Mastodon ↗

Mastodon · Comms / Social

Track your version:Monitors Mastodon and tailors your dashboard to that exact version.

4.5.11 · latest cycle100/100 Healthy

Summary iPlain-English security verdict for Mastodon, generated from its current health score, actively-exploited vulnerabilities, and latest supported version.

Mastodon currently scores 100/100 — healthy. No tracked vulnerabilities are currently known to be exploited in the wild. The latest supported release is 4.5.11. It's on the latest patch with no significant known issues — keep it current.

Disclosure trend iNew CVEs published for Mastodon each year (NVD). A higher bar means more disclosures that year — more scrutiny, not necessarily less safe.

'19

'20

'21

'22

'23

'24

'25

'26

Patch priority — what to act on iThe issues to fix first — actively exploited (CISA KEV) first, then by exploitation probability (EPSS), then severity. Each row's "→ fixed in" is the earliest version that patches it; "see advisory" means no fixed version is published.

Most urgent first — actively exploited, then likeliest to be exploited.

CVE-2023-36460 CRITICAL Path traversal EPSS 37% → fixed in 4.1.3 CVE-2018-21018 CRITICAL CWE-613 EPSS 3% → fixed in 2.6.3 CVE-2024-23832 CRITICAL CWE-290 EPSS 2% → fixed in 4.2.5 CVE-2022-24307 CRITICAL Incorrect authorization EPSS 1% → fixed in 3.4.6 CVE-2023-36459 CRITICAL Cross-site scripting (XSS) EPSS 1% → fixed in 4.1.3 CVE-2022-2166 CRITICAL CWE-307 EPSS 1% → see advisory

See all 42 known Mastodon CVEs & security history →

Get alerted about Mastodon

Be emailed the moment Mastodon gets a newly exploited vulnerability (CISA KEV) or a release reaches end of life. Free · double opt-in · unsubscribe anytime.

We email only on real events for Mastodon — no marketing, no sharing, and we never know what you run. Track your whole stack →

Versions & lifecycle iWhen each release line stops receiving security patches (end-of-life). After EOL there are no more fixes — plan upgrades before these dates.

How long each Mastodon release line is supported — and when it sunsets. Select a line for its full report.

May6'26 Mastodon 4.3ended 2026-05-06

Jan8'26 Mastodon 4.2ended 2026-01-08

Apr8'25 Mastodon 4.1ended 2025-04-08

Dec31'23 Mastodon 3.5ended 2023-12-31

Oct31'23 Mastodon 4.0ended 2023-10-31

Nov6'22 Mastodon 3.4ended 2022-11-06

May26'22 Mastodon 3.3ended 2022-05-26

Full Mastodon end-of-life dates & support timeline →

4.5 latest 4.5.11 Supported 4.5.11 → 4.4 latest 4.4.18 Supported 4.4.18 → 4.3 latest 4.3.23 End of life ended 2026-05-064.3.23 → 4.2 latest 4.2.29 End of life ended 2026-01-084.2.29 → 4.1 latest 4.1.25 End of life ended 2025-04-084.1.25 → 4.0 latest 4.0.15 End of life ended 2023-10-314.0.15 → 3.5 latest 3.5.19 End of life ended 2023-12-313.5.19 → 3.4 latest 3.4.10 End of life ended 2022-11-063.4.10 → 3.3 latest 3.3.3 End of life ended 2022-05-263.3.3 → 3.2 latest 3.2.2 End of life 3.2.2 → See all upcoming end-of-life dates →

Frequently asked

Is Mastodon safe and patched?

What should I do about Mastodon now?

Upgrade Mastodon to the latest supported release (4.5.11) or later and apply available security updates, then confirm against Mastodon's official advisory.

When does Mastodon reach end-of-life?

The latest supported Mastodon release is 4.5.11. After end-of-life a release no longer receives security patches.

Which versions of Mastodon are still receiving security updates?

Supported Mastodon release lines (latest 4.5.11): 4.5, 4.4. End-of-life releases no longer receive security patches.

Informational only, from public data (NVD · CISA KEV · EPSS · endoflife.date), and can lag or miss vendor-specific fixes. Always confirm against Mastodon's official advisory before you patch or upgrade — Mastodon official site ↗