nodemailer 10.0.5 → 10.0.7

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # CHANGELOG
 
+## [10.0.7](https://github.com/nodemailer/nodemailer/compare/v10.0.6...v10.0.7) (2026-09-11)
+
+
+### Bug Fixes
+
+* **mime-funcs:** do not double encode Buffer input when chunking base64 mime words ([#1865](https://github.com/nodemailer/nodemailer/issues/1865)) ([4327a59](https://github.com/nodemailer/nodemailer/commit/4327a59939748a7f9394b0a029495fd476f68f30))
+* **mime-node:** keep a boundary that is only line breaks from stripping to empty ([ec46800](https://github.com/nodemailer/nodemailer/commit/ec46800cdcab734d9aa79e1278e819962b3b8f09))
+* **mime-node:** strip line breaks from multipart boundary material ([#1867](https://github.com/nodemailer/nodemailer/issues/1867)) ([03c1a5c](https://github.com/nodemailer/nodemailer/commit/03c1a5c48b6828d9392983d8718fdb1fd583a06c))
+* **smtp-pool:** release rate-limited connections on close ([#1866](https://github.com/nodemailer/nodemailer/issues/1866)) ([7f5c7a4](https://github.com/nodemailer/nodemailer/commit/7f5c7a46b61da9f5c5feaffd921c55b9d5892ee5))
+
+## [10.0.6](https://github.com/nodemailer/nodemailer/compare/v10.0.5...v10.0.6) (2026-09-11)
+
+
+### Bug Fixes
+
+* **addressparser:** scan free text for an address in linear time ([437d7fc](https://github.com/nodemailer/nodemailer/commit/437d7fc47403df176bc39271641541b7a9bce102))
+
 ## [10.0.5](https://github.com/nodemailer/nodemailer/compare/v10.0.4...v10.0.5) (2026-09-11)
 
 

