nodemailer
10.2.1 · 22 Oct 2026MIT-023.7M / weekRepositoryHomepagenpmAtom feed
Upgrading nodemailer from 4.1.1 to 4.7.0
19 releases in betweennotes for 6
Security
23 advisories still affect 4.7.0
- Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message header injectionmoderate · GHSA-268h-hp4c-crq3
- Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signingmoderate · GHSA-39m8-27wv-hr27
- Command injection in nodemailercritical · GHSA-48ww-j4fc-435p
Upgrading to 10.1.4 clears them.
Release by release
- new
Support promises
for mailcomposer.build() - fixed
Fixed 'full' return option for DSN (klaronix) [23b93a3b]
- new
4.6.1 – 4.6.88 releases, no release note
- new
Support socks module v2 in addition to v1 [e228bcb2]
- new
Allow using local addresses [8f6fa35f]
- fixed
Fixed invalid promise return value when using createTestAccount [5524e627]
- new
- new
Added new message transport option
normalizeHeaderKey(key)=>normalizedKeyfor custom header formatting
- new
4.3.1 – 4.4.24 releases, nothing new or fixed; 3 without a note
- new
Added new mail object method
mail.normalize(cb)that should make creating HTTP API based transports much easier
- new
- new
Expose streamed messages size and timers in info response
- new
4.1.2 – 4.1.32 releases, no release note
2 other lines we could not sort, mostly version bumps
- 4.7.0
Cleaned up List-* header generation
- 4.4.0
Changed default behavior for attachment option contentTransferEncoding. If it is unset then base64 encoding is used for the attachment. If it is set to false then previous default applies (base64 for most, 7bit for text)