nodemailer 10.0.6 → 10.0.8

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # CHANGELOG
 
+## [10.0.8](https://github.com/nodemailer/nodemailer/compare/v10.0.7...v10.0.8) (2026-09-11)
+
+
+### Bug Fixes
+
+* **mime-node:** clean the boundary where it is written, not only where it is built ([e14278d](https://github.com/nodemailer/nodemailer/commit/e14278d2dae9427280c79450605a27b1c5d2c355))
+* **mime-node:** drop every control character from multipart boundary material ([a82a355](https://github.com/nodemailer/nodemailer/commit/a82a35554848a2e07485ff81f80aefe2736e5a04))
+
+## [10.0.7](https://github.com/nodemailer/nodemailer/compare/v10.0.6...v10.0.7) (2026-09-11)
+
+
+### Bug Fixes
+
+* **mime-funcs:** do not double encode Buffer input when chunking base64 mime words ([#1865](https://github.com/nodemailer/nodemailer/issues/1865)) ([4327a59](https://github.com/nodemailer/nodemailer/commit/4327a59939748a7f9394b0a029495fd476f68f30))
+* **mime-node:** keep a boundary that is only line breaks from stripping to empty ([ec46800](https://github.com/nodemailer/nodemailer/commit/ec46800cdcab734d9aa79e1278e819962b3b8f09))
+* **mime-node:** strip line breaks from multipart boundary material ([#1867](https://github.com/nodemailer/nodemailer/issues/1867)) ([03c1a5c](https://github.com/nodemailer/nodemailer/commit/03c1a5c48b6828d9392983d8718fdb1fd583a06c))
+* **smtp-pool:** release rate-limited connections on close ([#1866](https://github.com/nodemailer/nodemailer/issues/1866)) ([7f5c7a4](https://github.com/nodemailer/nodemailer/commit/7f5c7a46b61da9f5c5feaffd921c55b9d5892ee5))
+
 ## [10.0.6](https://github.com/nodemailer/nodemailer/compare/v10.0.5...v10.0.6) (2026-09-11)
 
 

package/dist/cjs/mime-funcs/index.js

@@ -125,7 +125,10 @@ function encodeWord(data, mimeWordEncoding, maxLength) {
         });
     }
     else if (mimeWordEncoding === 'B') {
-        encodedStr = typeof data === 'string' ? data : base64.encode(data);
+        // the chunking loop below splits raw text and base64 encodes each part, so a
+        // Buffer goes in as its UTF-8 string: handing it the base64 of the whole input
+        // would encode the encoding itself and decode back to base64 text
+        encodedStr = typeof data === 'string' ? data : data.toString('utf-8');
         maxLength = maxLength ? Math.max(3, ((maxLength - (maxLength % 4)) / 4) * 3) : 0;
     }
     if (maxLength && (mimeWordEncoding !== 'B' ? encodedStr : base64.encode(data)).length > maxLength) {