package/dist/cjs/addressparser/index.js

@@ -50,6 +50,111 @@ const ADDR_SPEC = /^[^@\s]+@[^@\s]+$/;
  * further '@' that a domain should not have but malformed headers carry anyway.
  */
 const LOOSE_ADDR_SPEC = /^[^@\s]+@\S+$/;
+/**
+ * An addr-spec sitting inside free text, together with the whitespace around it. Sticky
+ * on purpose: it is run at the one offset _looseAddressStart picks rather than being let
+ * loose to search, see there.
+ */
+const LOOSE_TEXT_ADDR = /\s*\b[^@\s]+@[^\s]+\b\s*/y;
+/**
+ * The characters JS `\s` matches, which the scan below has to agree with to land on the
+ * same match the pattern would.
+ */
+function _isSpaceCode(code) {
+    return (code === 0x20 ||
+        (code >= 0x09 && code <= 0x0d) ||
+        code === 0xa0 ||
+        code === 0x1680 ||
+        (code >= 0x2000 && code <= 0x200a) ||
+        code === 0x2028 ||
+        code === 0x2029 ||
+        code === 0x202f ||
+        code === 0x205f ||
+        code === 0x3000 ||
+        code === 0xfeff);
+}
+/**
+ * The characters JS `\w` matches without the unicode flag, the set the `\b` in
+ * LOOSE_TEXT_ADDR is read against. charCodeAt off either end of the string gives NaN,
+ * which compares false throughout, so out of range reads as the non-word the pattern
+ * treats them as.
+ */
+function _isWordCode(code) {
+    return (code >= 0x30 && code <= 0x39) || (code >= 0x41 && code <= 0x5a) || (code >= 0x61 && code <= 0x7a) || code === 0x5f;
+}
+/**
+ * Whether `\b` holds at an offset
+ */
+function _isBoundary(text, at) {
+    return _isWordCode(text.charCodeAt(at - 1)) !== _isWordCode(text.charCodeAt(at));
+}
+/**
+ * Finds the offset LOOSE_TEXT_ADDR matches at, or -1 when it does not match at all.
+ *
+ * Letting the pattern search for itself is quadratic: '[^@\s]+' is retried from every
+ * offset and rescans the run to the next '@' each time, so 140KB of header holding no
+ * usable '@' blocks the event loop for about ten seconds (GHSA-v53p-9fqp-m79j). The search is also unnecessary.
+ * '[^@\s]+' crosses neither whitespace nor a '@', so a match can only begin at the head of
+ * a whitespace delimited run or just past a '@' inside one, and '[^\s]+\b' gives characters
+ * back until it lands on a boundary, so the only end it can take in that run is the last
+ * boundary in it. Both are found in one pass, and the pattern is then run at that single
+ * offset.
+ *
+ * @param text Free text to look in
+ * @return Offset to match at, or -1
+ */
+function _looseAddressStart(text) {
+    const len = text.length;
+    let pos = 0;
+    while (pos < len) {
+        while (pos < len && _isSpaceCode(text.charCodeAt(pos))) {
+            pos++;
+        }
+        if (pos >= len) {
+            break;
+        }
+        const runStart = pos;
+        let runEnd = pos;
+        while (runEnd < len && !_isSpaceCode(text.charCodeAt(runEnd))) {
+            runEnd++;
+        }
+        let at = text.indexOf('@', runStart);
+        if (at >= 0 && at < runEnd) {
+            let lastBoundary = -1;
+            for (let k = runEnd; k > runStart; k--) {
+                if (_isBoundary(text, k)) {
+                    lastBoundary = k;
+                    break;
+                }
+            }
+            let atomStart = runStart;
+            while (lastBoundary >= 0 && at >= 0 && at < runEnd) {
+                // '[^@\s]+' has to cover a character before the '@' and '[^\s]+' one after it,
+                // and the boundary that ends the match has to sit past both
+                if (at > atomStart && runEnd > at + 1 && lastBoundary > at + 1) {
+                    for (let start = atomStart; start < at; start++) {
+                        if (_isBoundary(text, start)) {
+                            if (start > runStart) {
+                                return start;
+                            }
+                            // the leading '\s*' is greedy, so a match that begins at the run
+                            // takes the whitespace in front of it along
+                            let padded = runStart;
+                            while (padded > 0 && _isSpaceCode(text.charCodeAt(padded - 1))) {
+                                padded--;
+                            }
+                            return padded;
+                        }
+                    }
+                }
+                atomStart = at + 1;
+                at = text.indexOf('@', atomStart);
+            }
+        }
+        pos = runEnd;
+    }
+    return -1;
+}
 /**
  * Recovers the addr-spec from an angle-addr that came back holding unquoted whitespace.
  *
@@ -247,16 +352,19 @@ function _handleAddress(tokens, depth) {
                 for (let i = data.text.length - 1; i >= 0; i--) {
                     // Security: Do not extract email addresses from quoted strings
                     if (!data.textWasQuoted[i]) {
-                        data.text[i] = data.text[i]
-                            .replace(/\s*\b[^@\s]+@[^\s]+\b\s*/, (match) => {
-                            if (!extracted) {
-                                data.address = [match.trim()];
+                        const part = data.text[i];
+                        let remainder = part;
+                        const at = _looseAddressStart(part);
+                        if (at >= 0) {
+                            LOOSE_TEXT_ADDR.lastIndex = at;
+                            const match = LOOSE_TEXT_ADDR.exec(part);
+                            if (match) {
+                                data.address = [match[0].trim()];
                                 extracted = true;
-                                return ' ';
+                                remainder = part.slice(0, at) + ' ' + part.slice(at + match[0].length);
                             }
-                            return match;
-                        })
-                            .trim();
+                        }
+                        data.text[i] = remainder.trim();
                         if (extracted) {
                             break;
                         }

