nodemailer
10.2.1 · 22 Oct 2026MIT-023.7M / weekRepositoryHomepagenpmAtom feed
Upgrading nodemailer from 6.9.2 to 6.10.1
16 releases in betweenevery note read
- 0
- changes to make
- 1
- advisory fixed
- 5
- new
- 14
- fixes
Security
22 advisories still affect 6.10.1
- Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message header injectionmoderate · GHSA-268h-hp4c-crq3
- Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signingmoderate · GHSA-39m8-27wv-hr27
- Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of servicemoderate · GHSA-4ffr-jq9g-5ffx
Upgrading to 10.1.4 clears them.
Fixes 1 advisory affecting 6.9.2
- nodemailer ReDoS when trying to send a specially crafted emailmoderate · GHSA-9h6g-pr28-7cqp
- 6.9.9
security: Fix issues described in GHSA-9h6g-pr28-7cqp. Do not use eternal matching pattern if only a few occurences are expected
Release by release
- fixed
Close correct socket
- fixed
- new
services: add Seznam email service configuration
- fixed
proxy: Set error and timeout errors for proxied sockets
- new
- fixed
addressparser: Correctly detect if user local part is attached to domain part
- fixed
- new
api: Added support for Ethereal authentication
- new
services.json: Add Email Services Provider Feishu Mail (CN)
- new
well-known-services: Add Loopia in well known services
- fixed
services.json: update Mailtrap host and port in well known
- new
- fixed
tls: Ensure servername for SMTP
- fixed
- fixed
message-generation: Escape single quote in address names
- fixed
- fixed
headers: Ensure that Content-type is the bottom header
- fixed
3 other lines we could not sort, mostly version bumps
- 6.9.4
Renamed SendinBlue to Brevo
- 6.9.3
Specified license identifier (was defined as MIT, actual value MIT-0)
- 6.9.3
If SMTP server disconnects with a message, process it and include as part of the response error
2 internal lines (docs, tests, tooling) left out.