nodemailer 10.0.16 → 10.1.1

package/CHANGELOG.md

@@ -1,5 +1,39 @@
 # CHANGELOG
 
+## [10.1.1](https://github.com/nodemailer/nodemailer/compare/v10.1.0...v10.1.1) (2026-10-14)
+
+
+### Bug Fixes
+
+* **fetch:** strip credentials on any cross-origin redirect ([a15360c](https://github.com/nodemailer/nodemailer/commit/a15360cd2cd12e4670e96ab0b7290e8c862391cf))
+
+## [10.1.0](https://github.com/nodemailer/nodemailer/compare/v10.0.16...v10.1.0) (2026-10-10)
+
+
+### Features
+
+* harden message streams, SMTP connections and the connection pool ([8009da6](https://github.com/nodemailer/nodemailer/commit/8009da6e10bb8e10d7f0948a25d65895fdcd64f1))
+
+
+### Bug Fixes
+
+* do not read the environment or the interface table on import ([094179d](https://github.com/nodemailer/nodemailer/commit/094179d176d2ebe7a28742411ad427d3c87a3981))
+* end the SMTP session on any 421 reply and drive the envelope through one step ([5638ac1](https://github.com/nodemailer/nodemailer/commit/5638ac1914342460df270f736e7ceb0a844cf83a))
+* keep ERR_ACCESS_DENIED from the Node.js permission model ([8b33a3d](https://github.com/nodemailer/nodemailer/commit/8b33a3d4fedee3431b97da7da12af954c3c8dceb))
+* let the proxy handshake and the SMTP connection share one deadline ([91ed683](https://github.com/nodemailer/nodemailer/commit/91ed683f7a1e9ff8c56e24fb76facf16af08b162))
+* **mime-node:** decode an SMTPUTF8 domain from its A-label form ([e436f4d](https://github.com/nodemailer/nodemailer/commit/e436f4dccbc8b0fb57b4747ebaafa5bb035c15cb))
+* **mime-node:** finish an encoded part only after its output was read ([ec97d8f](https://github.com/nodemailer/nodemailer/commit/ec97d8f679a1d9d47bbebb03ea064f5fa6f58d01))
+* **qp:** encode a lone CR or LF in binary quoted-printable parts ([42b91d9](https://github.com/nodemailer/nodemailer/commit/42b91d9a0fe18eea412c9774c5c142adf5b3efc7))
+* **smtp-connection:** count the wait for the greeting against connectionTimeout ([bdcd046](https://github.com/nodemailer/nodemailer/commit/bdcd0462cab163eca3c34058d09b9981ab671c47))
+* **smtp-connection:** drop the connection when DATA is taken after a refused sender ([f90fb04](https://github.com/nodemailer/nodemailer/commit/f90fb045bc24f96a128710791b2fa443e64f55fd))
+* **smtp-connection:** refuse a second connect() call ([24ba2e0](https://github.com/nodemailer/nodemailer/commit/24ba2e0847ecb8202540f1c5e53483bd119ae4f2))
+* turn Nagle off for SMTP sockets and report an early sendmail exit as such ([fa9b8d3](https://github.com/nodemailer/nodemailer/commit/fa9b8d300bf642cd9e11f6732ebb312c09868677))
+
+
+### Performance Improvements
+
+* encode base64 and quoted-printable without per-chunk delays ([fd377bb](https://github.com/nodemailer/nodemailer/commit/fd377bbf559363860aedbedba6f107348fc152d2))
+
 ## [10.0.16](https://github.com/nodemailer/nodemailer/compare/v10.0.15...v10.0.16) (2026-10-07)
 
 

package/SECURITY.md

@@ -1,7 +1,9 @@
 # Security Policy
 
-Nodemailer is a widely deployed, zero-dependency e-mail library. We take security
-reports seriously and aim to respond quickly.
+Nodemailer is a widely deployed, zero-dependency email library. We welcome
+responsible reports of vulnerabilities that present a credible security risk to
+users. Please distinguish security vulnerabilities from ordinary bugs, unusual
+edge cases, and hardening suggestions.
 
 ## Supported Versions
 
@@ -17,45 +19,119 @@ the supported way to receive security updates.
 If you are on an older major, please upgrade. See the migration notes at
 <https://nodemailer.com/> before updating.
 
