nodemailer
10.2.1 · 22 Oct 2026MIT-023.7M / weekRepositoryHomepagenpmAtom feed
Upgrading nodemailer from 0.3.11 to 10.2.1
264 releases in betweennotes for 213
Counted from 213 of 264 release notes. Advisories are counted from the advisory database, in full.
Start here
Before you upgrade
Tick each one off as you go- breaking10.2.1
- breaking10.0.0
- breaking9.0.0
- breaking8.0.0
- breaking7.0.0
- breaking5.0.0
- breaking0.5.6
Security
Fixes 15 advisories affecting 0.3.11
- Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message header injectionmoderate · GHSA-268h-hp4c-crq3
- Command injection in nodemailercritical · GHSA-48ww-j4fc-435p
- Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disableUrlAccess when called with the legacy signaturemoderate · GHSA-8m3c-c648-2xjj
- Nodemailer: Nested structured recipient arrays bypass the parser depth limit and cause stack exhaustion DoSmoderate · GHSA-8vvx-rff5-p5rq
- nodemailer ReDoS when trying to send a specially crafted emailmoderate · GHSA-9h6g-pr28-7cqp
- Nodemailer has SMTP command injection due to unsanitized `envelope.size` parameterlow · GHSA-c7w3-x93f-qmm8
- Header injection in nodemailermoderate · GHSA-hwqf-gcqm-7353
- Nodemailer: Email to an unintended domain can occur due to Interpretation Conflictmoderate · GHSA-mm7p-fcc7-pg87
- Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered messagehigh · GHSA-p6gq-j5cr-w38f
- Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interceptionhigh · GHSA-r7g4-qg5f-qqm2
- Nodemailer: Quadratic backtracking in the addressparser free-text fallback allows remote denial of servicehigh · GHSA-v53p-9fqp-m79j
- Nodemailer Vulnerable to SMTP Command Injection via CRLF in Transport name Option (EHLO/HELO) moderate · GHSA-vvjj-xcjg-gr5g
- Nodemailer: IDN/Punycode domain allow-list bypass leads to email delivery to an attacker-controlled domainmoderate · GHSA-wmmp-3585-3rmp
- Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess during message normalizationmoderate · GHSA-wqvq-jvpq-h66f
- Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address listhigh · GHSA-2x7j-588g-ccc2
- 8.0.9
Two pending security advisories (jsonTransport access bypass, List-* CRLF injection)
- 8.0.5
Sanitize CRLF in transport name option to prevent SMTP command injection (GHSA-vvjj-xcjg-gr5g)
- 8.0.4
Sanitize envelope size to prevent SMTP command injection
- 7.0.6
ReDoS vulnerability in parseDataURI and _processDataUrl
- 6.9.9
security: Fix issues described in GHSA-9h6g-pr28-7cqp. Do not use eternal matching pattern if only a few occurences are expected
Release by release
10.2.1nothing new or fixed in the note
- new
Add info.serverMessageId from the final 250 reply
- new
Add pendingCount() to the SMTP pool
- new
Make header value encoding public with MimeNode encodeHeaderValue()
- new
Mark SMTP errors as permanent or transient with err.permanent
- fixed
Label an ASCII message/rfc822 attachment 7bit instead of 8bit
- fixed
Report the recipients an LMTP server refuses after DATA in rejectedErrors
- new
- fixed
mime-funcs: encode parameter values that look like encoded words
- fixed
- fixed
addressparser: read groups in the same pass as the rest of the list
- fixed
- fixed
addressparser: handle an address list without copying it per address
- fixed
addressparser: tokenize into offsets instead of an object per token
- fixed
- fixed
addressparser: apply the unexpected "<" rule outside quotes and comments
- fixed
addressparser: bound group nesting at ten levels
- fixed
addressparser: drop the obsolete route from an angle-addr
- fixed
addressparser: end a comment only at the ")" that closes the outermost one
- fixed
- fixed
Format References and strip URLs in linear time, release any number of streams
- fixed
- fixed
Bound the work a message can make the mailer do and keep per-message auth off the transport's token endpoint
- fixed
114 other lines we could not sort, mostly version bumps
- 6.9.4
Renamed SendinBlue to Brevo
- 6.9.3
Specified license identifier (was defined as MIT, actual value MIT-0)
- 6.9.3
If SMTP server disconnects with a message, process it and include as part of the response error
- 6.9.0
Include EHLO extensions in the send response
- 6.7.7
Resolver fixes
- 6.7.5
No changes, pushing a new README to npmjs.org
- 6.7.4
Replaced Travis with Github Actions
- 6.7.3
Update Outlook/Hotmail host in well known services (popod)
- 6.7.0
Updated DNS resolving logic. If there are multiple responses for a A/AAAA record, then loop these randomly instead of only caching the first one
- 6.6.5
Replaced Object.values() and Array.flat() with polyfills to allow using Nodemailer in Node v6+
6 internal lines (docs, tests, tooling) left out.