nodemailer
10.2.1 · 22 Oct 2026MIT-023.7M / weekRepositoryHomepagenpmAtom feed
Upgrading nodemailer from 6.4.16 to 10.2.1
99 releases in betweennotes for 32
Counted from 32 of 99 release notes. Advisories are counted from the advisory database, in full.
Before you upgrade
Tick each one off as you go- breaking10.2.1
- breaking10.0.0
Security
Fixes 23 advisories affecting 6.4.16
- Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message header injectionmoderate · GHSA-268h-hp4c-crq3
- Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signingmoderate · GHSA-39m8-27wv-hr27
- Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of servicemoderate · GHSA-4ffr-jq9g-5ffx
- Nodemailer: Quadratic (O(n^2)) SMTP client reply parsing lets a malicious server or MITM cause a pre-auth remote denial of servicemoderate · GHSA-4g23-2xm8-66gc
- Nodemailer: Process-global DNS cache reuses TLS `servername` across transports, enabling cross-tenant SMTP credential disclosuremoderate · GHSA-6vj9-mwq6-2f5v
- Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not namemoderate · GHSA-85x2-q946-cp5h
- Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipientmoderate · GHSA-8c8m-p3m8-cjg8
- Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disableUrlAccess when called with the legacy signaturemoderate · GHSA-8m3c-c648-2xjj
- Nodemailer: Nested structured recipient arrays bypass the parser depth limit and cause stack exhaustion DoSmoderate · GHSA-8vvx-rff5-p5rq
- nodemailer ReDoS when trying to send a specially crafted emailmoderate · GHSA-9h6g-pr28-7cqp
- Nodemailer has SMTP command injection due to unsanitized `envelope.size` parameterlow · GHSA-c7w3-x93f-qmm8
- Nodemailer: RFC 5322 comment inside an angle-bracket address is never strippedmoderate · GHSA-g73g-hqqh-jr95
- Header injection in nodemailermoderate · GHSA-hwqf-gcqm-7353
- Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipientmoderate · GHSA-m943-m63m-w62w
- Nodemailer: Email to an unintended domain can occur due to Interpretation Conflictmoderate · GHSA-mm7p-fcc7-pg87
- Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered messagehigh · GHSA-p6gq-j5cr-w38f
- Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interceptionhigh · GHSA-r7g4-qg5f-qqm2
- Nodemailer’s addressparser is vulnerable to DoS caused by recursive callshigh · GHSA-rcmh-qjqh-p98v
- Nodemailer: Quadratic backtracking in the addressparser free-text fallback allows remote denial of servicehigh · GHSA-v53p-9fqp-m79j
- Nodemailer Vulnerable to SMTP Command Injection via CRLF in Transport name Option (EHLO/HELO) moderate · GHSA-vvjj-xcjg-gr5g
- Nodemailer: IDN/Punycode domain allow-list bypass leads to email delivery to an attacker-controlled domainmoderate · GHSA-wmmp-3585-3rmp
- Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess during message normalizationmoderate · GHSA-wqvq-jvpq-h66f
- Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address listhigh · GHSA-2x7j-588g-ccc2
Release by release
10.2.1nothing new or fixed in the note
- new
Add info.serverMessageId from the final 250 reply
- new
Add pendingCount() to the SMTP pool
- new
Make header value encoding public with MimeNode encodeHeaderValue()
- new
Mark SMTP errors as permanent or transient with err.permanent
- fixed
Label an ASCII message/rfc822 attachment 7bit instead of 8bit
- fixed
Report the recipients an LMTP server refuses after DATA in rejectedErrors
- new
- fixed
mime-funcs: encode parameter values that look like encoded words
- fixed
- fixed
addressparser: read groups in the same pass as the rest of the list
- fixed
- fixed
addressparser: handle an address list without copying it per address
- fixed
addressparser: tokenize into offsets instead of an object per token
- fixed
- fixed
addressparser: apply the unexpected "<" rule outside quotes and comments
- fixed
addressparser: bound group nesting at ten levels
- fixed
addressparser: drop the obsolete route from an angle-addr
- fixed
addressparser: end a comment only at the ")" that closes the outermost one
- fixed
- fixed
Format References and strip URLs in linear time, release any number of streams
- fixed
- fixed
Bound the work a message can make the mailer do and keep per-message auth off the transport's token endpoint
- fixed
1 internal line (docs, tests, tooling) left out.