-## Reporting a Vulnerability
+## What Qualifies as a Security Vulnerability
 
-**Please do not report security vulnerabilities through public GitHub issues,
-pull requests, or discussions.**
+A security report should identify a realistic way for an attacker to cross a
+security boundary in a supported version of Nodemailer. Unexpected behavior,
+a failing test, or a technically correct proof of concept is not sufficient on
+its own to establish security impact.
 
-Report privately through one of the following channels:
+In particular, explain:
 
-1. **GitHub Security Advisories (preferred).** Open a private report at
-   <https://github.com/nodemailer/nodemailer/security/advisories/new>. This keeps
-   the discussion private until a fix is published and lets us credit you.
-2. **Email.** Send details to **andris@reinman.eu** (the contact listed in
-   [`SECURITY.txt`](SECURITY.txt)). Encrypt sensitive details if possible.
+- **Attacker capabilities:** Who is the attacker, and what inputs, systems, or
+  responses can they control _without_ already having the privileges or secrets
+  they are trying to gain?
+- **Attack path:** How does attacker-controlled input reach the affected code
+  through a supported Nodemailer API or a realistic application integration?
+- **Prerequisites:** What configuration and user actions are required? If the
+  attack depends on unusual options or deliberately malformed input, explain
+  why those conditions could arise in a real application.
+- **Impact:** What confidentiality, integrity, or availability boundary is
+  crossed, and what can the attacker achieve as a result?
 
-When reporting, please include as much of the following as you can:
+A vulnerability involving an optional or less common feature can still qualify
+if these conditions are met. Conversely, the existence of a defensive check in
+the code does not, by itself, establish that every bypass of that check has a
+realistic security impact.
 
-- The affected version(s) and environment (Node.js version, OS).
-- The component involved (e.g. SMTP connection, address parsing, MIME/header
-  generation, DKIM).
-- A clear description of the issue and its impact (e.g. header/SMTP command
-  injection, information disclosure, DoS).
-- A minimal proof of concept or reproduction steps.
-- Any suggested remediation, if you have one.
+## Reporting a Vulnerability
 
-Nodemailer is maintained by a single person, so there is no guaranteed response
-time: sometimes reports are handled within hours, sometimes they take longer.
-Accepted issues are fixed in a new release and coordinated through a GitHub
-Security Advisory, and reporters who wish to be named are credited.
+**Do not disclose suspected exploitable vulnerabilities through public GitHub
+issues, pull requests, or discussions before coordinating with the maintainer.**
 
-## CVEs
+Report privately through one of the following channels:
 
-We track and disclose vulnerabilities through GitHub Security Advisories. We do
-not request or manage CVE identifiers ourselves. If you need a CVE assigned for a
-reported issue, please request one yourself, for example through GitHub's own
-CVE request flow on the published advisory, or another CNA.
+1. **GitHub Security Advisories (preferred):**
+   <https://github.com/nodemailer/nodemailer/security/advisories/new>.
+2. **Email:** **andris@reinman.eu**, as listed in
+   [`SECURITY.txt`](SECURITY.txt). Encrypt sensitive details if possible.
+
+### Required Information
+
+Please provide enough information to evaluate both the defect and its security
+impact. Reports should include:
+
+1. The affected Nodemailer version or commit, Node.js version, and relevant
+   configuration.
+2. A concise description of the issue and the affected public API or code path.
+3. A minimal, tested reproduction, including steps to run it, expected behavior,
+   and observed behavior.
+4. A concrete threat model: attacker control, prerequisites, trust boundary, and
+   resulting impact. Clearly distinguish what your reproduction proves from what
+   you believe might be possible.
+5. An explanation of why the issue affects applications beyond a deliberately
+   constructed test setup, where this is not obvious.
+
+A suggested fix is welcome but does not replace an explanation of exploitability.
+A complete real-world exploit is not always necessary, but the report must make
+a credible security impact clear.
+
+### Reports That May Be Treated as Ordinary Bugs
+
+The following generally do **not** qualify for private security handling unless
+you can demonstrate an additional, meaningful security boundary crossing:
+
+- Issues that require the attacker to control trusted application code,
+  administrator-only configuration, or the secret they supposedly extract.
+- Problems caused solely by application-level misuse, exposed credentials, or
+  insecure deployment choices outside Nodemailer's control.
+- Contrived proof-of-concept setups where the tester controls both sides of a
+  request, without explaining how a separate attacker could trigger the issue.
+- Parser quirks, unexpected behavior, and bypasses of internal checks with no
+  demonstrated security impact.
+- Speculative findings based only on static analysis or an automated tool's
+  assessment, without a verified reproduction and credible attack scenario.
+
+These may still be valid bugs and may be considered through the normal issue
+tracker. Please coordinate before making any potentially exploitable details
+public. Classification as a bug does not guarantee a fix or a particular
+priority.
+
+### Automated and AI-Assisted Reports
+
+Automated analysis and AI tools are welcome as research aids, but the person
+submitting a report is responsible for verifying its claims. **Do not submit
+bulk, unverified, or speculative AI-generated findings.** Test each finding
+against a supported release and establish the actual security impact. Reports
+that do not meet the requirements above may be closed without further
+investigation or individual feedback; they can be resubmitted with stronger
+evidence.
+
+## Triage and Disclosure
+
+Nodemailer is maintained by a single person, and there is **no guaranteed
+response or resolution time**. Reports are prioritized based on demonstrated
+impact, exploitability, affected usage, and available maintenance resources.
+
+A private report does not automatically become a security advisory. Confirmed
+vulnerabilities may be fixed and disclosed through GitHub Security Advisories;
+other findings may be closed, deferred, or handled as ordinary bugs. Please do
+not disclose details of an unresolved, potentially exploitable issue publicly
+without coordinating with the maintainer.
+
+## CVEs and Credit
+
+We do not request or manage CVE identifiers. A report being acknowledged, a bug
+being fixed, or a pull request being merged does **not** mean that Nodemailer
+has confirmed a security vulnerability or endorsed a CVE assignment. We do not
+guarantee advisories, CVE identifiers, or public credit for reports. For
+confirmed vulnerabilities disclosed through an advisory, substantive reporters
+may be credited if they wish.
 
