nodemailer
10.2.1 · 22 Oct 2026MIT-023.7M / weekRepositoryHomepagenpmAtom feed
Upgrading nodemailer from 3.1.7 to 10.1.4
144 releases in betweennotes for 69
Counted from 69 of 144 release notes. Advisories are counted from the advisory database, in full.
Before you upgrade
Tick each one off as you go- breaking10.0.0
- breaking9.0.0
- breaking8.0.0
- breaking7.0.0
- breaking5.0.0
Security
Fixes 23 advisories affecting 3.1.7
- Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message header injectionmoderate · GHSA-268h-hp4c-crq3
- Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signingmoderate · GHSA-39m8-27wv-hr27
- Command injection in nodemailercritical · GHSA-48ww-j4fc-435p
- Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of servicemoderate · GHSA-4ffr-jq9g-5ffx
- Nodemailer: Quadratic (O(n^2)) SMTP client reply parsing lets a malicious server or MITM cause a pre-auth remote denial of servicemoderate · GHSA-4g23-2xm8-66gc
- Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not namemoderate · GHSA-85x2-q946-cp5h
- Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipientmoderate · GHSA-8c8m-p3m8-cjg8
- Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disableUrlAccess when called with the legacy signaturemoderate · GHSA-8m3c-c648-2xjj
- Nodemailer: Nested structured recipient arrays bypass the parser depth limit and cause stack exhaustion DoSmoderate · GHSA-8vvx-rff5-p5rq
- nodemailer ReDoS when trying to send a specially crafted emailmoderate · GHSA-9h6g-pr28-7cqp
- Nodemailer has SMTP command injection due to unsanitized `envelope.size` parameterlow · GHSA-c7w3-x93f-qmm8
- Nodemailer: RFC 5322 comment inside an angle-bracket address is never strippedmoderate · GHSA-g73g-hqqh-jr95
- Header injection in nodemailermoderate · GHSA-hwqf-gcqm-7353
- Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipientmoderate · GHSA-m943-m63m-w62w
- Nodemailer: Email to an unintended domain can occur due to Interpretation Conflictmoderate · GHSA-mm7p-fcc7-pg87
- Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered messagehigh · GHSA-p6gq-j5cr-w38f
- Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interceptionhigh · GHSA-r7g4-qg5f-qqm2
- Nodemailer’s addressparser is vulnerable to DoS caused by recursive callshigh · GHSA-rcmh-qjqh-p98v
- Nodemailer: Quadratic backtracking in the addressparser free-text fallback allows remote denial of servicehigh · GHSA-v53p-9fqp-m79j
- Nodemailer Vulnerable to SMTP Command Injection via CRLF in Transport name Option (EHLO/HELO) moderate · GHSA-vvjj-xcjg-gr5g
- Nodemailer: IDN/Punycode domain allow-list bypass leads to email delivery to an attacker-controlled domainmoderate · GHSA-wmmp-3585-3rmp
- Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess during message normalizationmoderate · GHSA-wqvq-jvpq-h66f
- Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address listhigh · GHSA-2x7j-588g-ccc2
- 8.0.9
Two pending security advisories (jsonTransport access bypass, List-* CRLF injection)
- 8.0.5
Sanitize CRLF in transport name option to prevent SMTP command injection (GHSA-vvjj-xcjg-gr5g)
- 8.0.4
Sanitize envelope size to prevent SMTP command injection
Release by release
- fixed
addressparser: apply the unexpected "<" rule outside quotes and comments
- fixed
addressparser: bound group nesting at ten levels
- fixed
addressparser: drop the obsolete route from an angle-addr
- fixed
addressparser: end a comment only at the ")" that closes the outermost one
- fixed
- fixed
Format References and strip URLs in linear time, release any number of streams
- fixed
- fixed
Bound the work a message can make the mailer do and keep per-message auth off the transport's token endpoint
- fixed
- fixed
fetch: strip credentials on any cross-origin redirect
- fixed
- new
Harden message streams, SMTP connections and the connection pool
- new
Encode base64 and quoted-printable without per-chunk delays
- fixed
Do not read the environment or the interface table on import
- fixed
End the SMTP session on any 421 reply and drive the envelope through one step
- new
- fixed
addressparser: keep an escaped parenthesis inside a comment
- fixed
fetch: keep the case of cookie names
- fixed
fetch: read the cookie name-value pair by position
- fixed
- fixed
addressparser: keep a quoted display name that holds no "@" out of the address
- fixed
addressparser: keep the group recursion depth out of the options object
- fixed
addressparser: stop a "[" from hiding the operators after it
- fixed
dkim: trim a header field name in linear time
- fixed
mime-funcs: read and write header parameters per rfc2045 and rfc2231
- fixed
Search only the new bytes for the end of the proxy CONNECT response
- fixed
11 other lines we could not sort, mostly version bumps
- 6.9.0
Include EHLO extensions in the send response
- 6.7.0
Updated DNS resolving logic. If there are multiple responses for a A/AAAA record, then loop these randomly instead of only caching the first one
- 6.6.0
Aws ses connection verification (Ognjen Jevremovic)
- 6.5.0
Pass through textEncoding to subnodes
- 6.2.1
No changes. It is the same as 6.2.0 that was accidentally published as 6.2.1 to npm
- 6.0.0
SMTPConnection: Use removeListener instead of removeAllListeners (xr0master) [ddc4af15]
- 5.1.0
Official support for custom authentication methods and examples (examples/custom-auth-async.js and examples/custom-auth-cb.js)
- 5.0.0
Show more logs for renewing OAuth2 tokens, previously it was not possible to see what actually failed
- 4.7.0
Cleaned up List-* header generation
- 4.4.0
Changed default behavior for attachment option contentTransferEncoding. If it is unset then base64 encoding is used for the attachment. If it is set to false then previous default applies (base64 for most, 7bit for text)
1 internal line (docs, tests, tooling) left out.