nodemailer 10.0.1 → 10.0.2

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # CHANGELOG
 
+## [10.0.2](https://github.com/nodemailer/nodemailer/compare/v10.0.1...v10.0.2) (2026-09-09)
+
+
+### Bug Fixes
+
+* **mime-node:** flatten nested recipient arrays without recursion ([ebe0849](https://github.com/nodemailer/nodemailer/commit/ebe084940aef88278afc6016b78c6d1c3821bb66))
+* **shared:** keep the TLS server name out of the DNS cache ([a6512db](https://github.com/nodemailer/nodemailer/commit/a6512dbcb3c6e7f2f70d3acccc5752defe3c61fe))
+
 ## [10.0.1](https://github.com/nodemailer/nodemailer/compare/v10.0.0...v10.0.1) (2026-09-07)
 
 

package/dist/cjs/mailer/index.js

@@ -172,12 +172,24 @@ class Mail extends node_events_1.EventEmitter {
                 }, 'PluginCompile Error: %s', err.message);
                 return done(err);
             }
-            mail.message = new index_js_1.default(mail.data).compile();
-            mail.setMailerHeader();
-            mail.setPriorityHeaders();
-            mail.setListHeaders();
+            let recipientCount;
+            try {
+                mail.message = new index_js_1.default(mail.data).compile();
+                mail.setMailerHeader();
+                mail.setPriorityHeaders();
+                mail.setListHeaders();
+                recipientCount = mail.message.getEnvelope().to.length;
+            }
+            catch (err) {
+                // message data can throw while it is compiled, the error belongs to the callback
+                this.logger.error({
+                    err,
+                    tnx: 'transport',
+                    action: 'send'
+                }, 'Compile Error: %s', err.message);
+                return done(err);
+            }
             const maxRecipients = mail.data.maxRecipients === undefined ? DEFAULT_MAX_RECIPIENTS : mail.data.maxRecipients;
-            const recipientCount = mail.message.getEnvelope().to.length;
             if (maxRecipients && recipientCount > maxRecipients) {
                 const err = new Error(`Message has ${recipientCount} recipients, which is over the ${maxRecipients} allowed by maxRecipients`);
                 err.code = errors.EMAXRECIPIENTS;

package/dist/cjs/mime-node/index.js

@@ -1042,17 +1042,38 @@ class MimeNode {
      * @internal
      */
     _parseAddresses(addresses) {
-        // Collected into one list as we go. concat.apply spreads the entries into arguments
-        // and throws a RangeError once a recipient array is long enough to pass the
-        // argument limit, which a large Bcc list reaches on its own.
         const flattened = [];
-        [].concat(addresses).forEach(address => {
+        // Nested arrays are flattened iteratively. concat.apply throws once a recipient list
+        // is long enough to pass the argument limit, and an array handed to addressparser is
+        // stringified, which recurses once per nesting level and exhausts the call stack on
+        // a deep enough value. Every array is walked once, which also ends a self-referential
+        // input
+        const seen = new WeakSet();
+        const stack = [];
+        const enter = (list) => {
+            if (!seen.has(list)) {
+                seen.add(list);
+                stack.push({ list, pos: 0 });
+            }
+        };
+        enter(Array.isArray(addresses) ? addresses : [addresses]);
+        while (stack.length) {
+            const frame = stack[stack.length - 1];
+            if (frame.pos >= frame.list.length) {
+                stack.pop();
+                continue;
+            }
+            const address = frame.list[frame.pos++];
+            if (Array.isArray(address)) {
+                enter(address);
+                continue;
+            }
             if (address && address.address) {
                 const normalized = this._normalizeAddress(address.address);
                 if (normalized === address.address && typeof address.name === 'string') {
                     // there is nothing to rewrite, so there is nothing to keep off the original
                     flattened.push(address);
-                    return;
+                    continue;
                 }
                 // rewriting would land on the object the caller passed in and might
                 // still hold a reference to, so rewrite a copy of it instead. An own
@@ -1062,13 +1083,13 @@ class MimeNode {
                 copy.address = normalized;
                 copy.name = address.name || '';
                 flattened.push(copy);
-                return;
+                continue;
             }
             const parsed = this._normalizeParsedAddresses((0, index_js_1.default)(address));
             for (let i = 0; i < parsed.length; i++) {
                 flattened.push(parsed[i]);
             }
-        });
+        }
         return flattened;
     }
     /**