package/dist/cjs/mime-funcs/index.js

@@ -125,7 +125,10 @@ function encodeWord(data, mimeWordEncoding, maxLength) {
         });
     }
     else if (mimeWordEncoding === 'B') {
-        encodedStr = typeof data === 'string' ? data : base64.encode(data);
+        // the chunking loop below splits raw text and base64 encodes each part, so a
+        // Buffer goes in as its UTF-8 string: handing it the base64 of the whole input
+        // would encode the encoding itself and decode back to base64 text
+        encodedStr = typeof data === 'string' ? data : data.toString('utf-8');
         maxLength = maxLength ? Math.max(3, ((maxLength - (maxLength % 4)) / 4) * 3) : 0;
     }
     if (maxLength && (mimeWordEncoding !== 'B' ? encodedStr : base64.encode(data)).length > maxLength) {

package/dist/cjs/mime-node/index.js

@@ -99,6 +99,15 @@ function normalizeDomain(domain, toUnicode) {
     }
     return toUnicode ? punycode.toUnicode(domain) : punycode.toASCII(domain);
 }
+/**
+ * Removes the line breaks that would split a value across lines once it is written out.
+ *
+ * @param value Value to clean
+ * @return Value with every CR and LF removed
+ */
+function _stripLineBreaks(value) {
+    return value.replace(/[\r\n]+/g, '');
+}
 /**
  * Creates a new mime tree node. Assumes 'multipart/*' as the content type
  * if it is a branch, anything else counts as leaf. If rootNode is missing from
@@ -119,10 +128,12 @@ class MimeNode {
         this.nodeCounter = 0;
         options = options || {};
         /**
-         * shared part of the unique multipart boundary
+         * shared part of the unique multipart boundary. A line break here would split
+         * the delimiter lines the tree is streamed with, so the declared boundary could
+         * never match them again and the remainder would go out as body lines
          */
-        this.baseBoundary = options.baseBoundary || node_crypto_1.default.randomBytes(8).toString('hex');
-        this.boundaryPrefix = options.boundaryPrefix || '--_NmP';
+        this.baseBoundary = _stripLineBreaks(options.baseBoundary || node_crypto_1.default.randomBytes(8).toString('hex'));
+        this.boundaryPrefix = _stripLineBreaks(options.boundaryPrefix || '--_NmP');
         this.disableFileAccess = !!options.disableFileAccess;
         this.disableUrlAccess = !!options.disableUrlAccess;
         this.normalizeHeaderKey = options.normalizeHeaderKey;
@@ -1169,8 +1180,19 @@ class MimeNode {
         this.contentType = structured.value.trim().toLowerCase();
         this.multipart = /^multipart\//i.test(this.contentType) ? this.contentType.substr(this.contentType.indexOf('/') + 1) : false;
         if (this.multipart) {
-            this.boundary = structured.params.boundary =
-                structured.params.boundary || this.boundary || this._generateBoundary();
+            // A line break in the boundary would split the delimiter lines the tree is
+            // streamed with, so the declared boundary could never match them again and
+            // the remainder would go out as body lines. The declared value and the
+            // delimiters are assigned from the same expression here, so whatever the
+            // header emitter then does with it, the two sides cannot disagree.
+            //
+            // Stripping runs before the fallback rather than over the whole chain: a
+            // boundary that was nothing but line breaks would otherwise strip to '' and
+            // leave the node declaring no boundary and streaming bare '--' delimiters.
+            // The generated boundary is stripped too, since baseBoundary and
+            // boundaryPrefix are public and may have been written after construction.
+            const declared = _stripLineBreaks(structured.params.boundary || this.boundary || '');
+            this.boundary = structured.params.boundary = declared || _stripLineBreaks(this._generateBoundary());
         }
         else {
             this.boundary = false;

package/dist/cjs/package-info.d.ts

@@ -1,3 +1,3 @@
 export declare const name = "nodemailer";
-export declare const version = "10.0.5";
+export declare const version = "10.0.7";
 export declare const homepage = "https://nodemailer.com/";

