nodemailer
10.2.1 · 22 Oct 2026MIT-023.7M / weekRepositoryHomepagenpmAtom feed
Upgrading nodemailer from 6.4.8 to 6.10.1
45 releases in betweennotes for 43
- ?
- changes to make
- 3
- advisories fixed
- 14+
- new
- 29+
- fixes
Counted from 43 of 45 release notes. Advisories are counted from the advisory database, in full.
Security
22 advisories still affect 6.10.1
- Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message header injectionmoderate · GHSA-268h-hp4c-crq3
- Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signingmoderate · GHSA-39m8-27wv-hr27
- Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of servicemoderate · GHSA-4ffr-jq9g-5ffx
Upgrading to 10.1.4 clears them.
Fixes 3 advisories affecting 6.4.8
- Command injection in nodemailercritical · GHSA-48ww-j4fc-435p
- nodemailer ReDoS when trying to send a specially crafted emailmoderate · GHSA-9h6g-pr28-7cqp
- Header injection in nodemailermoderate · GHSA-hwqf-gcqm-7353
- 6.9.9
security: Fix issues described in GHSA-9h6g-pr28-7cqp. Do not use eternal matching pattern if only a few occurences are expected
Release by release
- fixed
Close correct socket
- fixed
- new
services: add Seznam email service configuration
- fixed
proxy: Set error and timeout errors for proxied sockets
- new
- fixed
addressparser: Correctly detect if user local part is attached to domain part
- fixed
- new
api: Added support for Ethereal authentication
- new
services.json: Add Email Services Provider Feishu Mail (CN)
- new
well-known-services: Add Loopia in well known services
- fixed
services.json: update Mailtrap host and port in well known
- new
- fixed
tls: Ensure servername for SMTP
- fixed
- fixed
message-generation: Escape single quote in address names
- fixed
- fixed
headers: Ensure that Content-type is the bottom header
- fixed
19 other lines we could not sort, mostly version bumps
- 6.9.4
Renamed SendinBlue to Brevo
- 6.9.3
Specified license identifier (was defined as MIT, actual value MIT-0)
- 6.9.3
If SMTP server disconnects with a message, process it and include as part of the response error
- 6.9.0
Include EHLO extensions in the send response
- 6.7.7
Resolver fixes
- 6.7.5
No changes, pushing a new README to npmjs.org
- 6.7.4
Replaced Travis with Github Actions
- 6.7.3
Update Outlook/Hotmail host in well known services (popod)
- 6.7.0
Updated DNS resolving logic. If there are multiple responses for a A/AAAA record, then loop these randomly instead of only caching the first one
- 6.6.5
Replaced Object.values() and Array.flat() with polyfills to allow using Nodemailer in Node v6+
3 internal lines (docs, tests, tooling) left out.