nodemailer 10.0.2 → 10.0.4

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # CHANGELOG
 
+## [10.0.4](https://github.com/nodemailer/nodemailer/compare/v10.0.3...v10.0.4) (2026-09-11)
+
+
+### Bug Fixes
+
+* **fetch:** scope a cookie without a Path to the RFC 6265 default path ([2f907cb](https://github.com/nodemailer/nodemailer/commit/2f907cb71396860d0b2534dc72c3d252ef16339d))
+* **fetch:** send cookies set with Path back to the exact path ([#1861](https://github.com/nodemailer/nodemailer/issues/1861)) ([d557113](https://github.com/nodemailer/nodemailer/commit/d5571139750de47abbac73a3b07ae90ff39a7bdd))
+* **mail-composer:** keep httpHeaders and tls for href alternatives and icalEvent ([#1862](https://github.com/nodemailer/nodemailer/issues/1862)) ([7f502be](https://github.com/nodemailer/nodemailer/commit/7f502bee4a6b0386099c66c0a35d92850ec462f7))
+* resolve well-known services by their primary domains ([#1859](https://github.com/nodemailer/nodemailer/issues/1859)) ([085f525](https://github.com/nodemailer/nodemailer/commit/085f525e6b292f0ca32ab1b20d4a4ee82fc40e2d))
+* **ses-transport:** throw a configuration error when the SES client is missing ([#1863](https://github.com/nodemailer/nodemailer/issues/1863)) ([4d9c4c9](https://github.com/nodemailer/nodemailer/commit/4d9c4c966aaca61ff6d7649a1ac0aa0ceac6ef1e))
+
+## [10.0.3](https://github.com/nodemailer/nodemailer/compare/v10.0.2...v10.0.3) (2026-09-10)
+
+
+### Bug Fixes
+
+* **fetch:** honor the cookie Domain attribute without accepting public suffixes ([1608391](https://github.com/nodemailer/nodemailer/commit/1608391ff4ccd5422a88e4cf760b26068aad6d39)), closes [#1856](https://github.com/nodemailer/nodemailer/issues/1856)
+
 ## [10.0.2](https://github.com/nodemailer/nodemailer/compare/v10.0.1...v10.0.2) (2026-09-09)
 
 

package/dist/cjs/fetch/cookies.d.ts

@@ -85,10 +85,12 @@ export default class Cookies {
      */
     isExpired(cookie: Cookie): boolean;
     /**
-     * Returns normalized cookie path for an URL path argument
+     * Returns the default path for an URL path argument, the default-path of
+     * RFC 6265 section 5.1.4. A cookie that carries no Path attribute is scoped
+     * to the directory of the URL it was set from
      *
      * @param pathname
-     * @returns Normalized path
+     * @returns Default path
      */
     getPath(pathname?: string | null): string;
 }