package/dist/cjs/mime-node/index.js

@@ -99,6 +99,23 @@ function normalizeDomain(domain, toUnicode) {
     }
     return toUnicode ? punycode.toUnicode(domain) : punycode.toASCII(domain);
 }
+/**
+ * Removes the characters that must never reach a multipart delimiter line.
+ *
+ * A line break splits the delimiter, so the boundary declared in the header can never
+ * match it again and the parts go out as body lines instead. The other C0 controls and
+ * DEL do not split anything but must not be written either: RFC 5321 does not allow a
+ * NUL in DATA at all, and an MTA or a scanner that stops at one reads a different
+ * message than a client that does not, which is the same parser disagreement a split
+ * delimiter creates. Both sides are cleaned together, since the declared value and the
+ * delimiters come from this one result.
+ *
+ * @param value Value to clean
+ * @return Value with every control character removed
+ */
+function _stripBoundaryControls(value) {
+    return value.replace(/[\x00-\x1f\x7f]+/g, '');
+}
 /**
  * Creates a new mime tree node. Assumes 'multipart/*' as the content type
  * if it is a branch, anything else counts as leaf. If rootNode is missing from
@@ -119,10 +136,11 @@ class MimeNode {
         this.nodeCounter = 0;
         options = options || {};
         /**
-         * shared part of the unique multipart boundary
+         * shared part of the unique multipart boundary. Control characters are dropped
+         * here rather than at the delimiter, see _stripBoundaryControls
          */
-        this.baseBoundary = options.baseBoundary || node_crypto_1.default.randomBytes(8).toString('hex');
-        this.boundaryPrefix = options.boundaryPrefix || '--_NmP';
+        this.baseBoundary = _stripBoundaryControls(options.baseBoundary || node_crypto_1.default.randomBytes(8).toString('hex'));
+        this.boundaryPrefix = _stripBoundaryControls(options.boundaryPrefix || '--_NmP');
         this.disableFileAccess = !!options.disableFileAccess;
         this.disableUrlAccess = !!options.disableUrlAccess;
         this.normalizeHeaderKey = options.normalizeHeaderKey;
@@ -1169,8 +1187,20 @@ class MimeNode {
         this.contentType = structured.value.trim().toLowerCase();
         this.multipart = /^multipart\//i.test(this.contentType) ? this.contentType.substr(this.contentType.indexOf('/') + 1) : false;
         if (this.multipart) {
+            // The declared value and the delimiters are assigned from the same expression
+            // here, so whatever the header emitter then does with it, the two sides cannot
+            // disagree about which characters the boundary is made of.
+            //
+            // Stripping runs before the fallback rather than over the whole chain: a
+            // boundary made only of control characters would otherwise strip to '' and
+            // leave the node declaring no boundary and streaming bare '--' delimiters.
+            // _generateBoundary cleans what it builds, but this is the one place the boundary
+            // is written, so it cleans the value it is about to write rather than trusting
+            // where it came from. MimeNode is exported and subclassable, so the generator is
+            // not necessarily the one below. Stripping twice costs nothing, it is idempotent.
+            const declared = _stripBoundaryControls(structured.params.boundary || this.boundary || '');
             this.boundary = structured.params.boundary =
-                structured.params.boundary || this.boundary || this._generateBoundary();
+                declared || _stripBoundaryControls(this._generateBoundary());
         }
         else {
             this.boundary = false;
@@ -1183,7 +1213,9 @@ class MimeNode {
      * @internal
      */
     _generateBoundary() {
-        return this.rootNode.boundaryPrefix + '-' + this.rootNode.baseBoundary + '-Part_' + this._nodeId;
+        // baseBoundary and boundaryPrefix are public, so they may hold something the
+        // constructor never cleaned, and the -Part_ suffix keeps the result non empty
+        return _stripBoundaryControls(this.rootNode.boundaryPrefix + '-' + this.rootNode.baseBoundary) + '-Part_' + this._nodeId;
     }
     /**
      * Encodes a header value for use in the generated rfc2822 email.

package/dist/cjs/package-info.d.ts

@@ -1,3 +1,3 @@
 export declare const name = "nodemailer";
-export declare const version = "10.0.6";
+export declare const version = "10.0.8";
 export declare const homepage = "https://nodemailer.com/";

package/dist/cjs/package-info.js

@@ -3,5 +3,5 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.homepage = exports.version = exports.name = void 0;
 exports.name = 'nodemailer';
-exports.version = '10.0.6';
+exports.version = '10.0.8';
 exports.homepage = 'https://nodemailer.com/';

package/dist/cjs/smtp-pool/index.js

@@ -138,8 +138,10 @@ class SMTPPool extends node_events_1.EventEmitter {
         let connection;
         const len = this._connections.length;
         this._closed = true;
-        // clear rate limit timer if it exists
-        clearTimeout(this._rateLimit.timeout);
+        // release connections gated by the rate limiter so they become
+        // available and are torn down below instead of leaking with a
+        // cleared timer that never fires
+        this._clearRateLimit();
         if (!len && !this._queue.length) {
             return;
         }

package/dist/esm/mime-funcs/index.js

@@ -76,7 +76,10 @@ export function encodeWord(data, mimeWordEncoding, maxLength) {
         });
     }
     else if (mimeWordEncoding === 'B') {
-        encodedStr = typeof data === 'string' ? data : base64.encode(data);
+        // the chunking loop below splits raw text and base64 encodes each part, so a
+        // Buffer goes in as its UTF-8 string: handing it the base64 of the whole input
+        // would encode the encoding itself and decode back to base64 text
+        encodedStr = typeof data === 'string' ? data : data.toString('utf-8');
         maxLength = maxLength ? Math.max(3, ((maxLength - (maxLength % 4)) / 4) * 3) : 0;
     }
     if (maxLength && (mimeWordEncoding !== 'B' ? encodedStr : base64.encode(data)).length > maxLength) {