package/dist/cjs/package-info.js

@@ -3,5 +3,5 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.homepage = exports.version = exports.name = void 0;
 exports.name = 'nodemailer';
-exports.version = '10.0.5';
+exports.version = '10.0.7';
 exports.homepage = 'https://nodemailer.com/';

package/dist/cjs/smtp-pool/index.js

@@ -138,8 +138,10 @@ class SMTPPool extends node_events_1.EventEmitter {
         let connection;
         const len = this._connections.length;
         this._closed = true;
-        // clear rate limit timer if it exists
-        clearTimeout(this._rateLimit.timeout);
+        // release connections gated by the rate limiter so they become
+        // available and are torn down below instead of leaking with a
+        // cleared timer that never fires
+        this._clearRateLimit();
         if (!len && !this._queue.length) {
             return;
         }

package/dist/esm/addressparser/index.js

@@ -47,6 +47,111 @@ const ADDR_SPEC = /^[^@\s]+@[^@\s]+$/;
  * further '@' that a domain should not have but malformed headers carry anyway.
  */
 const LOOSE_ADDR_SPEC = /^[^@\s]+@\S+$/;
+/**
+ * An addr-spec sitting inside free text, together with the whitespace around it. Sticky
+ * on purpose: it is run at the one offset _looseAddressStart picks rather than being let
+ * loose to search, see there.
+ */
+const LOOSE_TEXT_ADDR = /\s*\b[^@\s]+@[^\s]+\b\s*/y;
+/**
+ * The characters JS `\s` matches, which the scan below has to agree with to land on the
+ * same match the pattern would.
+ */
+function _isSpaceCode(code) {
+    return (code === 0x20 ||
+        (code >= 0x09 && code <= 0x0d) ||
+        code === 0xa0 ||
+        code === 0x1680 ||
+        (code >= 0x2000 && code <= 0x200a) ||
+        code === 0x2028 ||
+        code === 0x2029 ||
+        code === 0x202f ||
+        code === 0x205f ||
+        code === 0x3000 ||
+        code === 0xfeff);
+}
+/**
+ * The characters JS `\w` matches without the unicode flag, the set the `\b` in
+ * LOOSE_TEXT_ADDR is read against. charCodeAt off either end of the string gives NaN,
+ * which compares false throughout, so out of range reads as the non-word the pattern
+ * treats them as.
+ */
+function _isWordCode(code) {
+    return (code >= 0x30 && code <= 0x39) || (code >= 0x41 && code <= 0x5a) || (code >= 0x61 && code <= 0x7a) || code === 0x5f;
+}
+/**
+ * Whether `\b` holds at an offset
+ */
+function _isBoundary(text, at) {
+    return _isWordCode(text.charCodeAt(at - 1)) !== _isWordCode(text.charCodeAt(at));
+}
+/**
+ * Finds the offset LOOSE_TEXT_ADDR matches at, or -1 when it does not match at all.
+ *
+ * Letting the pattern search for itself is quadratic: '[^@\s]+' is retried from every
+ * offset and rescans the run to the next '@' each time, so 140KB of header holding no
+ * usable '@' blocks the event loop for about ten seconds (GHSA-v53p-9fqp-m79j). The search is also unnecessary.
+ * '[^@\s]+' crosses neither whitespace nor a '@', so a match can only begin at the head of
+ * a whitespace delimited run or just past a '@' inside one, and '[^\s]+\b' gives characters
+ * back until it lands on a boundary, so the only end it can take in that run is the last
+ * boundary in it. Both are found in one pass, and the pattern is then run at that single
+ * offset.
+ *
+ * @param text Free text to look in
+ * @return Offset to match at, or -1
+ */
+function _looseAddressStart(text) {
+    const len = text.length;
+    let pos = 0;
+    while (pos < len) {
