Mockoon release v9.9.0

2026-09-16

Welcome to this new release of Mockoon. It brings support for connecting to a self-hosted API in the future, a smarter CRUD auto-generated ID strategy, Content-Type charset override, and several bug fixes and improvements. Read on to learn more about this release.

 Support us!

Mockoon is proudly independent and open-source, maintained without external funding. We rely on both sponsorships and Mockoon Cloud subscriptions to keep improving the project and building new features. A big thank you to the companies below for supporting our work and helping us grow (and all the sponsors who helped this project over time!):

GitHub Localazy
SerpApi

If you'd like to support Mockoon as well, you can become a sponsor or subscribe to Mockoon Cloud. Every contribution helps keep the project alive and evolving. Thank you!

sponsor button subscribe to cloud button

 Deprecation of the @mockoon/serverless library

The @mockoon/serverless package is now formally deprecated and will no longer receive new feature updates.

We recommend using the official Mockoon CLI Docker image instead when running mocks on serverless platforms such as AWS Lambda or Google Cloud Run. We plan to remove the @mockoon/serverless package entirely in a future major release.

(Issue #2079)

 Preparation for self-hosted API

The desktop and web applications have been updated to support connecting to a self-hosted Mockoon backend.

We announced earlier this year that self-hosting would be our focus for the rest of 2026.

Nothing to see yet, but a self-hosted backend supporting Mockoon Cloud features will soon be available as a paid product. Stay tuned for more updates as development progresses.

(PR #2354)

 Improvements

  • Mockoon now respects explicit Content-Type header definitions on your responses without automatically forcing a charset=utf-8 suffix, giving you full control over response headers and non-UTF-8 payload encodings. More details can be found in the response headers documentation. (Issue #539)

  • When opening an environment via custom protocol (mockoon://), the application now prompts for the destination save path before fetching the remote file, making remote imports clearer and providing smoother cancellation handling. (PR #2341)

  • The Logs tab search has been enhanced to include request and response bodies as well as headers, alongside the URL path, HTTP method, and status code. This makes debugging much easier when working with identical URLs (such as GraphQL endpoints) or searching for specific headers and payload properties without having to manually inspect every logged transaction. (Issue #1881)

  • When importing an OpenAPI specification that contains remote $ref references, Mockoon will now warn you before dereferencing and fetching external URLs, listing the target endpoints for greater visibility and security. In addition, a new CLI flag has been added to disable remote URL dereferencing during automated OpenAPI imports: --disable-external-refs. (Issue #2339)

  • CRUD routes now detect the format and templating helpers used for existing item IDs in your data bucket (such as UUIDs, auto-incrementing numbers, or helpers like {{faker 'database.mongodbObjectId'}}) and automatically reuse that strategy when auto-generating new record IDs upon POST requests. Read more in the CRUD routes documentation. (Issue #1547)

 Fixes

  • Fixed an issue where templated file paths in responses were erroneously blocked by path traversal checks. (Issue #2319)
  • Fixed an issue where non-TLS HTTP/2 requests with upgrade headers failed with an Invalid WebSocket upgrade request error when WebSocket routes were defined. (Issue #1908)
  • Fixed an issue where the Secure cookie flag was not removed when proxying HTTPS services over plain HTTP. (Issue #611)
  • Removed the append-field dependency and improved multipart form-data parsing with nested/indexed fields handling and prototype pollution protection. A prototype pollution vulnerability was fixed where specially crafted multipart form-data field names could modify Object prototype properties on the server runtime. We recommend updating to this version as soon as possible if your mocks process untrusted requests or are exposed publicly. This vulnerability was disclosed in GHSA-cmwm-hp2w-h3cx. Read our security update. (PR #2355)

 Chores

  • Migrated automated end-to-end desktop test mocking to WDIO Electron mocks. (PR #2258)
  • Updated application and library dependencies to their latest versions. (PR #2356)