 ## Scope
 
 In scope: the `nodemailer` package source in this repository: message and MIME
-generation, SMTP/LMTP client behaviour, address parsing, header handling, DKIM
+generation, SMTP/LMTP client behavior, address parsing, header handling, DKIM
 signing, and the bundled transports.
 
 Out of scope: vulnerabilities in your own application code, misconfiguration of

package/dist/cjs/base64/index.d.ts

@@ -24,6 +24,9 @@ export interface EncoderOptions {
 /**
  * Creates a transform stream for encoding data to base64 encoding
  *
+ * The output is the same as `wrap(encode(input), lineLength)` no matter how the input is split
+ * into chunks: every line but the last one ends with a line break, the last one does not
+ *
  * @constructor
  * @param options Stream options
  * @param [options.lineLength=76] Maximum length for lines, set to false to disable wrapping

package/dist/cjs/base64/index.js

@@ -16,6 +16,47 @@ function encode(buffer) {
     }
     return buffer.toString('base64');
 }
+/**
+ * Turns a line length option into a whole number of characters, the default for anything unusable
+ */
+function normalizeLineLength(lineLength) {
+    const length = Math.floor(Number(lineLength));
+    return Number.isFinite(length) && length >= 1 ? length : 76;
+}
+/**
+ * Splits the bytes of `src` into lines of `lineLength` bytes, each followed by a line break. With
+ * `final` set the last line, which may be shorter, gets no line break; otherwise only complete
+ * lines are taken and the rest is left for the caller
+ *
+ * @param src Bytes to wrap
+ * @param lineLength Line length
+ * @param final Whether `src` ends the output
+ * @returns The wrapped bytes and the number of trailing bytes not taken
+ */
+function wrapBuffer(src, lineLength, final) {
+    const lines = Math.ceil(src.length / lineLength);
+    // the last line waits for more data unless this is the end: whether it gets a line break
+    // depends on whether anything follows it
+    const complete = Math.max(lines - 1, 0);
+    let rest = src.length - complete * lineLength;
+    const output = Buffer.allocUnsafe(complete * (lineLength + 2) + (final ? rest : 0));
+    let to = 0;
+    for (let from = 0; from < complete * lineLength; from += lineLength) {
+        src.copy(output, to, from, from + lineLength);
+        to += lineLength;
+        output[to++] = 0x0d;
+        output[to++] = 0x0a;
+    }
+    if (final) {
+        to += src.copy(output, to, complete * lineLength);
+        rest = 0;
+    }
+    if (to !== output.length) {
+        // never hand out bytes of the unfilled allocation
+        throw new Error('Unexpected wrapped length');
+    }
+    return { output, rest };
+}
 /**
  * Adds soft line breaks to a base64 string
  *
@@ -44,6 +85,9 @@ function wrap(str, lineLength) {
 /**
  * Creates a transform stream for encoding data to base64 encoding
  *
+ * The output is the same as `wrap(encode(input), lineLength)` no matter how the input is split
+ * into chunks: every line but the last one ends with a line break, the last one does not
+ *
  * @constructor
  * @param options Stream options
  * @param [options.lineLength=76] Maximum length for lines, set to false to disable wrapping
@@ -53,66 +97,61 @@ class Encoder extends node_stream_1.Transform {
         super();
         this.options = options || {};
         if (this.options.lineLength !== false) {
-            this.options.lineLength = this.options.lineLength || 76;