package/dist/cjs/fetch/cookies.js

@@ -33,7 +33,11 @@ var __importStar = (this && this.__importStar) || (function () {
         return result;
     };
 })();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
+const node_net_1 = __importDefault(require("node:net"));
 const urllib = __importStar(require("../shared/url.js"));
 const SESSION_TIMEOUT = 1800; // 30 min
 /**
@@ -59,12 +63,19 @@ class Cookies {
         let domain;
         if (cookie.domain) {
             domain = cookie.domain.replace(/^\./, '');
-            // do not allow cross origin cookies
+            // do not allow cross origin cookies. There is no public suffix list here, so a
+            // multi-label suffix like 'co.uk' can not be told apart from a registrable domain
             if (
             // can't be valid if the requested domain is shorter than current hostname
             urlparts.hostname.length < domain.length ||
+                // a top level domain is not a valid scope, 'Domain=com' would otherwise be
+                // sent to every .com host. A trailing dot does not make 'com.' any better
+                domain.indexOf('.') < 0 ||
+                domain.endsWith('.') ||
+                // an IP address has no subdomains, so cookies set on it stay host-only
+                node_net_1.default.isIP(urlparts.hostname) ||
                 // prefix domains with dot to be sure that partial matches are not used
-                ('.' + urlparts.hostname).substr(-domain.length + 1) !== '.' + domain) {
+                !('.' + urlparts.hostname).endsWith('.' + domain)) {
                 cookie.domain = urlparts.hostname;
             }
         }
@@ -184,9 +195,13 @@ class Cookies {
                 ('.' + urlparts.hostname).substr(-cookie.domain.length) !== cookie.domain)) {
             return false;
         }
-        // check if path matches
-        const path = this.getPath(urlparts.pathname);
-        if (path.substr(0, cookie.path.length) !== cookie.path) {
+        // check if the request path path-matches the cookie path (RFC 6265 section 5.1.4):
+        // identical paths match, otherwise the cookie path must be a directory prefix
+        const pathname = urlparts.pathname || '/';
+        const cookiePath = cookie.path;
+        const pathMatches = pathname === cookiePath ||
+            (pathname.startsWith(cookiePath) && (cookiePath.endsWith('/') || pathname.charAt(cookiePath.length) === '/'));
+        if (!pathMatches) {
             return false;
         }
         // check secure argument
@@ -243,22 +258,21 @@ class Cookies {
         return (cookie.expires && cookie.expires < new Date()) || !cookie.value;
     }
     /**
-     * Returns normalized cookie path for an URL path argument
+     * Returns the default path for an URL path argument, the default-path of
+     * RFC 6265 section 5.1.4. A cookie that carries no Path attribute is scoped
+     * to the directory of the URL it was set from
      *
      * @param pathname
-     * @returns Normalized path
+     * @returns Default path
      */
     getPath(pathname) {
         const pathParts = (pathname || '/').split('/');
         pathParts.pop(); // remove filename part
-        let path = pathParts.join('/').trim();
-        // ensure path prefix /
+        const path = pathParts.join('/').trim();
+        // a path that holds no more than one '/' is scoped to the root path, and so
+        // is one that does not start with '/' at all
         if (path.charAt(0) !== '/') {
-            path = '/' + path;
-        }
-        // ensure path suffix /
-        if (path.substr(-1) !== '/') {
-            path += '/';
+            return '/';
         }
         return path;
     }

package/dist/cjs/mail-composer/index.js

@@ -253,7 +253,8 @@ class MailComposer {
                 else if (icalEvent.href) {
                     icalEvent.content = {
                         href: icalEvent.href,
-                        httpHeaders: icalEvent.httpHeaders
+                        httpHeaders: icalEvent.httpHeaders,
+                        tls: icalEvent.tls
                     };
                     icalEvent.href = undefined;
                 }
@@ -362,7 +363,9 @@ class MailComposer {
             }
             else if (alternative.href) {
                 data.content = {
-                    href: alternative.href
+                    href: alternative.href,
+                    httpHeaders: alternative.httpHeaders,
+                    tls: alternative.tls
                 };
             }
             else {

package/dist/cjs/package-info.d.ts

@@ -1,3 +1,3 @@
 export declare const name = "nodemailer";
-export declare const version = "10.0.2";
+export declare const version = "10.0.4";
 export declare const homepage = "https://nodemailer.com/";

package/dist/cjs/package-info.js

@@ -3,5 +3,5 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.homepage = exports.version = exports.name = void 0;
 exports.name = 'nodemailer';
-exports.version = '10.0.2';
+exports.version = '10.0.4';
 exports.homepage = 'https://nodemailer.com/';

package/dist/cjs/ses-transport/index.js

@@ -62,7 +62,11 @@ function tagSesError(err) {
 class SESTransport extends node_events_1.default {
     constructor(options) {
         super();
-        options = options || {};
+        if (!options || !options.SES || !options.SES.sesClient) {
+            const error = new Error('Missing SES configuration, expecting { sesClient, SendEmailCommand } from @aws-sdk/client-sesv2, see https://nodemailer.com/transports/ses/');
+            error.code = errors.ECONFIG;
+            throw error;
+        }
         this.options = options;
         this.ses = this.options.SES;
         this.name = 'SESTransport';

