nodemailer 10.0.3 → 10.0.5

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # CHANGELOG
 
+## [10.0.5](https://github.com/nodemailer/nodemailer/compare/v10.0.4...v10.0.5) (2026-09-11)
+
+
+### Bug Fixes
+
+* **addressparser:** parse comment-joined addresses in linear time ([c07f175](https://github.com/nodemailer/nodemailer/commit/c07f17518d25aca8ab2ad66968dcbca538c24b89))
+
+## [10.0.4](https://github.com/nodemailer/nodemailer/compare/v10.0.3...v10.0.4) (2026-09-11)
+
+
+### Bug Fixes
+
+* **fetch:** scope a cookie without a Path to the RFC 6265 default path ([2f907cb](https://github.com/nodemailer/nodemailer/commit/2f907cb71396860d0b2534dc72c3d252ef16339d))
+* **fetch:** send cookies set with Path back to the exact path ([#1861](https://github.com/nodemailer/nodemailer/issues/1861)) ([d557113](https://github.com/nodemailer/nodemailer/commit/d5571139750de47abbac73a3b07ae90ff39a7bdd))
+* **mail-composer:** keep httpHeaders and tls for href alternatives and icalEvent ([#1862](https://github.com/nodemailer/nodemailer/issues/1862)) ([7f502be](https://github.com/nodemailer/nodemailer/commit/7f502bee4a6b0386099c66c0a35d92850ec462f7))
+* resolve well-known services by their primary domains ([#1859](https://github.com/nodemailer/nodemailer/issues/1859)) ([085f525](https://github.com/nodemailer/nodemailer/commit/085f525e6b292f0ca32ab1b20d4a4ee82fc40e2d))
+* **ses-transport:** throw a configuration error when the SES client is missing ([#1863](https://github.com/nodemailer/nodemailer/issues/1863)) ([4d9c4c9](https://github.com/nodemailer/nodemailer/commit/4d9c4c966aaca61ff6d7649a1ac0aa0ceac6ef1e))
+
 ## [10.0.3](https://github.com/nodemailer/nodemailer/compare/v10.0.2...v10.0.3) (2026-09-10)
 
 

package/dist/cjs/addressparser/index.js

@@ -134,6 +134,12 @@ function _handleAddress(tokens, depth) {
         textWasQuoted: []
     };
     let insideQuotes = false;
+    // Last character of the run each state is currently accumulating. Reading it back off
+    // the accumulator with slice(-1) makes the engine flatten the whole growing string on
+    // every token, which is quadratic over an address built from many comment-joined atoms
+    // (GHSA-prgh-xp8r-p3m5). A run only ever grows by the token appended below, so the
+    // character is carried along instead of re-read.
+    const lastChars = { address: '', comment: '', group: '', text: '' };
     // Filter out <addresses>, (comments) and regular text
     for (let i = 0, len = tokens.length; i < len; i++) {
         const token = tokens[i];
@@ -177,15 +183,19 @@ function _handleAddress(tokens, depth) {
             const joins = prevToken &&
                 prevToken.noBreak &&
                 parts.length &&
-                (prevToken.value !== ')' || parts[parts.length - 1].slice(-1) === '@' || token.value.charAt(0) === '@');
+                (prevToken.value !== ')' || lastChars[state] === '@' || token.value.charAt(0) === '@');
             if (joins) {
                 data[state][data[state].length - 1] += token.value;
+                if (token.value) {
+                    lastChars[state] = token.value.charAt(token.value.length - 1);
+                }
                 if (state === 'text' && insideQuotes) {
                     data.textWasQuoted[data.textWasQuoted.length - 1] = true;
                 }
             }
             else {
                 data[state].push(token.value);
+                lastChars[state] = token.value.charAt(token.value.length - 1);
                 if (state === 'text') {
                     data.textWasQuoted.push(insideQuotes);
                 }

