nodemailer
10.2.1 · 22 Oct 2026MIT-023.7M / weekRepositoryHomepagenpmAtom feed
Upgrading nodemailer from 4.1.2 to 4.7.0
18 releases in betweenevery note read
Security
23 advisories still affect 4.7.0
- Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message header injectionmoderate · GHSA-268h-hp4c-crq3
- Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signingmoderate · GHSA-39m8-27wv-hr27
- Command injection in nodemailercritical · GHSA-48ww-j4fc-435p
Upgrading to 10.1.4 clears them.
Release by release
- new
Support promises
for mailcomposer.build() - fixed
Fixed 'full' return option for DSN (klaronix) [23b93a3b]
- new
4.6.8nothing new or fixed in the note
- new
Added option
skipEncodingto JSONTransport
- new
- fixed
Fixes mime encoded-word compatibility issue with invalid clients like Zimbra
- fixed
- fixed
Fixed broken DKIM stream in Node.js v10
- fixed
4.6.2 – 4.6.43 releases, nothing new or fixed in the notes
- fixed
Fixed Smtp connection freezing, when trying to send after close / quit (twawszczak) [73d3911c]
- fixed
- new
Support socks module v2 in addition to v1 [e228bcb2]
- new
Allow using local addresses [8f6fa35f]
- fixed
Fixed invalid promise return value when using createTestAccount [5524e627]
- new
10 other lines we could not sort, mostly version bumps
- 4.7.0
Cleaned up List-* header generation
- 4.6.8
Use first IP address from DNS resolution when using a proxy (Limbozz) [d4ca847c]
- 4.6.8
Return raw email from SES transport (gabegorelick) [3aa08967]
- 4.6.5
Updated error messages for SMTP responses to not include a newline
- 4.6.4
Readded logo author link to README that was accidentally removed a while ago
- 4.6.3
Removed unneeded dependency
- 4.6.2
When redirecting URL calls then do not include original POST content
- 4.4.2
Enclose encodeURIComponent in try..catch to handle invalid urls
- 4.4.1
Better handling of unexpectedly dropping connections
- 4.4.0
Changed default behavior for attachment option contentTransferEncoding. If it is unset then base64 encoding is used for the attachment. If it is set to false then previous default applies (base64 for most, 7bit for text)