AliasVault Files

What's Changed

[!IMPORTANT] 🔒 Web app email rendering validation vulnerablity (disclosed 2026-03-01): This version 0.26.0 includes a fix for a web-app specific email rendering validation issue (CVE-2026-26266). Self-hosted users are recommended to update to 0.26.0 or later. Cloud users, browser extensions and mobile apps were not affected.

Welcome to AliasVault v0.26.0 🎉

This is one of the biggest releases yet with a major architecture upgrade that unlocks long-requested features like custom fields, folders, new item types, history tracking, recently deleted items, and true offline vault access and editing with automatic vault merging.

Alongside these major additions, this release includes security improvements, performance optimizations, and many community-requested fixes.

[!NOTE]
This release includes a client vault model update. After upgrading, your vault can only be opened by v0.26.0+ client versions. For self-hosted users: make sure you update your server to avoid compatibility issues.
- Install.sh update: Update Guide
- Docker update: Update Guide

Highlights of this release

1. New vault architecture (enables major features)

   • We listened to all your feedback in the last months and designed a new architecture to support all of these ideas. Thanks to this major architecture upgrade, AliasVault now supports the following new powerful features:
     • New item types (credit card, secure note)
     • Folder support (allowing you to group credentials)
     • Custom fields (store exactly what you need with easy copy/paste)
     • Field history tracking (see previous values for usernames/passwords)
     • Recently deleted items (with option to restore)

2. Full offline mode (browser extension + mobile)

   • You now have full access to your vault even without a server connection.
   • View and edit your vault completely offline
   • Changes sync automatically once you're back online
   • Built-in conflict merging in all apps and devices
   • Field-level merge logic (e.g. username changed on device A, password on device B → both are preserved)
   • Last-write-wins per field when conflicts occur

3. New language options

   • AliasVault is now also available in Romanian, which means AliasVault is now available in a total of (14) languages! A big thank you to all of our translators who continue to work very hard in adding translations for all the new (reworked) features. Do you want to help improve translations and/or make AliasVault available in your native language? Check out the AliasVault project on Crowdin and apply.
   • Added Italian as a language option to the built-in identity generator. Do you want to help make your language available to the identity generator for the alias feature? Check out this guide.

4. General improvements

5. Introduced a new cross-platform core library written in Rust, improving:

   • Sync merging reliability
   • Autofill matching accuracy
   • Shared logic consistency across all clients
   • When creating a new passkey, the wizard will now suggest existing credentials to save the passkey into (instead of creating a second duplicate entry)
   • Add new NordPass importer
   • Update all existing importers to also import credit cards and secure notes separately + folders (if there are any),

6. Bugfixes

   • Fixed issues where large vaults could throw errors when trying to open them in the browser extension
   • Favicon logos are now deduplicated, meaning duplicate credentials for the same website now share the same favicon, resulting in a smaller vault size
   • Fixed bug where changing username in self-hosted admin panel could result in login issues
   • Security hardening fixes

Read more details about this release on our blog:
https://www.aliasvault.net/news/aliasvault-0.26.0-released.

Note: as with any large update, if you encounter an issue, please report it on GitHub or join the AliasVault Discord: we actively monitor and respond quickly.