package/dist/cjs/fetch/cookies.d.ts

@@ -85,10 +85,12 @@ export default class Cookies {
      */
     isExpired(cookie: Cookie): boolean;
     /**
-     * Returns normalized cookie path for an URL path argument
+     * Returns the default path for an URL path argument, the default-path of
+     * RFC 6265 section 5.1.4. A cookie that carries no Path attribute is scoped
+     * to the directory of the URL it was set from
      *
      * @param pathname
-     * @returns Normalized path
+     * @returns Default path
      */
     getPath(pathname?: string | null): string;
 }

package/dist/cjs/fetch/cookies.js

@@ -195,9 +195,13 @@ class Cookies {
                 ('.' + urlparts.hostname).substr(-cookie.domain.length) !== cookie.domain)) {
             return false;
         }
-        // check if path matches
-        const path = this.getPath(urlparts.pathname);
-        if (path.substr(0, cookie.path.length) !== cookie.path) {
+        // check if the request path path-matches the cookie path (RFC 6265 section 5.1.4):
+        // identical paths match, otherwise the cookie path must be a directory prefix
+        const pathname = urlparts.pathname || '/';
+        const cookiePath = cookie.path;
+        const pathMatches = pathname === cookiePath ||
+            (pathname.startsWith(cookiePath) && (cookiePath.endsWith('/') || pathname.charAt(cookiePath.length) === '/'));
+        if (!pathMatches) {
             return false;
         }
         // check secure argument
@@ -254,22 +258,21 @@ class Cookies {
         return (cookie.expires && cookie.expires < new Date()) || !cookie.value;
     }
     /**
-     * Returns normalized cookie path for an URL path argument
+     * Returns the default path for an URL path argument, the default-path of
+     * RFC 6265 section 5.1.4. A cookie that carries no Path attribute is scoped
+     * to the directory of the URL it was set from
      *
      * @param pathname
-     * @returns Normalized path
+     * @returns Default path
      */
     getPath(pathname) {
         const pathParts = (pathname || '/').split('/');
         pathParts.pop(); // remove filename part
-        let path = pathParts.join('/').trim();
-        // ensure path prefix /
+        const path = pathParts.join('/').trim();
+        // a path that holds no more than one '/' is scoped to the root path, and so
+        // is one that does not start with '/' at all
         if (path.charAt(0) !== '/') {
-            path = '/' + path;
-        }
-        // ensure path suffix /
-        if (path.substr(-1) !== '/') {
-            path += '/';
+            return '/';
         }
         return path;
     }

package/dist/cjs/mail-composer/index.js

@@ -253,7 +253,8 @@ class MailComposer {
                 else if (icalEvent.href) {
                     icalEvent.content = {
                         href: icalEvent.href,
-                        httpHeaders: icalEvent.httpHeaders
+                        httpHeaders: icalEvent.httpHeaders,
+                        tls: icalEvent.tls
                     };
                     icalEvent.href = undefined;
                 }
@@ -362,7 +363,9 @@ class MailComposer {
             }
             else if (alternative.href) {
                 data.content = {
-                    href: alternative.href
+                    href: alternative.href,
+                    httpHeaders: alternative.httpHeaders,
+                    tls: alternative.tls
                 };
             }
             else {

package/dist/cjs/package-info.d.ts

@@ -1,3 +1,3 @@
 export declare const name = "nodemailer";
-export declare const version = "10.0.3";
+export declare const version = "10.0.5";
 export declare const homepage = "https://nodemailer.com/";

package/dist/cjs/package-info.js

@@ -3,5 +3,5 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.homepage = exports.version = exports.name = void 0;
 exports.name = 'nodemailer';
-exports.version = '10.0.3';
+exports.version = '10.0.5';
 exports.homepage = 'https://nodemailer.com/';

package/dist/cjs/ses-transport/index.js

@@ -62,7 +62,11 @@ function tagSesError(err) {
 class SESTransport extends node_events_1.default {
     constructor(options) {
         super();
-        options = options || {};
+        if (!options || !options.SES || !options.SES.sesClient) {
+            const error = new Error('Missing SES configuration, expecting { sesClient, SendEmailCommand } from @aws-sdk/client-sesv2, see https://nodemailer.com/transports/ses/');
+            error.code = errors.ECONFIG;
+            throw error;
+        }
         this.options = options;
         this.ses = this.options.SES;
         this.name = 'SESTransport';

