nodemailer
10.2.1 · 22 Oct 2026MIT-023.7M / weekRepositoryHomepagenpmAtom feed
Upgrading nodemailer from 7.0.0 to 10.1.4
55 releases in betweennotes for 45
Counted from 45 of 55 release notes. Advisories are counted from the advisory database, in full.
Before you upgrade
Tick each one off as you go- breaking10.0.0
- breaking9.0.0
- breaking8.0.0
Security
Fixes 22 advisories affecting 7.0.0
- Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message header injectionmoderate · GHSA-268h-hp4c-crq3
- Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signingmoderate · GHSA-39m8-27wv-hr27
- Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of servicemoderate · GHSA-4ffr-jq9g-5ffx
- Nodemailer: Quadratic (O(n^2)) SMTP client reply parsing lets a malicious server or MITM cause a pre-auth remote denial of servicemoderate · GHSA-4g23-2xm8-66gc
- Nodemailer: Process-global DNS cache reuses TLS `servername` across transports, enabling cross-tenant SMTP credential disclosuremoderate · GHSA-6vj9-mwq6-2f5v
- Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not namemoderate · GHSA-85x2-q946-cp5h
- Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipientmoderate · GHSA-8c8m-p3m8-cjg8
- Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disableUrlAccess when called with the legacy signaturemoderate · GHSA-8m3c-c648-2xjj
- Nodemailer: Nested structured recipient arrays bypass the parser depth limit and cause stack exhaustion DoSmoderate · GHSA-8vvx-rff5-p5rq
- Nodemailer has SMTP command injection due to unsanitized `envelope.size` parameterlow · GHSA-c7w3-x93f-qmm8
- Nodemailer: Recipient-domain validation bypass via RFC 5322 comment mis-parsing leads to email delivery to an attacker-controlled domainmoderate · GHSA-cc9r-2j5m-2m83
- Nodemailer: RFC 5322 comment inside an angle-bracket address is never strippedmoderate · GHSA-g73g-hqqh-jr95
- Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipientmoderate · GHSA-m943-m63m-w62w
- Nodemailer: Email to an unintended domain can occur due to Interpretation Conflictmoderate · GHSA-mm7p-fcc7-pg87
- Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered messagehigh · GHSA-p6gq-j5cr-w38f
- Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interceptionhigh · GHSA-r7g4-qg5f-qqm2
- Nodemailer’s addressparser is vulnerable to DoS caused by recursive callshigh · GHSA-rcmh-qjqh-p98v
- Nodemailer: Quadratic backtracking in the addressparser free-text fallback allows remote denial of servicehigh · GHSA-v53p-9fqp-m79j
- Nodemailer Vulnerable to SMTP Command Injection via CRLF in Transport name Option (EHLO/HELO) moderate · GHSA-vvjj-xcjg-gr5g
- Nodemailer: IDN/Punycode domain allow-list bypass leads to email delivery to an attacker-controlled domainmoderate · GHSA-wmmp-3585-3rmp
- Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess during message normalizationmoderate · GHSA-wqvq-jvpq-h66f
- Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address listhigh · GHSA-2x7j-588g-ccc2
- 8.0.9
Two pending security advisories (jsonTransport access bypass, List-* CRLF injection)
- 8.0.5
Sanitize CRLF in transport name option to prevent SMTP command injection (GHSA-vvjj-xcjg-gr5g)
- 8.0.4
Sanitize envelope size to prevent SMTP command injection
Release by release
- fixed
addressparser: apply the unexpected "<" rule outside quotes and comments
- fixed
addressparser: bound group nesting at ten levels
- fixed
addressparser: drop the obsolete route from an angle-addr
- fixed
addressparser: end a comment only at the ")" that closes the outermost one
- fixed
- fixed
Format References and strip URLs in linear time, release any number of streams
- fixed
- fixed
Bound the work a message can make the mailer do and keep per-message auth off the transport's token endpoint
- fixed
- fixed
fetch: strip credentials on any cross-origin redirect
- fixed
- new
Harden message streams, SMTP connections and the connection pool
- new
Encode base64 and quoted-printable without per-chunk delays
- fixed
Do not read the environment or the interface table on import
- fixed
End the SMTP session on any 421 reply and drive the envelope through one step
- new
- fixed
addressparser: keep an escaped parenthesis inside a comment
- fixed
fetch: keep the case of cookie names
- fixed
fetch: read the cookie name-value pair by position
- fixed
- fixed
addressparser: keep a quoted display name that holds no "@" out of the address
- fixed
addressparser: keep the group recursion depth out of the options object
- fixed
addressparser: stop a "[" from hiding the operators after it
- fixed
dkim: trim a header field name in linear time
- fixed
mime-funcs: read and write header parameters per rfc2045 and rfc2231
- fixed
Search only the new bytes for the end of the proxy CONNECT response
- fixed
1 internal line (docs, tests, tooling) left out.