nodemailer
10.2.1 · 22 Oct 2026MIT-023.7M / weekRepositoryHomepagenpmAtom feed
Upgrading nodemailer from 8.0.4 to 8.0.11
7 releases in betweenevery note read
- 0
- changes to make
- 4
- advisories fixed
- 0
- new
- 13
- fixes
Security
15 advisories still affect 8.0.11
- Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signingmoderate · GHSA-39m8-27wv-hr27
- Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of servicemoderate · GHSA-4ffr-jq9g-5ffx
- Nodemailer: Quadratic (O(n^2)) SMTP client reply parsing lets a malicious server or MITM cause a pre-auth remote denial of servicemoderate · GHSA-4g23-2xm8-66gc
Upgrading to 10.1.4 clears them.
Fixes 4 advisories affecting 8.0.4
- Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message header injectionmoderate · GHSA-268h-hp4c-crq3
- Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interceptionhigh · GHSA-r7g4-qg5f-qqm2
- Nodemailer Vulnerable to SMTP Command Injection via CRLF in Transport name Option (EHLO/HELO) moderate · GHSA-vvjj-xcjg-gr5g
- Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess during message normalizationmoderate · GHSA-wqvq-jvpq-h66f
- 8.0.9
Two pending security advisories (jsonTransport access bypass, List-* CRLF injection)
- 8.0.5
Sanitize CRLF in transport name option to prevent SMTP command injection (GHSA-vvjj-xcjg-gr5g)
Release by release
- fixed
Apply the transport-level newline option in stream and sendmail transports
- fixed
Include icalEvent path/href content in the application/ics attachment
- fixed
Parse Ethereal response props without polynomial regex backtracking
- fixed
Resolve oauth2_provision_cb at send time for non-pooled SMTP transports
- fixed
Return the promise from every resolveContent branch
- fixed
Strip the url scheme from List-ID header values
- fixed
Tag AWS SES transport errors with the ESES code
- fixed
- fixed
Fall back to lower-severity handler when custom logger lacks a level method
- fixed
8.0.9nothing new or fixed in the note
- fixed
Enforce strict TLS for OAuth2 and Ethereal credential requests
- fixed
Four listener/stream leaks in SMTP transport, connection, pool
- fixed
- fixed
Keep domain as UTF-8 when local part is non-ASCII
- fixed
- fixed
Restore base64 wrap() trim behavior to prevent trailing CRLF
- fixed
- fixed
Decode SMTP server responses as UTF-8 at line boundary
- fixed