nodemailer
10.2.1 · 22 Oct 2026MIT-023.7M / weekRepositoryHomepagenpmAtom feed
Upgrading nodemailer from 2.2.0 to 2.7.2
16 releases in betweennotes for 9
Security
15 advisories still affect 2.7.2
- Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message header injectionmoderate · GHSA-268h-hp4c-crq3
- Command injection in nodemailercritical · GHSA-48ww-j4fc-435p
- Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disableUrlAccess when called with the legacy signaturemoderate · GHSA-8m3c-c648-2xjj
Upgrading to 10.0.6 clears them.
Release by release
2.6.1 – 2.7.27 releases, nothing new or fixed; 6 without a note
- new
Added new options disableFileAccess and disableUrlAccess
- fixed
Fixed envelope handling where cc/bcc fields were ignored in the envelope object
- new
2.4.2 – 2.5.02 releases, nothing new or fixed; 1 without a note
- fixed
Fixed outdated shrinkwrap file
- fixed
- new
Added NTLM authentication support
- new
2.3.1 – 2.3.22 releases, nothing new or fixed in the notes
- new
Added built-in support for proxies by providing a new SMTP option
proxythat takes a proxy configuration url as its value - new
Added option
transportto dynamically load transport plugins - fixed
Fixed a bug with attachment filename that contains mixed unicode and dashes
- fixed
Do not require globally installed grunt-cli
- new
- fixed
Fixed a bug in SMTP requireTLS option that was broken
- fixed
5 other lines we could not sort, mostly version bumps
- 2.7.0
Bumped mailcomposer that generates encoded-words differently which might break some tests
- 2.4.2
Removed shrinkwrap file. Seemed to cause more trouble than help
- 2.4.0
Bumped mailcomposer module to allow using
falseas attachment filename (suppresses filename usage) - 2.3.2
Bumped smtp transport modules to get newest smtp-connection that fixes SMTPUTF8 support for internationalized email addresses
- 2.3.1
Bumped mailcomposer to have better support for message/822 attachments