nodemailer
10.2.1 · 22 Oct 2026MIT-023.7M / weekRepositoryHomepagenpmAtom feed
Upgrading nodemailer from 8.0.9 to 8.0.11
2 releases in betweenevery note read
- 0
- changes to make
- 0
- advisories fixed
- 0
- new
- 8
- fixes
Security
15 advisories still affect 8.0.11
- Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signingmoderate · GHSA-39m8-27wv-hr27
- Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of servicemoderate · GHSA-4ffr-jq9g-5ffx
- Nodemailer: Quadratic (O(n^2)) SMTP client reply parsing lets a malicious server or MITM cause a pre-auth remote denial of servicemoderate · GHSA-4g23-2xm8-66gc
Upgrading to 10.1.4 clears them.
Release by release
- fixed
Apply the transport-level newline option in stream and sendmail transports
- fixed
Include icalEvent path/href content in the application/ics attachment
- fixed
Parse Ethereal response props without polynomial regex backtracking
- fixed
Resolve oauth2_provision_cb at send time for non-pooled SMTP transports
- fixed
Return the promise from every resolveContent branch
- fixed
Strip the url scheme from List-ID header values
- fixed
Tag AWS SES transport errors with the ESES code
- fixed
- fixed
Fall back to lower-severity handler when custom logger lacks a level method
- fixed