nodemailer
10.2.1 · 22 Oct 2026MIT-023.7M / weekRepositoryHomepagenpmAtom feed
Upgrading nodemailer from 2.3.1 to 2.7.2
13 releases in betweennotes for 6
Security
15 advisories still affect 2.7.2
- Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message header injectionmoderate · GHSA-268h-hp4c-crq3
- Command injection in nodemailercritical · GHSA-48ww-j4fc-435p
- Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disableUrlAccess when called with the legacy signaturemoderate · GHSA-8m3c-c648-2xjj
Upgrading to 10.0.6 clears them.
Release by release
2.6.1 – 2.7.27 releases, nothing new or fixed; 6 without a note
- new
Added new options disableFileAccess and disableUrlAccess
- fixed
Fixed envelope handling where cc/bcc fields were ignored in the envelope object
- new
2.4.2 – 2.5.02 releases, nothing new or fixed; 1 without a note
- fixed
Fixed outdated shrinkwrap file
- fixed
- new
Added NTLM authentication support
- new
2.3.2nothing new or fixed in the note
4 other lines we could not sort, mostly version bumps
- 2.7.0
Bumped mailcomposer that generates encoded-words differently which might break some tests
- 2.4.2
Removed shrinkwrap file. Seemed to cause more trouble than help
- 2.4.0
Bumped mailcomposer module to allow using
falseas attachment filename (suppresses filename usage) - 2.3.2
Bumped smtp transport modules to get newest smtp-connection that fixes SMTPUTF8 support for internationalized email addresses