nodemailer
10.2.1 · 22 Oct 2026MIT-023.7M / weekRepositoryHomepagenpmAtom feed
Upgrading nodemailer from 2.7.2 to 3.0.0
1 release in betweenevery note read
- ?
- changes to make
- 0
- advisories fixed
- 1
- new
- 0
- fixes
Security
23 advisories still affect 3.0.0
- Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message header injectionmoderate · GHSA-268h-hp4c-crq3
- Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signingmoderate · GHSA-39m8-27wv-hr27
- Command injection in nodemailercritical · GHSA-48ww-j4fc-435p
Upgrading to 10.1.4 clears them.
Release by release
- new
Delivery status notifications added to Nodemailer
- new
11 other lines we could not sort, mostly version bumps
- 3.0.0
Initial version of Nodemailer 3
- 3.0.0
License changed from MIT to EUPL-1.1. This was possible as the new version of Nodemailer is a major rewrite. The features I don't have ownership for, were removed or reimplemented. If there's still some snippets in the code that have vague ownership then notify andris@kreata.ee about the conflicting code and I'll fix it.
- 3.0.0
Requires Node.js v6+
- 3.0.0
All templating is gone. It was too confusing to use and to be really universal a huge list of different renderers would be required. Nodemailer is about email, not about parsing different template syntaxes
- 3.0.0
No NTLM authentication. It was too difficult to re-implement. If you still need it then it would be possible to introduce a pluggable SASL interface where you could load the NTLM module in your own code and pass it to Nodemailer. Currently this is not possible.
- 3.0.0
OAuth2 authentication is built in and has a different configuration. You can use both user (3LO) and service (2LO) accounts to generate access tokens from Nodemailer. Additionally there's a new feature to authenticate differently for every message – useful if your application sends on behalf of different users instead of a single sender.
- 3.0.0
Improved Calendaring. Provide an ical file to Nodemailer to send out calendar events.
- 3.0.0
All dependencies were dropped. There is exactly 0 dependencies needed to use Nodemailer. This brings the installation time of Nodemailer from NPM down to less than 2 seconds
- 3.0.0
Improved and built-in DKIM signing of messages. Previously you needed an external module for this and it did quite a lousy job with larger messages
- 3.0.0
Stream transport to return a RFC822 formatted message as a stream. Useful if you want to use Nodemailer as a preprocessor and not for actual delivery.