package/dist/cjs/well-known/services.js

@@ -119,6 +119,7 @@ exports.services = {
     "FastMail": {
         "description": "FastMail",
         "domains": [
+            "fastmail.com",
             "fastmail.fm"
         ],
         "host": "smtp.fastmail.com",
@@ -232,6 +233,7 @@ exports.services = {
             "Mac"
         ],
         "domains": [
+            "icloud.com",
             "me.com",
             "mac.com"
         ],

package/dist/esm/addressparser/index.js

@@ -131,6 +131,12 @@ function _handleAddress(tokens, depth) {
         textWasQuoted: []
     };
     let insideQuotes = false;
+    // Last character of the run each state is currently accumulating. Reading it back off
+    // the accumulator with slice(-1) makes the engine flatten the whole growing string on
+    // every token, which is quadratic over an address built from many comment-joined atoms
+    // (GHSA-prgh-xp8r-p3m5). A run only ever grows by the token appended below, so the
+    // character is carried along instead of re-read.
+    const lastChars = { address: '', comment: '', group: '', text: '' };
     // Filter out <addresses>, (comments) and regular text
     for (let i = 0, len = tokens.length; i < len; i++) {
         const token = tokens[i];
@@ -174,15 +180,19 @@ function _handleAddress(tokens, depth) {
             const joins = prevToken &&
                 prevToken.noBreak &&
                 parts.length &&
-                (prevToken.value !== ')' || parts[parts.length - 1].slice(-1) === '@' || token.value.charAt(0) === '@');
+                (prevToken.value !== ')' || lastChars[state] === '@' || token.value.charAt(0) === '@');
             if (joins) {
                 data[state][data[state].length - 1] += token.value;
+                if (token.value) {
+                    lastChars[state] = token.value.charAt(token.value.length - 1);
+                }
                 if (state === 'text' && insideQuotes) {
                     data.textWasQuoted[data.textWasQuoted.length - 1] = true;
                 }
             }
             else {
                 data[state].push(token.value);
+                lastChars[state] = token.value.charAt(token.value.length - 1);
                 if (state === 'text') {
                     data.textWasQuoted.push(insideQuotes);
                 }

package/dist/esm/fetch/cookies.d.ts

@@ -85,10 +85,12 @@ export default class Cookies {
      */
     isExpired(cookie: Cookie): boolean;
     /**
-     * Returns normalized cookie path for an URL path argument
+     * Returns the default path for an URL path argument, the default-path of
+     * RFC 6265 section 5.1.4. A cookie that carries no Path attribute is scoped
+     * to the directory of the URL it was set from
      *
      * @param pathname
-     * @returns Normalized path
+     * @returns Default path
      */
     getPath(pathname?: string | null): string;
 }

package/dist/esm/fetch/cookies.js

@@ -157,9 +157,13 @@ export default class Cookies {
                 ('.' + urlparts.hostname).substr(-cookie.domain.length) !== cookie.domain)) {
             return false;
         }
-        // check if path matches
-        const path = this.getPath(urlparts.pathname);
-        if (path.substr(0, cookie.path.length) !== cookie.path) {
+        // check if the request path path-matches the cookie path (RFC 6265 section 5.1.4):
+        // identical paths match, otherwise the cookie path must be a directory prefix
+        const pathname = urlparts.pathname || '/';
+        const cookiePath = cookie.path;
+        const pathMatches = pathname === cookiePath ||
+            (pathname.startsWith(cookiePath) && (cookiePath.endsWith('/') || pathname.charAt(cookiePath.length) === '/'));
+        if (!pathMatches) {
             return false;
         }
         // check secure argument
@@ -216,22 +220,21 @@ export default class Cookies {
         return (cookie.expires && cookie.expires < new Date()) || !cookie.value;
     }
     /**
-     * Returns normalized cookie path for an URL path argument
+     * Returns the default path for an URL path argument, the default-path of
+     * RFC 6265 section 5.1.4. A cookie that carries no Path attribute is scoped
+     * to the directory of the URL it was set from
      *
      * @param pathname
-     * @returns Normalized path
+     * @returns Default path
      */
     getPath(pathname) {
         const pathParts = (pathname || '/').split('/');
         pathParts.pop(); // remove filename part
-        let path = pathParts.join('/').trim();
-        // ensure path prefix /
+        const path = pathParts.join('/').trim();
+        // a path that holds no more than one '/' is scoped to the root path, and so
+        // is one that does not start with '/' at all
         if (path.charAt(0) !== '/') {
-            path = '/' + path;
-        }
-        // ensure path suffix /
-        if (path.substr(-1) !== '/') {
-            path += '/';
+            return '/';
         }
         return path;
     }