+            this.options.lineLength = normalizeLineLength(this.options.lineLength);
         }
         this._curLine = '';
         this._remainingBytes = false;
         this.inputBytes = 0;
         this.outputBytes = 0;
     }
+    /**
+     * Emits the encoded characters `b64` that follow the current line, keeping what can not be
+     * emitted yet as the new current line
+     *
+     * @internal
+     */
+    _emit(b64, final) {
+        const src = Buffer.from(this._curLine + b64, 'latin1');
+        if (!src.length) {
+            return;
+        }
+        let output = src;
+        if (this.options.lineLength) {
+            const wrapped = wrapBuffer(src, this.options.lineLength, final);
+            output = wrapped.output;
+            this._curLine = wrapped.rest ? src.toString('latin1', src.length - wrapped.rest) : '';
+        }
+        else {
+            this._curLine = '';
+        }
+        if (output.length) {
+            this.outputBytes += output.length;
+            this.push(output);
+        }
+    }
     /** @internal */
     _transform(chunk, encoding, done) {
         let buf = encoding !== 'buffer' ? Buffer.from(chunk, encoding) : chunk;
         if (!buf || !buf.length) {
-            setImmediate(done);
-            return;
+            return done();
         }
         this.inputBytes += buf.length;
-        if (this._remainingBytes && this._remainingBytes.length) {
+        if (this._remainingBytes) {
             buf = Buffer.concat([this._remainingBytes, buf], this._remainingBytes.length + buf.length);
             this._remainingBytes = false;
         }
-        if (buf.length % 3) {
-            this._remainingBytes = buf.slice(buf.length - (buf.length % 3));
-            buf = buf.slice(0, buf.length - (buf.length % 3));
-        }
-        else {
-            this._remainingBytes = false;
-        }
-        let b64 = this._curLine + encode(buf);
-        if (this.options.lineLength) {
-            b64 = wrap(b64, this.options.lineLength);
-            // remove last line as it is still most probably incomplete
-            const lastLF = b64.lastIndexOf('\n');
-            if (lastLF < 0) {
-                this._curLine = b64;
-                b64 = '';
-            }
-            else if (lastLF === b64.length - 1) {
-                this._curLine = '';
-            }
-            else {
-                this._curLine = b64.substring(lastLF + 1);
-                b64 = b64.substring(0, lastLF + 1);
-            }
-        }
-        if (b64) {
-            this.outputBytes += b64.length;
-            this.push(Buffer.from(b64, 'ascii'));
+        const extra = buf.length % 3;
+        if (extra) {
+            this._remainingBytes = buf.subarray(buf.length - extra);
+            buf = buf.subarray(0, buf.length - extra);
         }
-        setImmediate(done);
+        this._emit(encode(buf), false);
+        done();
     }
     /** @internal */
     _flush(done) {
-        if (this._remainingBytes && this._remainingBytes.length) {
-            this._curLine += encode(this._remainingBytes);
-        }
-        if (this._curLine) {
-            this._curLine = wrap(this._curLine, this.options.lineLength);
-            this.outputBytes += this._curLine.length;
-            this.push(Buffer.from(this._curLine, 'ascii'));
-            this._curLine = '';
-        }
+        this._emit(this._remainingBytes ? encode(this._remainingBytes) : '', true);
+        this._remainingBytes = false;
         done();
     }
 }

