Release 13 November 2026

The November release focuses on performance, scalability, and reliability across PentestPortal, introducing support for larger Nessus and Nmap scan imports (up to 250 MB) alongside faster loading times in Risk Management and Overview pages.

We’ve also rolled out important security and infrastructure updates, including a Node.js security upgrade and improved ClamAV malware scanning reliability. As usual, the release includes a range of bug fixes across file uploads, PDF report exports, report delivery emails, pentest pages, and general UI stability.

Features & Improvements

Support for larger Nessus and Nmap imports (up to 250 MB)

• Increased both the warning and maximum upload limits for .nessus and Nmap scan files to 250 MB.

• Large Nessus XML files are now pre-filtered before parsing and transfer, making imports of large scans (e.g., hundreds of hosts) significantly faster and more reliable.

Risk Management & Overview performance improvements

• Improved loading speed across the Risk Overview and Risk Manager (now defaulting to 25 items per page) by optimizing and parallelizing data retrieval.

• Reduced redundant autocomplete requests in the rich-text editor for a smoother editing experience.

Security & infrastructure updates

• Upgraded Node.js to 24.22.1 to patch a security vulnerability (CVE-2026-111497).

• Improved ClamAV malware scanning deployment stability and container build efficiency.

Bug Fixes

• PP-800 MPK file uploads & file-type detection: Fixed an issue where .mpk uploads could fail due to ClamAV scan limits and file-type detection handling.

• Report delivery emails for Customer Functional Managers: Fixed an issue where report delivery emails were blocked when a report exceeded the attachment size limit, even when the recipient had Customer Functional Manager access and was allowed to log in to download the report from the portal.

• PDF report export error: Fixed an error that could prevent PDF reports from downloading when template-like syntax appeared in report or customer fields.

• PP-802 Pentest pages & liability waiver stability: Fixed a frontend crash on pentest pages and prevented unnecessary errors when loading liability waiver form data.

• UI, navigation, and dialog fixes: Fixed an issue where an add (+) button could display literal icon text instead of the icon. Resolved issues where dialogs, risk navigation, QA demand checks, and data views could trigger incomplete requests before page parameters were fully loaded.

• PP-803 Attachments, calendar, and contact person lookups: Prevented unnecessary 404/4xx errors when loading empty attachments or calendar items, and improved validation error details. Fixed edge cases in contact person lookups where empty values could be mishandled or ordering could be lost.

• Health-check endpoint reliability: Ensured /healthz health-check probes respond directly without redirects.

We believe that PentestPortal will greatly enhance the experience of individual penetration testers, penetration testing firms and enterprises conducting their own pentests and that PentestPortal contributes to more efficient and effective penetration testing. Your feedback is invaluable in helping us improve and tailor the software to meet your needs.

Thank you for choosing our software, and we look forward to hearing your thoughts on this exciting new release!