package/dist/cjs/package-info.d.ts

@@ -1,3 +1,3 @@
 export declare const name = "nodemailer";
-export declare const version = "10.0.1";
+export declare const version = "10.0.2";
 export declare const homepage = "https://nodemailer.com/";

package/dist/cjs/package-info.js

@@ -3,5 +3,5 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.homepage = exports.version = exports.name = void 0;
 exports.name = 'nodemailer';
-exports.version = '10.0.1';
+exports.version = '10.0.2';
 exports.homepage = 'https://nodemailer.com/';

package/dist/cjs/shared/index.d.ts

@@ -39,7 +39,6 @@ export interface ResolvedHostname {
  */
 export interface DnsCacheValue {
     addresses: string[];
-    servername: string | false;
 }
 /**
  * A DNS cache entry

package/dist/cjs/shared/index.js

@@ -109,7 +109,6 @@ const formatDNSValue = (value, extra) => {
     // Select a random address from available addresses, or null if none
     const host = addresses.length > 0 ? addresses[Math.floor(Math.random() * addresses.length)] : null;
     return Object.assign({
-        servername: value.servername,
         host,
         // Include all addresses for connection fallback support
         _addresses: addresses
@@ -123,14 +122,19 @@ const resolveHostname = (options, callback) => {
     if (!options.host || node_net_1.default.isIP(options.host)) {
         // nothing to do here
         const value = {
-            addresses: [options.host],
-            servername: options.servername || false
+            addresses: [options.host]
         };
         return callback(null, formatDNSValue(value, {
+            servername: options.servername || false,
             cached: false
         }));
     }
     const host = options.host;
+    // The TLS server name belongs to the connection asking, not to the host it resolves. The
+    // cache is shared by every transport of the process and keyed by host alone, so a server
+    // name stored in it would be the one of whichever transport resolved the host first, and a
+    // later transport with its own tls.servername would present and verify that name instead
+    const servername = options.servername || host;
     let cached;
     if (exports.dnsCache.has(options.host)) {
         cached = exports.dnsCache.get(options.host);
@@ -153,6 +157,7 @@ const resolveHostname = (options, callback) => {
         }
         if (!cached.expires || cached.expires >= now) {
             return callback(null, formatDNSValue(cached.value, {
+                servername,
                 cached: true
             }));
         }
@@ -180,14 +185,14 @@ const resolveHostname = (options, callback) => {
             const allAddresses = ipv4Addresses.concat(ipv6Addresses);
             if (allAddresses.length) {
                 const value = {
-                    addresses: allAddresses,
-                    servername: options.servername || host
+                    addresses: allAddresses
                 };
                 exports.dnsCache.set(host, {
                     value,
                     expires: Date.now() + (options.dnsTtl || DNS_TTL)
                 });
                 return callback(null, formatDNSValue(value, {
+                    servername,
                     cached: false
                 }));
             }
@@ -200,6 +205,7 @@ const resolveHostname = (options, callback) => {
                         expires: Date.now() + (options.dnsTtl || DNS_TTL)
                     });
                     return callback(null, formatDNSValue(cached.value, {
+                        servername,
                         cached: true,
                         error: ipv4Error
                     }));
@@ -214,6 +220,7 @@ const resolveHostname = (options, callback) => {
                                 expires: Date.now() + (options.dnsTtl || DNS_TTL)
                             });
                             return callback(null, formatDNSValue(cached.value, {
+                                servername,
                                 cached: true,
                                 error: err
                             }));
@@ -231,18 +238,19 @@ const resolveHostname = (options, callback) => {
                     if (!supportedAddresses.length && cached) {
                         // nothing was found, fallback to cached value
                         return callback(null, formatDNSValue(cached.value, {
+                            servername,
                             cached: true
                         }));
                     }
                     const value = {
-                        addresses: supportedAddresses.length ? supportedAddresses : [host],
-                        servername: options.servername || host
+                        addresses: supportedAddresses.length ? supportedAddresses : [host]
                     };
                     exports.dnsCache.set(host, {
                         value,
                         expires: Date.now() + (options.dnsTtl || DNS_TTL)
                     });
                     return callback(null, formatDNSValue(value, {
+                        servername,
                         cached: false
                     }));
                 });
@@ -254,6 +262,7 @@ const resolveHostname = (options, callback) => {
                         expires: Date.now() + (options.dnsTtl || DNS_TTL)
                     });
                     return callback(null, formatDNSValue(cached.value, {
+                        servername,
                         cached: true,
                         error: lookupErr
                     }));