package/dist/cjs/well-known/services.js

@@ -119,6 +119,7 @@ exports.services = {
     "FastMail": {
         "description": "FastMail",
         "domains": [
+            "fastmail.com",
             "fastmail.fm"
         ],
         "host": "smtp.fastmail.com",
@@ -232,6 +233,7 @@ exports.services = {
             "Mac"
         ],
         "domains": [
+            "icloud.com",
             "me.com",
             "mac.com"
         ],

package/dist/esm/fetch/cookies.d.ts

@@ -85,10 +85,12 @@ export default class Cookies {
      */
     isExpired(cookie: Cookie): boolean;
     /**
-     * Returns normalized cookie path for an URL path argument
+     * Returns the default path for an URL path argument, the default-path of
+     * RFC 6265 section 5.1.4. A cookie that carries no Path attribute is scoped
+     * to the directory of the URL it was set from
      *
      * @param pathname
-     * @returns Normalized path
+     * @returns Default path
      */
     getPath(pathname?: string | null): string;
 }

package/dist/esm/fetch/cookies.js

@@ -1,4 +1,5 @@
 // module to handle cookies
+import net from 'node:net';
 import * as urllib from '../shared/url.js';
 const SESSION_TIMEOUT = 1800; // 30 min
 /**
@@ -24,12 +25,19 @@ export default class Cookies {
         let domain;
         if (cookie.domain) {
             domain = cookie.domain.replace(/^\./, '');
-            // do not allow cross origin cookies
+            // do not allow cross origin cookies. There is no public suffix list here, so a
+            // multi-label suffix like 'co.uk' can not be told apart from a registrable domain
             if (
             // can't be valid if the requested domain is shorter than current hostname
             urlparts.hostname.length < domain.length ||
+                // a top level domain is not a valid scope, 'Domain=com' would otherwise be
+                // sent to every .com host. A trailing dot does not make 'com.' any better
+                domain.indexOf('.') < 0 ||
+                domain.endsWith('.') ||
+                // an IP address has no subdomains, so cookies set on it stay host-only
+                net.isIP(urlparts.hostname) ||
                 // prefix domains with dot to be sure that partial matches are not used
-                ('.' + urlparts.hostname).substr(-domain.length + 1) !== '.' + domain) {
+                !('.' + urlparts.hostname).endsWith('.' + domain)) {
                 cookie.domain = urlparts.hostname;
             }
         }
@@ -149,9 +157,13 @@ export default class Cookies {
                 ('.' + urlparts.hostname).substr(-cookie.domain.length) !== cookie.domain)) {
             return false;
         }
-        // check if path matches
-        const path = this.getPath(urlparts.pathname);
-        if (path.substr(0, cookie.path.length) !== cookie.path) {
+        // check if the request path path-matches the cookie path (RFC 6265 section 5.1.4):
+        // identical paths match, otherwise the cookie path must be a directory prefix
+        const pathname = urlparts.pathname || '/';
+        const cookiePath = cookie.path;
+        const pathMatches = pathname === cookiePath ||
+            (pathname.startsWith(cookiePath) && (cookiePath.endsWith('/') || pathname.charAt(cookiePath.length) === '/'));
+        if (!pathMatches) {
             return false;
         }
         // check secure argument
@@ -208,22 +220,21 @@ export default class Cookies {
         return (cookie.expires && cookie.expires < new Date()) || !cookie.value;
     }
     /**
-     * Returns normalized cookie path for an URL path argument
+     * Returns the default path for an URL path argument, the default-path of
+     * RFC 6265 section 5.1.4. A cookie that carries no Path attribute is scoped
+     * to the directory of the URL it was set from
      *
      * @param pathname
-     * @returns Normalized path
+     * @returns Default path
      */
     getPath(pathname) {
         const pathParts = (pathname || '/').split('/');
         pathParts.pop(); // remove filename part
-        let path = pathParts.join('/').trim();
-        // ensure path prefix /
+        const path = pathParts.join('/').trim();
+        // a path that holds no more than one '/' is scoped to the root path, and so
+        // is one that does not start with '/' at all
         if (path.charAt(0) !== '/') {
-            path = '/' + path;
-        }
-        // ensure path suffix /
-        if (path.substr(-1) !== '/') {
-            path += '/';
+            return '/';
         }
         return path;
     }