🚀 New Features

• Update datamodel to use fields based approach by @lanedirt in https://github.com/aliasvault/aliasvault/pull/1428
• UI tweaks by @lanedirt in https://github.com/aliasvault/aliasvault/pull/1466
• Cleanup translations by @lanedirt in https://github.com/aliasvault/aliasvault/pull/1470
• Usability tweaks by @lanedirt in https://github.com/aliasvault/aliasvault/pull/1476
• Update docker build to include new Rust core libraries by @lanedirt in https://github.com/aliasvault/aliasvault/pull/1484
• Add Romanian language option to all apps by @lanedirt in https://github.com/aliasvault/aliasvault/pull/1486
• Update importers to detect folders and optionally new item types by @lanedirt in https://github.com/aliasvault/aliasvault/pull/1482
• Tweak iOS autofill link in settings to go directly to correct settings screen by @lanedirt in https://github.com/aliasvault/aliasvault/pull/1503
• Fix issue where large vaults could throw quota limitation errors in browser extension by @lanedirt in https://github.com/aliasvault/aliasvault/pull/1508
• Add NordPass import method by @lanedirt in https://github.com/aliasvault/aliasvault/pull/1511
• Update installation guide by @NightFurySL2001 in https://github.com/aliasvault/aliasvault/pull/1509
• Add random string generator for email aliases when login item has no alias fields by @lanedirt in https://github.com/aliasvault/aliasvault/pull/1515
• Add confirm warning to admin when stopping services by @lanedirt in https://github.com/aliasvault/aliasvault/pull/1521

🐞 Bug Fixes

• Authentication activity could appear incomplete for some users by @lanedirt in https://github.com/aliasvault/aliasvault/pull/1490
• Firefox browser extension closes when trying to upload an attachment by @lanedirt in https://github.com/aliasvault/aliasvault/pull/1492
• Add JS bundler to web app to prevent loading errors by @lanedirt in https://github.com/aliasvault/aliasvault/pull/1494
• Fix bug where mobile app would crash because of certain SVG icon formats by @lanedirt in https://github.com/aliasvault/aliasvault/pull/1510
• Fix Android passkey creation error for certain apps like Whatsapp by @lanedirt in https://github.com/aliasvault/aliasvault/pull/1512
• Fix duplicate key value error on credential save by @lanedirt in https://github.com/aliasvault/aliasvault/pull/1514
• Fix bug where emails did not load when using a capital letter in the alias email address by @lanedirt in https://github.com/aliasvault/aliasvault/pull/1519

🔐 Security Hardening

• Disable iOS/Android native backups for AliasVault app data by @lanedirt in https://github.com/aliasvault/aliasvault/pull/1499 (reported by @nmochea)
• Fix hosted self-XSS in Notes field (reported by @dedrknex))

🧩 Dependencies Updates

• Bump react-server-dom-webpack from 19.0.2 to 19.0.3 in /apps/mobile-app in the npm_and_yarn group across 1 directory by @dependabot[bot] in https://github.com/aliasvault/aliasvault/pull/1431
• Bump uri from 1.0.3 to 1.0.4 in /docs in the bundler group across 1 directory by @dependabot[bot] in https://github.com/aliasvault/aliasvault/pull/1444
• Bump qs from 6.13.0 to 6.14.1 in /apps/mobile-app in the npm_and_yarn group across 1 directory by @dependabot[bot] in https://github.com/aliasvault/aliasvault/pull/1445
• Bump react-router from 7.6.0 to 7.12.0 in /apps/browser-extension in the npm_and_yarn group across 1 directory by @dependabot[bot] in https://github.com/aliasvault/aliasvault/pull/1452
• Bump undici from 6.21.3 to 6.23.0 in /apps/mobile-app in the npm_and_yarn group across 1 directory by @dependabot[bot] in https://github.com/aliasvault/aliasvault/pull/1460
• Bump tar from 7.5.3 to 7.5.6 in /apps/mobile-app in the npm_and_yarn group across 1 directory by @dependabot[bot] in https://github.com/aliasvault/aliasvault/pull/1469
• Bump lodash from 4.17.21 to 4.17.23 in /apps/mobile-app in the npm_and_yarn group across 1 directory by @dependabot[bot] in https://github.com/aliasvault/aliasvault/pull/1479
• Bump esbuild from 0.24.2 to 0.25.0 in /apps/server/AliasVault.Client in the npm_and_yarn group across 1 directory by @dependabot[bot] in https://github.com/aliasvault/aliasvault/pull/1498

New Contributors

• @NightFurySL2001 made their first contribution in https://github.com/aliasvault/aliasvault/pull/1509

Full Changelog: https://github.com/aliasvault/aliasvault/compare/0.25.2...0.26.0