package/dist/esm/mailer/index.js

@@ -134,12 +134,24 @@ class Mail extends EventEmitter {
                 }, 'PluginCompile Error: %s', err.message);
                 return done(err);
             }
-            mail.message = new MailComposer(mail.data).compile();
-            mail.setMailerHeader();
-            mail.setPriorityHeaders();
-            mail.setListHeaders();
+            let recipientCount;
+            try {
+                mail.message = new MailComposer(mail.data).compile();
+                mail.setMailerHeader();
+                mail.setPriorityHeaders();
+                mail.setListHeaders();
+                recipientCount = mail.message.getEnvelope().to.length;
+            }
+            catch (err) {
+                // message data can throw while it is compiled, the error belongs to the callback
+                this.logger.error({
+                    err,
+                    tnx: 'transport',
+                    action: 'send'
+                }, 'Compile Error: %s', err.message);
+                return done(err);
+            }
             const maxRecipients = mail.data.maxRecipients === undefined ? DEFAULT_MAX_RECIPIENTS : mail.data.maxRecipients;
-            const recipientCount = mail.message.getEnvelope().to.length;
             if (maxRecipients && recipientCount > maxRecipients) {
                 const err = new Error(`Message has ${recipientCount} recipients, which is over the ${maxRecipients} allowed by maxRecipients`);
                 err.code = errors.EMAXRECIPIENTS;

package/dist/esm/mime-node/index.js

@@ -1004,17 +1004,38 @@ class MimeNode {
      * @internal
      */
     _parseAddresses(addresses) {
-        // Collected into one list as we go. concat.apply spreads the entries into arguments
-        // and throws a RangeError once a recipient array is long enough to pass the
-        // argument limit, which a large Bcc list reaches on its own.
         const flattened = [];
-        [].concat(addresses).forEach(address => {
+        // Nested arrays are flattened iteratively. concat.apply throws once a recipient list
+        // is long enough to pass the argument limit, and an array handed to addressparser is
+        // stringified, which recurses once per nesting level and exhausts the call stack on
+        // a deep enough value. Every array is walked once, which also ends a self-referential
+        // input
+        const seen = new WeakSet();
+        const stack = [];
+        const enter = (list) => {
+            if (!seen.has(list)) {
+                seen.add(list);
+                stack.push({ list, pos: 0 });
+            }
+        };
+        enter(Array.isArray(addresses) ? addresses : [addresses]);
+        while (stack.length) {
+            const frame = stack[stack.length - 1];
+            if (frame.pos >= frame.list.length) {
+                stack.pop();
+                continue;
+            }
+            const address = frame.list[frame.pos++];
+            if (Array.isArray(address)) {
+                enter(address);
+                continue;
+            }
             if (address && address.address) {
                 const normalized = this._normalizeAddress(address.address);
                 if (normalized === address.address && typeof address.name === 'string') {
                     // there is nothing to rewrite, so there is nothing to keep off the original
                     flattened.push(address);
-                    return;
+                    continue;
                 }
                 // rewriting would land on the object the caller passed in and might
                 // still hold a reference to, so rewrite a copy of it instead. An own
@@ -1024,13 +1045,13 @@ class MimeNode {
                 copy.address = normalized;
                 copy.name = address.name || '';
                 flattened.push(copy);
-                return;
+                continue;
             }
             const parsed = this._normalizeParsedAddresses(addressparser(address));
             for (let i = 0; i < parsed.length; i++) {
                 flattened.push(parsed[i]);
             }
-        });
+        }
         return flattened;
     }
     /**

package/dist/esm/package-info.d.ts

@@ -1,3 +1,3 @@
 export declare const name = "nodemailer";
-export declare const version = "10.0.1";
+export declare const version = "10.0.2";
 export declare const homepage = "https://nodemailer.com/";

package/dist/esm/package-info.js

@@ -1,4 +1,4 @@
 // Generated by scripts/build.js from package.json. Do not edit by hand.
 export const name = 'nodemailer';
-export const version = '10.0.1';
+export const version = '10.0.2';
 export const homepage = 'https://nodemailer.com/';

