LoginSign Up
← Back to all sparks
M

Mirth Connect

DEVOPS
Velocity0.0

Healthcare integration engine for routing and transforming clinical messages

nextgen.com/solutions/interoperability ↗

A healthcare integration engine that spent two years recovering from one CVE

healthcare-integrationhl7cve-remediationduo-mfajava-upgrade
◆Current state
Mirth Connect's release notes are thin — a sentence of framing, then download tables — with the substance living on external release-notes pages. What is visible is a security posture. Two entries carry an explicit banner that the version is affected by CVE-2023-43208 and CVE-2023-37679 and that users must move to 4.4.1 or later, and the releases after that are dominated by security patches rather than features. Platform deadlines recur: Duo's Traditional Prompt retired, Java 17 becoming the minimum.
◆Where it's heading
The arc is remediation and platform currency, not capability. Once a remote-code-execution class vulnerability hits an engine sitting between hospital systems, the product's job becomes proving it is safe to keep running, and the 4.4.x and 4.5.x lines read accordingly — patch releases described only as security improvements. The forward-looking notices about Java 17 and the Administrator Launcher signal that upgrade friction is the next thing operators will feel.
◆Prediction
Expect the Java 17 minimum to land as the gating change in an upcoming release, since it is the only concrete commitment these notes make about future versions.

◆Recent moves

  1. 1y ago

    4.5.2 patches security and announces a Java 17 minimum

    A patch release combining enhancements, fixes and security improvements, notable mainly for the notice that Mirth Connect will require Java 17 as its minimum supported version. That is the upgrade planning signal in an otherwise routine release.

    View source ↗
  2. 2y ago

    4.5.1 ships as a security-only patch

    Described entirely as security improvements with no feature or fix list — the shape of a release that exists because something needed patching. Consistent with the post-CVE posture across this line.

    View source ↗
  3. 2y ago

    4.5.0 moves Duo MFA to the Universal Prompt

    A forced authentication migration rather than a chosen one: Duo's Traditional Prompt stopped working after March 30, 2024, so multi-factor auth moves to the Universal Prompt. Bundled with security updates and bug fixes, plus a revised notice about changes coming in 4.7.0.

    View source ↗
  4. 2y ago

    Mirth Connect 4.4.2

    A patch release described as bug fixes plus one improvement to exporting messages. Nothing beyond routine maintenance is visible in the notes.

    View source ↗
  5. 2y ago

    4.1.0 adds event log messages and richer alerts, but carries the critical CVE

    The last genuinely feature-carrying release here — new event log messages, additional Welcome screen fields, more information in alerts, and commercial extension improvements. It ships with a banner warning that this version is affected by CVE-2023-43208 and CVE-2023-37679 and that users must move to 4.4.1 or later.

    View source ↗
  6. 2y ago

    Mirth Connect 4.1.1

    A patch containing Welcome screen modifications and two fixed defects, carrying the same critical-vulnerability warning as 4.1.0. Superseded by the 4.4.1 upgrade advice in its own notes.

    View source ↗