nodemailer
10.2.1 · 22 Oct 2026MIT-023.7M / weekRepositoryHomepagenpmAtom feed
Upgrading nodemailer from 0.3.25 to 10.0.6
230 releases in betweennotes for 193
Counted from 193 of 230 release notes. Advisories are counted from the advisory database, in full.
Start here
Before you upgrade
Tick each one off as you go- breaking10.0.0
- breaking9.0.0
- breaking8.0.0
- breaking7.0.0
- breaking5.0.0
- breaking0.5.6
Security
8 advisories still affect 10.0.6
- Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signingmoderate · GHSA-39m8-27wv-hr27
- Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of servicemoderate · GHSA-4ffr-jq9g-5ffx
- Nodemailer: Quadratic (O(n^2)) SMTP client reply parsing lets a malicious server or MITM cause a pre-auth remote denial of servicemoderate · GHSA-4g23-2xm8-66gc
Upgrading to 10.1.4 clears them.
Fixes 15 advisories affecting 0.3.25
- Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message header injectionmoderate · GHSA-268h-hp4c-crq3
- Command injection in nodemailercritical · GHSA-48ww-j4fc-435p
- Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disableUrlAccess when called with the legacy signaturemoderate · GHSA-8m3c-c648-2xjj
- Nodemailer: Nested structured recipient arrays bypass the parser depth limit and cause stack exhaustion DoSmoderate · GHSA-8vvx-rff5-p5rq
- nodemailer ReDoS when trying to send a specially crafted emailmoderate · GHSA-9h6g-pr28-7cqp
- Nodemailer has SMTP command injection due to unsanitized `envelope.size` parameterlow · GHSA-c7w3-x93f-qmm8
- Header injection in nodemailermoderate · GHSA-hwqf-gcqm-7353
- Nodemailer: Email to an unintended domain can occur due to Interpretation Conflictmoderate · GHSA-mm7p-fcc7-pg87
- Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered messagehigh · GHSA-p6gq-j5cr-w38f
- Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interceptionhigh · GHSA-r7g4-qg5f-qqm2
- Nodemailer: Quadratic backtracking in the addressparser free-text fallback allows remote denial of servicehigh · GHSA-v53p-9fqp-m79j
- Nodemailer Vulnerable to SMTP Command Injection via CRLF in Transport name Option (EHLO/HELO) moderate · GHSA-vvjj-xcjg-gr5g
- Nodemailer: IDN/Punycode domain allow-list bypass leads to email delivery to an attacker-controlled domainmoderate · GHSA-wmmp-3585-3rmp
- Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess during message normalizationmoderate · GHSA-wqvq-jvpq-h66f
- Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address listhigh · GHSA-2x7j-588g-ccc2
- 8.0.9
Two pending security advisories (jsonTransport access bypass, List-* CRLF injection)
- 8.0.5
Sanitize CRLF in transport name option to prevent SMTP command injection (GHSA-vvjj-xcjg-gr5g)
- 8.0.4
Sanitize envelope size to prevent SMTP command injection
- 7.0.6
ReDoS vulnerability in parseDataURI and _processDataUrl
- 6.9.9
security: Fix issues described in GHSA-9h6g-pr28-7cqp. Do not use eternal matching pattern if only a few occurences are expected
Release by release
- fixed
addressparser: scan free text for an address in linear time
- fixed
- fixed
addressparser: parse comment-joined addresses in linear time
- fixed
- fixed
fetch: scope a cookie without a Path to the RFC 6265 default path
- fixed
fetch: send cookies set with Path back to the exact path
- fixed
mail-composer: keep httpHeaders and tls for href alternatives and icalEvent
- fixed
Resolve well-known services by their primary domains
- fixed
ses-transport: throw a configuration error when the SES client is missing
- fixed
- fixed
mime-node: flatten nested recipient arrays without recursion
- fixed
shared: keep the TLS server name out of the DNS cache
- fixed
- new
Keep the @types/nodemailer type layout working
- new
Migrate to TypeScript with ES module and CommonJS builds
- fixed
Apply the other keys of a configuration object next to its url
- fixed
dkim: canonicalize raw messages the way verifiers do
- new
- fixed
mailer: apply the message access policy in resolveContent
- fixed
mailer: keep message data from reopening the access sandbox
- fixed
mime-node: inherit the access policy from the tree a node hangs in
- fixed
114 other lines we could not sort, mostly version bumps
- 6.9.4
Renamed SendinBlue to Brevo
- 6.9.3
Specified license identifier (was defined as MIT, actual value MIT-0)
- 6.9.3
If SMTP server disconnects with a message, process it and include as part of the response error
- 6.9.0
Include EHLO extensions in the send response
- 6.7.7
Resolver fixes
- 6.7.5
No changes, pushing a new README to npmjs.org
- 6.7.4
Replaced Travis with Github Actions
- 6.7.3
Update Outlook/Hotmail host in well known services (popod)
- 6.7.0
Updated DNS resolving logic. If there are multiple responses for a A/AAAA record, then loop these randomly instead of only caching the first one
- 6.6.5
Replaced Object.values() and Array.flat() with polyfills to allow using Nodemailer in Node v6+
6 internal lines (docs, tests, tooling) left out.