package/dist/esm/mail-composer/index.js

@@ -215,7 +215,8 @@ class MailComposer {
                 else if (icalEvent.href) {
                     icalEvent.content = {
                         href: icalEvent.href,
-                        httpHeaders: icalEvent.httpHeaders
+                        httpHeaders: icalEvent.httpHeaders,
+                        tls: icalEvent.tls
                     };
                     icalEvent.href = undefined;
                 }
@@ -324,7 +325,9 @@ class MailComposer {
             }
             else if (alternative.href) {
                 data.content = {
-                    href: alternative.href
+                    href: alternative.href,
+                    httpHeaders: alternative.httpHeaders,
+                    tls: alternative.tls
                 };
             }
             else {

package/dist/esm/package-info.d.ts

@@ -1,3 +1,3 @@
 export declare const name = "nodemailer";
-export declare const version = "10.0.2";
+export declare const version = "10.0.4";
 export declare const homepage = "https://nodemailer.com/";

package/dist/esm/package-info.js

@@ -1,4 +1,4 @@
 // Generated by scripts/build.js from package.json. Do not edit by hand.
 export const name = 'nodemailer';
-export const version = '10.0.2';
+export const version = '10.0.4';
 export const homepage = 'https://nodemailer.com/';

package/dist/esm/ses-transport/index.js

@@ -24,7 +24,11 @@ function tagSesError(err) {
 class SESTransport extends EventEmitter {
     constructor(options) {
         super();
-        options = options || {};
+        if (!options || !options.SES || !options.SES.sesClient) {
+            const error = new Error('Missing SES configuration, expecting { sesClient, SendEmailCommand } from @aws-sdk/client-sesv2, see https://nodemailer.com/transports/ses/');
+            error.code = errors.ECONFIG;
+            throw error;
+        }
         this.options = options;
         this.ses = this.options.SES;
         this.name = 'SESTransport';

package/dist/esm/well-known/services.js

@@ -116,6 +116,7 @@ export const services = {
     "FastMail": {
         "description": "FastMail",
         "domains": [
+            "fastmail.com",
             "fastmail.fm"
         ],
         "host": "smtp.fastmail.com",
@@ -229,6 +230,7 @@ export const services = {
             "Mac"
         ],
         "domains": [
+            "icloud.com",
             "me.com",
             "mac.com"
         ],

package/dist/well-known/services.json

@@ -107,7 +107,7 @@
 
     "FastMail": {
         "description": "FastMail",
-        "domains": ["fastmail.fm"],
+        "domains": ["fastmail.com", "fastmail.fm"],
         "host": "smtp.fastmail.com",
         "port": 465,
         "secure": true
@@ -196,7 +196,7 @@
     "iCloud": {
         "description": "iCloud Mail",
         "aliases": ["Me", "Mac"],
-        "domains": ["me.com", "mac.com"],
+        "domains": ["icloud.com", "me.com", "mac.com"],
         "host": "smtp.mail.me.com",
         "port": 587
     },

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "nodemailer",
-    "version": "10.0.2",
+    "version": "10.0.4",
     "description": "Easy as cake e-mail sending from your Node.js applications",
     "type": "module",
     "main": "./dist/cjs/nodemailer.js",