nodemailer
10.2.1 · 22 Oct 2026MIT-023.7M / weekRepositoryHomepagenpmAtom feed
10.2.1 is the newest release of 10.x.
In short
1 new1 faster11 fixed
Security
3 advisories affect 10.1.0; 10.1.4 fixes them
- ModerateNodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipientGHSA-8c8m-p3m8-cjg8 · 23 Oct 2026Fixed in 10.1.4
- ModerateNodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipientGHSA-m943-m63m-w62w · 23 Oct 2026Fixed in 10.1.4
- ModerateNodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not nameGHSA-85x2-q946-cp5h · 23 Oct 2026Fixed in 10.1.4
Release note
Features
Harden message streams, SMTP connections and the connection pool
Bug Fixes
Do not read the environment or the interface table on import
End the SMTP session on any 421 reply and drive the envelope through one step
Keep ERR_ACCESS_DENIED from the Node.js permission model
Let the proxy handshake and the SMTP connection share one deadline
mime-node: decode an SMTPUTF8 domain from its A-label form
mime-node: finish an encoded part only after its output was read
qp: encode a lone CR or LF in binary quoted-printable parts
smtp-connection: count the wait for the greeting against connectionTimeout
smtp-connection: drop the connection when DATA is taken after a refused sender
smtp-connection: refuse a second connect() call
Turn Nagle off for SMTP sockets and report an early sendmail exit as such
Performance Improvements
Encode base64 and quoted-printable without per-chunk delays