package/dist/cjs/dkim/index.js

@@ -37,51 +37,67 @@ class DKIMSigner {
         this.output = output;
         this.output.usingCache = false;
         this.hasErrored = false;
-        this.input.on('error', err => {
+        this.input.on('error', err => this.fail(err));
+        // A consumer that goes away before the signed message was read in full destroys the
+        // output. Stop reading the input and drop the cache file instead of leaving them open
+        this.output.once('close', () => {
+            if (this.output.writableFinished) {
+                return;
+            }
             this.hasErrored = true;
+            this.input.unpipe();
+            this.input.destroy();
             this.cleanup();
-            output.emit('error', err);
         });
     }
+    /**
+     * Ends the output with an error and releases the cache file
+     */
+    fail(err) {
+        this.hasErrored = true;
+        this.cleanup();
+        this.output.destroy(err);
+    }
     cleanup() {
         if (!this.cache || !this.cachePath) {
             return;
         }
+        const cache = this.cache;
+        this.cache = false;
+        cache.destroy();
         node_fs_1.default.unlink(this.cachePath, () => false);
     }
     createReadCache() {
         // pipe remainings to cache file
         this.cache = node_fs_1.default.createReadStream(this.cachePath);
-        this.cache.once('error', err => {
-            this.cleanup();
-            this.output.emit('error', err);
-        });
+        this.cache.once('error', err => this.fail(err));
         this.cache.once('close', () => {
             this.cleanup();
         });
         this.cache.pipe(this.output);
     }
     sendNextChunk() {
-        if (this.hasErrored) {
-            return;
-        }
-        if (this.readPos >= this.chunks.length) {
-            if (!this.cache) {
-                this.output.end();
+        while (!this.hasErrored) {
+            if (this.readPos >= this.chunks.length) {
+                if (!this.cache) {
+                    this.output.end();
+                    return;
+                }
+                return this.createReadCache();
+            }
+            const chunk = this.chunks[this.readPos++];
+            if (this.output.write(chunk) === false) {
+                this.output.once('drain', () => {
+                    this.sendNextChunk();
+                });
                 return;
             }
-            return this.createReadCache();
-        }
-        const chunk = this.chunks[this.readPos++];
-        if (this.output.write(chunk) === false) {
-            this.output.once('drain', () => {
-                this.sendNextChunk();
-            });
-            return;
         }
-        setImmediate(() => this.sendNextChunk());
     }
     sendSignedOutput() {
+        if (this.hasErrored) {
+            return;
+        }
         let keyPos = 0;
         const signNextKey = () => {
             if (keyPos >= this.keys.length) {
@@ -101,9 +117,7 @@ class DKIMSigner {
                 });
             }
             catch (err) {
-                this.hasErrored = true;
-                this.cleanup();
-                this.output.emit('error', err);
+                this.fail(err);
                 return;
             }
             if (dkimField) {
@@ -122,7 +136,6 @@ class DKIMSigner {
         // pipe remainings to cache file
         this.cache = node_fs_1.default.createWriteStream(this.cachePath);
         this.cache.once('error', err => {
-            this.cleanup();
             // drain input
             this.relaxedBody.unpipe(this.cache);
             this.relaxedBody.on('readable', () => {
@@ -130,11 +143,12 @@ class DKIMSigner {
                     // do nothing
                 }
             });
-            this.hasErrored = true;
-            // emit error
-            this.output.emit('error', err);
+            this.fail(err);
         });
         this.cache.once('close', () => {
+            if (this.hasErrored) {
+                return;
+            }
             this.sendSignedOutput();
         });
         this.relaxedBody.removeAllListeners('readable');
@@ -211,7 +225,7 @@ class DKIM {
             catch (_E) {
                 // the body hash is created here, an unknown hashAlgo throws inside this timer
                 // where nothing else could catch it
-                output.emit('error', sign_js_1.default.unsupportedHashAlgoError(signer.hashAlgo));
+                signer.fail(sign_js_1.default.unsupportedHashAlgoError(signer.hashAlgo));
                 return;
             }
             if (writeValue) {

package/dist/cjs/dkim/message-parser.js

@@ -107,7 +107,7 @@ class MessageParser extends node_stream_1.Transform {
                 const chunk = data.slice(headerPos);
                 this.bodySize += chunk.length;
                 // this would be the first chunk of data sent downstream
-                setImmediate(() => this.push(chunk));
+                this.push(chunk);
             }
             return false;
         }
@@ -136,7 +136,7 @@ class MessageParser extends node_stream_1.Transform {
             this.bodySize += chunk.length;
             this.push(chunk);
         }
-        setImmediate(callback);
+        callback();
     }
     /** @internal */
     _flush(callback) {