package/dist/esm/shared/index.d.ts

@@ -39,7 +39,6 @@ export interface ResolvedHostname {
  */
 export interface DnsCacheValue {
     addresses: string[];
-    servername: string | false;
 }
 /**
  * A DNS cache entry

package/dist/esm/shared/index.js

@@ -68,7 +68,6 @@ const formatDNSValue = (value, extra) => {
     // Select a random address from available addresses, or null if none
     const host = addresses.length > 0 ? addresses[Math.floor(Math.random() * addresses.length)] : null;
     return Object.assign({
-        servername: value.servername,
         host,
         // Include all addresses for connection fallback support
         _addresses: addresses
@@ -82,14 +81,19 @@ export const resolveHostname = (options, callback) => {
     if (!options.host || net.isIP(options.host)) {
         // nothing to do here
         const value = {
-            addresses: [options.host],
-            servername: options.servername || false
+            addresses: [options.host]
         };
         return callback(null, formatDNSValue(value, {
+            servername: options.servername || false,
             cached: false
         }));
     }
     const host = options.host;
+    // The TLS server name belongs to the connection asking, not to the host it resolves. The
+    // cache is shared by every transport of the process and keyed by host alone, so a server
+    // name stored in it would be the one of whichever transport resolved the host first, and a
+    // later transport with its own tls.servername would present and verify that name instead
+    const servername = options.servername || host;
     let cached;
     if (dnsCache.has(options.host)) {
         cached = dnsCache.get(options.host);
@@ -112,6 +116,7 @@ export const resolveHostname = (options, callback) => {
         }
         if (!cached.expires || cached.expires >= now) {
             return callback(null, formatDNSValue(cached.value, {
+                servername,
                 cached: true
             }));
         }
@@ -139,14 +144,14 @@ export const resolveHostname = (options, callback) => {
             const allAddresses = ipv4Addresses.concat(ipv6Addresses);
             if (allAddresses.length) {
                 const value = {
-                    addresses: allAddresses,
-                    servername: options.servername || host
+                    addresses: allAddresses
                 };
                 dnsCache.set(host, {
                     value,
                     expires: Date.now() + (options.dnsTtl || DNS_TTL)
                 });
                 return callback(null, formatDNSValue(value, {
+                    servername,
                     cached: false
                 }));
             }
@@ -159,6 +164,7 @@ export const resolveHostname = (options, callback) => {
                         expires: Date.now() + (options.dnsTtl || DNS_TTL)
                     });
                     return callback(null, formatDNSValue(cached.value, {
+                        servername,
                         cached: true,
                         error: ipv4Error
                     }));
@@ -173,6 +179,7 @@ export const resolveHostname = (options, callback) => {
                                 expires: Date.now() + (options.dnsTtl || DNS_TTL)
                             });
                             return callback(null, formatDNSValue(cached.value, {
+                                servername,
                                 cached: true,
                                 error: err
                             }));
@@ -190,18 +197,19 @@ export const resolveHostname = (options, callback) => {
                     if (!supportedAddresses.length && cached) {
                         // nothing was found, fallback to cached value
                         return callback(null, formatDNSValue(cached.value, {
+                            servername,
                             cached: true
                         }));
                     }
                     const value = {
-                        addresses: supportedAddresses.length ? supportedAddresses : [host],
-                        servername: options.servername || host
+                        addresses: supportedAddresses.length ? supportedAddresses : [host]
                     };
                     dnsCache.set(host, {
                         value,
                         expires: Date.now() + (options.dnsTtl || DNS_TTL)
                     });
                     return callback(null, formatDNSValue(value, {
+                        servername,
                         cached: false
                     }));
                 });
@@ -213,6 +221,7 @@ export const resolveHostname = (options, callback) => {
                         expires: Date.now() + (options.dnsTtl || DNS_TTL)
                     });
                     return callback(null, formatDNSValue(cached.value, {
+                        servername,
                         cached: true,
                         error: lookupErr
                     }));

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "nodemailer",
-    "version": "10.0.1",
+    "version": "10.0.2",
     "description": "Easy as cake e-mail sending from your Node.js applications",
     "type": "module",
     "main": "./dist/cjs/nodemailer.js",