflare's message.forward() API with an intended Reply-To header to route responses back through the relay, but Cloudflare's forward() method silently drops any added Reply-To header. This caused user replies to be sent directly to external correspondents from the operator's real FORWARD_TO inbox address instead of through the relay alias, exposing the private address. The fix (version 1.5.0) switches to the EMAIL_SENDING binding to deliver inbound mail with properly preserved Reply-To and From headers, ensuring all correspondence routes through the relay and masking the private address in both directions. The exposure is limited to the operator's own address with no third-party data compromise, code execution, or authentication bypass.
Affected products
- PunchIn punchin-email prior to 1.5.0
Timeline
- 2026-06-08: patched: Version 1.5.0 released
- 2026-09-17: disclosed