package/dist/cjs/errors.d.ts

@@ -61,6 +61,19 @@ export declare const EPROXY = "EPROXY";
 export declare const EFILEACCESS = "EFILEACCESS";
 export declare const EURLACCESS = "EURLACCESS";
 export declare const EFETCH = "EFETCH";
+/**
+ * Tells whether the error ended the connection rather than rejected what was sent over it
+ */
+export declare const isTransientError: (err: {
+    code?: string | undefined;
+    responseCode?: number | undefined;
+}) => boolean;
+/**
+ * Code Node.js sets on an error when its permission model (`--permission`) denies an
+ * operation. It is not replaced with the Nodemailer code of the failing step (`ESOCKET`,
+ * `EDNS`, `EFETCH`, ...), so a missing grant such as `--allow-net` stays recognizable.
+ */
+export declare const ERR_ACCESS_DENIED = "ERR_ACCESS_DENIED";
 /**
  * An Error together with the properties Nodemailer attaches to the errors it
  * hands to callers. Every property is optional, the set that is present
@@ -84,6 +97,10 @@ export interface NodemailerError extends NodeJS.ErrnoException {
     rejected?: string[] | undefined;
     /** Per-recipient errors for the rejected addresses */
     rejectedErrors?: NodemailerError[] | undefined;
+    /** The code the error had before Nodemailer set its own, such as ECONNREFUSED for an ESOCKET error */
+    originalCode?: string | undefined;
+    /** Which wait an ETIMEDOUT error ended: connecting, the greeting, a TLS upgrade or an idle socket */
+    timeoutType?: 'CONNECT_TIMEOUT' | 'GREETING_TIMEOUT' | 'UPGRADE_TIMEOUT' | 'SOCKET_TIMEOUT' | undefined;
 }
 /**
  * Node style callback: called with an error, or with null and the result

package/dist/cjs/errors.js

@@ -10,7 +10,7 @@
  *   err.code = errors.ECONNECTION;
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.EFETCH = exports.EURLACCESS = exports.EFILEACCESS = exports.EPROXY = exports.ECONFIG = exports.ESES = exports.ESENDMAIL = exports.EMAXRECIPIENTS = exports.EMAXLIMIT = exports.EOAUTH2 = exports.ENOAUTH = exports.EAUTH = exports.ESTREAM = exports.EMESSAGE = exports.EENVELOPE = exports.EPROTOCOL = exports.EREQUIRETLS = exports.ETLS = exports.EDNS = exports.ESOCKET = exports.ETIMEDOUT = exports.ECONNECTION = exports.ERROR_CODES = void 0;
+exports.ERR_ACCESS_DENIED = exports.isTransientError = exports.EFETCH = exports.EURLACCESS = exports.EFILEACCESS = exports.EPROXY = exports.ECONFIG = exports.ESES = exports.ESENDMAIL = exports.EMAXRECIPIENTS = exports.EMAXLIMIT = exports.EOAUTH2 = exports.ENOAUTH = exports.EAUTH = exports.ESTREAM = exports.EMESSAGE = exports.EENVELOPE = exports.EPROTOCOL = exports.EREQUIRETLS = exports.ETLS = exports.EDNS = exports.ESOCKET = exports.ETIMEDOUT = exports.ECONNECTION = exports.ERROR_CODES = void 0;
 /**
  * Error code descriptions for documentation and debugging
  */
@@ -68,3 +68,14 @@ exports.EPROXY = 'EPROXY';
 exports.EFILEACCESS = 'EFILEACCESS';
 exports.EURLACCESS = 'EURLACCESS';
 exports.EFETCH = 'EFETCH';
+/**
+ * Tells whether the error ended the connection rather than rejected what was sent over it
+ */
+const isTransientError = (err) => err.responseCode === 421 || err.code === exports.ECONNECTION || err.code === exports.ESOCKET || err.code === exports.ETIMEDOUT;
+exports.isTransientError = isTransientError;
+/**
+ * Code Node.js sets on an error when its permission model (`--permission`) denies an
+ * operation. It is not replaced with the Nodemailer code of the failing step (`ESOCKET`,
+ * `EDNS`, `EFETCH`, ...), so a missing grant such as `--allow-net` stays recognizable.
+ */
+exports.ERR_ACCESS_DENIED = 'ERR_ACCESS_DENIED';