nodemailer
10.2.1 · 22 Oct 2026MIT-023.7M / weekRepositoryHomepagenpmAtom feed
Upgrading nodemailer from 6.9.7 to 6.10.1
11 releases in betweenevery note read
- 0
- changes to make
- 1
- advisory fixed
- 5
- new
- 11
- fixes
Security
22 advisories still affect 6.10.1
- Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message header injectionmoderate · GHSA-268h-hp4c-crq3
- Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signingmoderate · GHSA-39m8-27wv-hr27
- Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of servicemoderate · GHSA-4ffr-jq9g-5ffx
Upgrading to 10.1.4 clears them.
Fixes 1 advisory affecting 6.9.7
- nodemailer ReDoS when trying to send a specially crafted emailmoderate · GHSA-9h6g-pr28-7cqp
- 6.9.9
security: Fix issues described in GHSA-9h6g-pr28-7cqp. Do not use eternal matching pattern if only a few occurences are expected
Release by release
- fixed
Close correct socket
- fixed
- new
services: add Seznam email service configuration
- fixed
proxy: Set error and timeout errors for proxied sockets
- new
- fixed
addressparser: Correctly detect if user local part is attached to domain part
- fixed
- new
api: Added support for Ethereal authentication
- new
services.json: Add Email Services Provider Feishu Mail (CN)
- new
well-known-services: Add Loopia in well known services
- fixed
services.json: update Mailtrap host and port in well known
- new
- fixed
tls: Ensure servername for SMTP
- fixed
- fixed
message-generation: Escape single quote in address names
- fixed
- fixed
headers: Ensure that Content-type is the bottom header
- fixed
1 internal line (docs, tests, tooling) left out.