+        while (pos < len && _isSpaceCode(text.charCodeAt(pos))) {
+            pos++;
+        }
+        if (pos >= len) {
+            break;
+        }
+        const runStart = pos;
+        let runEnd = pos;
+        while (runEnd < len && !_isSpaceCode(text.charCodeAt(runEnd))) {
+            runEnd++;
+        }
+        let at = text.indexOf('@', runStart);
+        if (at >= 0 && at < runEnd) {
+            let lastBoundary = -1;
+            for (let k = runEnd; k > runStart; k--) {
+                if (_isBoundary(text, k)) {
+                    lastBoundary = k;
+                    break;
+                }
+            }
+            let atomStart = runStart;
+            while (lastBoundary >= 0 && at >= 0 && at < runEnd) {
+                // '[^@\s]+' has to cover a character before the '@' and '[^\s]+' one after it,
+                // and the boundary that ends the match has to sit past both
+                if (at > atomStart && runEnd > at + 1 && lastBoundary > at + 1) {
+                    for (let start = atomStart; start < at; start++) {
+                        if (_isBoundary(text, start)) {
+                            if (start > runStart) {
+                                return start;
+                            }
+                            // the leading '\s*' is greedy, so a match that begins at the run
+                            // takes the whitespace in front of it along
+                            let padded = runStart;
+                            while (padded > 0 && _isSpaceCode(text.charCodeAt(padded - 1))) {
+                                padded--;
+                            }
+                            return padded;
+                        }
+                    }
+                }
+                atomStart = at + 1;
+                at = text.indexOf('@', atomStart);
+            }
+        }
+        pos = runEnd;
+    }
+    return -1;
+}
 /**
  * Recovers the addr-spec from an angle-addr that came back holding unquoted whitespace.
  *
@@ -244,16 +349,19 @@ function _handleAddress(tokens, depth) {
                 for (let i = data.text.length - 1; i >= 0; i--) {
                     // Security: Do not extract email addresses from quoted strings
                     if (!data.textWasQuoted[i]) {
-                        data.text[i] = data.text[i]
-                            .replace(/\s*\b[^@\s]+@[^\s]+\b\s*/, (match) => {
-                            if (!extracted) {
-                                data.address = [match.trim()];
+                        const part = data.text[i];
+                        let remainder = part;
+                        const at = _looseAddressStart(part);
+                        if (at >= 0) {
+                            LOOSE_TEXT_ADDR.lastIndex = at;
+                            const match = LOOSE_TEXT_ADDR.exec(part);
+                            if (match) {
+                                data.address = [match[0].trim()];
                                 extracted = true;
-                                return ' ';
+                                remainder = part.slice(0, at) + ' ' + part.slice(at + match[0].length);
                             }
-                            return match;
-                        })
-                            .trim();
+                        }
+                        data.text[i] = remainder.trim();
                         if (extracted) {
                             break;
                         }