package/dist/esm/mail-composer/index.js

@@ -215,7 +215,8 @@ class MailComposer {
                 else if (icalEvent.href) {
                     icalEvent.content = {
                         href: icalEvent.href,
-                        httpHeaders: icalEvent.httpHeaders
+                        httpHeaders: icalEvent.httpHeaders,
+                        tls: icalEvent.tls
                     };
                     icalEvent.href = undefined;
                 }
@@ -324,7 +325,9 @@ class MailComposer {
             }
             else if (alternative.href) {
                 data.content = {
-                    href: alternative.href
+                    href: alternative.href,
+                    httpHeaders: alternative.httpHeaders,
+                    tls: alternative.tls
                 };
             }
             else {

package/dist/esm/package-info.d.ts

@@ -1,3 +1,3 @@
 export declare const name = "nodemailer";
-export declare const version = "10.0.3";
+export declare const version = "10.0.5";
 export declare const homepage = "https://nodemailer.com/";

package/dist/esm/package-info.js

@@ -1,4 +1,4 @@
 // Generated by scripts/build.js from package.json. Do not edit by hand.
 export const name = 'nodemailer';
-export const version = '10.0.3';
+export const version = '10.0.5';
 export const homepage = 'https://nodemailer.com/';

package/dist/esm/ses-transport/index.js

@@ -24,7 +24,11 @@ function tagSesError(err) {
 class SESTransport extends EventEmitter {
     constructor(options) {
         super();
-        options = options || {};
+        if (!options || !options.SES || !options.SES.sesClient) {
+            const error = new Error('Missing SES configuration, expecting { sesClient, SendEmailCommand } from @aws-sdk/client-sesv2, see https://nodemailer.com/transports/ses/');
+            error.code = errors.ECONFIG;
+            throw error;
+        }
         this.options = options;
         this.ses = this.options.SES;
         this.name = 'SESTransport';

package/dist/esm/well-known/services.js

@@ -116,6 +116,7 @@ export const services = {
     "FastMail": {
         "description": "FastMail",
         "domains": [
+            "fastmail.com",
             "fastmail.fm"
         ],
         "host": "smtp.fastmail.com",
@@ -229,6 +230,7 @@ export const services = {
             "Mac"
         ],
         "domains": [
+            "icloud.com",
             "me.com",
             "mac.com"
         ],

package/dist/well-known/services.json

@@ -107,7 +107,7 @@
 
     "FastMail": {
         "description": "FastMail",
-        "domains": ["fastmail.fm"],
+        "domains": ["fastmail.com", "fastmail.fm"],
         "host": "smtp.fastmail.com",
         "port": 465,
         "secure": true
@@ -196,7 +196,7 @@
     "iCloud": {
         "description": "iCloud Mail",
         "aliases": ["Me", "Mac"],
-        "domains": ["me.com", "mac.com"],
+        "domains": ["icloud.com", "me.com", "mac.com"],
         "host": "smtp.mail.me.com",
         "port": 587
     },

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "nodemailer",
-    "version": "10.0.3",
+    "version": "10.0.5",
     "description": "Easy as cake e-mail sending from your Node.js applications",
     "type": "module",
     "main": "./dist/cjs/nodemailer.js",