nodemailer
10.2.1 · 22 Oct 2026MIT-023.7M / weekRepositoryHomepagenpmAtom feed
Upgrading nodemailer from 0.5.15 to 0.6.0
1 release in betweenevery note read
- 0
- changes to make
- 0
- advisories fixed
- 2
- new
- 0
- fixes
Security
15 advisories still affect 0.6.0
- Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message header injectionmoderate · GHSA-268h-hp4c-crq3
- Command injection in nodemailercritical · GHSA-48ww-j4fc-435p
- Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disableUrlAccess when called with the legacy signaturemoderate · GHSA-8m3c-c648-2xjj
Upgrading to 10.0.6 clears them.
Release by release
- new
Allow defining custom transport methods [ec5b48ce]
- new
Added support for IIS pickup directory with PICKUP transport (philipproplesch) [36940b59..360a2878]
- new
6 other lines we could not sort, mostly version bumps
- 0.6.0
Bumped version to v0.6.0
- 0.6.0
Return messageId with responseObject for all built in transport methods [74445cec]
- 0.6.0
Bumped dependency versions for mailcomposer and readable-stream [9a034c34]
- 0.6.0
Changed pickup argument name to 'directory' [01c3ea53]
- 0.6.0
Applied common styles [9e93a409]
- 0.6.0
Updated readme [c78075e7]