package/dist/esm/mime-funcs/index.js

@@ -76,7 +76,10 @@ export function encodeWord(data, mimeWordEncoding, maxLength) {
         });
     }
     else if (mimeWordEncoding === 'B') {
-        encodedStr = typeof data === 'string' ? data : base64.encode(data);
+        // the chunking loop below splits raw text and base64 encodes each part, so a
+        // Buffer goes in as its UTF-8 string: handing it the base64 of the whole input
+        // would encode the encoding itself and decode back to base64 text
+        encodedStr = typeof data === 'string' ? data : data.toString('utf-8');
         maxLength = maxLength ? Math.max(3, ((maxLength - (maxLength % 4)) / 4) * 3) : 0;
     }
     if (maxLength && (mimeWordEncoding !== 'B' ? encodedStr : base64.encode(data)).length > maxLength) {

package/dist/esm/mime-node/index.js

@@ -61,6 +61,15 @@ function normalizeDomain(domain, toUnicode) {
     }
     return toUnicode ? punycode.toUnicode(domain) : punycode.toASCII(domain);
 }
+/**
+ * Removes the line breaks that would split a value across lines once it is written out.
+ *
+ * @param value Value to clean
+ * @return Value with every CR and LF removed
+ */
+function _stripLineBreaks(value) {
+    return value.replace(/[\r\n]+/g, '');
+}
 /**
  * Creates a new mime tree node. Assumes 'multipart/*' as the content type
  * if it is a branch, anything else counts as leaf. If rootNode is missing from
@@ -81,10 +90,12 @@ class MimeNode {
         this.nodeCounter = 0;
         options = options || {};
         /**
-         * shared part of the unique multipart boundary
+         * shared part of the unique multipart boundary. A line break here would split
+         * the delimiter lines the tree is streamed with, so the declared boundary could
+         * never match them again and the remainder would go out as body lines
          */
-        this.baseBoundary = options.baseBoundary || crypto.randomBytes(8).toString('hex');
-        this.boundaryPrefix = options.boundaryPrefix || '--_NmP';
+        this.baseBoundary = _stripLineBreaks(options.baseBoundary || crypto.randomBytes(8).toString('hex'));
+        this.boundaryPrefix = _stripLineBreaks(options.boundaryPrefix || '--_NmP');
         this.disableFileAccess = !!options.disableFileAccess;
         this.disableUrlAccess = !!options.disableUrlAccess;
         this.normalizeHeaderKey = options.normalizeHeaderKey;
@@ -1131,8 +1142,19 @@ class MimeNode {
         this.contentType = structured.value.trim().toLowerCase();
         this.multipart = /^multipart\//i.test(this.contentType) ? this.contentType.substr(this.contentType.indexOf('/') + 1) : false;
         if (this.multipart) {
-            this.boundary = structured.params.boundary =
-                structured.params.boundary || this.boundary || this._generateBoundary();
+            // A line break in the boundary would split the delimiter lines the tree is
+            // streamed with, so the declared boundary could never match them again and
+            // the remainder would go out as body lines. The declared value and the
+            // delimiters are assigned from the same expression here, so whatever the
+            // header emitter then does with it, the two sides cannot disagree.
+            //
+            // Stripping runs before the fallback rather than over the whole chain: a
+            // boundary that was nothing but line breaks would otherwise strip to '' and
+            // leave the node declaring no boundary and streaming bare '--' delimiters.
+            // The generated boundary is stripped too, since baseBoundary and
+            // boundaryPrefix are public and may have been written after construction.
+            const declared = _stripLineBreaks(structured.params.boundary || this.boundary || '');
+            this.boundary = structured.params.boundary = declared || _stripLineBreaks(this._generateBoundary());
         }
         else {
             this.boundary = false;

package/dist/esm/package-info.d.ts

@@ -1,3 +1,3 @@
 export declare const name = "nodemailer";
-export declare const version = "10.0.5";
+export declare const version = "10.0.7";
 export declare const homepage = "https://nodemailer.com/";

package/dist/esm/package-info.js

@@ -1,4 +1,4 @@
 // Generated by scripts/build.js from package.json. Do not edit by hand.
 export const name = 'nodemailer';
-export const version = '10.0.5';
+export const version = '10.0.7';
 export const homepage = 'https://nodemailer.com/';

package/dist/esm/smtp-pool/index.js

@@ -100,8 +100,10 @@ class SMTPPool extends EventEmitter {
         let connection;
         const len = this._connections.length;
         this._closed = true;
-        // clear rate limit timer if it exists
-        clearTimeout(this._rateLimit.timeout);
+        // release connections gated by the rate limiter so they become
+        // available and are torn down below instead of leaking with a
+        // cleared timer that never fires
+        this._clearRateLimit();
         if (!len && !this._queue.length) {
             return;
         }

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "nodemailer",
-    "version": "10.0.5",
+    "version": "10.0.7",
     "description": "Easy as cake e-mail sending from your Node.js applications",
     "type": "module",
     "main": "./dist/cjs/nodemailer.js",