package/dist/esm/mime-node/index.js

@@ -61,6 +61,23 @@ function normalizeDomain(domain, toUnicode) {
     }
     return toUnicode ? punycode.toUnicode(domain) : punycode.toASCII(domain);
 }
+/**
+ * Removes the characters that must never reach a multipart delimiter line.
+ *
+ * A line break splits the delimiter, so the boundary declared in the header can never
+ * match it again and the parts go out as body lines instead. The other C0 controls and
+ * DEL do not split anything but must not be written either: RFC 5321 does not allow a
+ * NUL in DATA at all, and an MTA or a scanner that stops at one reads a different
+ * message than a client that does not, which is the same parser disagreement a split
+ * delimiter creates. Both sides are cleaned together, since the declared value and the
+ * delimiters come from this one result.
+ *
+ * @param value Value to clean
+ * @return Value with every control character removed
+ */
+function _stripBoundaryControls(value) {
+    return value.replace(/[\x00-\x1f\x7f]+/g, '');
+}
 /**
  * Creates a new mime tree node. Assumes 'multipart/*' as the content type
  * if it is a branch, anything else counts as leaf. If rootNode is missing from
@@ -81,10 +98,11 @@ class MimeNode {
         this.nodeCounter = 0;
         options = options || {};
         /**
-         * shared part of the unique multipart boundary
+         * shared part of the unique multipart boundary. Control characters are dropped
+         * here rather than at the delimiter, see _stripBoundaryControls
          */
-        this.baseBoundary = options.baseBoundary || crypto.randomBytes(8).toString('hex');
-        this.boundaryPrefix = options.boundaryPrefix || '--_NmP';
+        this.baseBoundary = _stripBoundaryControls(options.baseBoundary || crypto.randomBytes(8).toString('hex'));
+        this.boundaryPrefix = _stripBoundaryControls(options.boundaryPrefix || '--_NmP');
         this.disableFileAccess = !!options.disableFileAccess;
         this.disableUrlAccess = !!options.disableUrlAccess;
         this.normalizeHeaderKey = options.normalizeHeaderKey;
@@ -1131,8 +1149,20 @@ class MimeNode {
         this.contentType = structured.value.trim().toLowerCase();
         this.multipart = /^multipart\//i.test(this.contentType) ? this.contentType.substr(this.contentType.indexOf('/') + 1) : false;
         if (this.multipart) {
+            // The declared value and the delimiters are assigned from the same expression
+            // here, so whatever the header emitter then does with it, the two sides cannot
+            // disagree about which characters the boundary is made of.
+            //
+            // Stripping runs before the fallback rather than over the whole chain: a
+            // boundary made only of control characters would otherwise strip to '' and
+            // leave the node declaring no boundary and streaming bare '--' delimiters.
+            // _generateBoundary cleans what it builds, but this is the one place the boundary
+            // is written, so it cleans the value it is about to write rather than trusting
+            // where it came from. MimeNode is exported and subclassable, so the generator is
+            // not necessarily the one below. Stripping twice costs nothing, it is idempotent.
+            const declared = _stripBoundaryControls(structured.params.boundary || this.boundary || '');
             this.boundary = structured.params.boundary =
-                structured.params.boundary || this.boundary || this._generateBoundary();
+                declared || _stripBoundaryControls(this._generateBoundary());
         }
         else {
             this.boundary = false;
@@ -1145,7 +1175,9 @@ class MimeNode {
      * @internal
      */
     _generateBoundary() {
-        return this.rootNode.boundaryPrefix + '-' + this.rootNode.baseBoundary + '-Part_' + this._nodeId;
+        // baseBoundary and boundaryPrefix are public, so they may hold something the
+        // constructor never cleaned, and the -Part_ suffix keeps the result non empty
+        return _stripBoundaryControls(this.rootNode.boundaryPrefix + '-' + this.rootNode.baseBoundary) + '-Part_' + this._nodeId;
     }
     /**
      * Encodes a header value for use in the generated rfc2822 email.

package/dist/esm/package-info.d.ts

@@ -1,3 +1,3 @@
 export declare const name = "nodemailer";
-export declare const version = "10.0.6";
+export declare const version = "10.0.8";
 export declare const homepage = "https://nodemailer.com/";

package/dist/esm/package-info.js

@@ -1,4 +1,4 @@
 // Generated by scripts/build.js from package.json. Do not edit by hand.
 export const name = 'nodemailer';
-export const version = '10.0.6';
+export const version = '10.0.8';
 export const homepage = 'https://nodemailer.com/';

package/dist/esm/smtp-pool/index.js

@@ -100,8 +100,10 @@ class SMTPPool extends EventEmitter {
         let connection;
         const len = this._connections.length;
         this._closed = true;
-        // clear rate limit timer if it exists
-        clearTimeout(this._rateLimit.timeout);
+        // release connections gated by the rate limiter so they become
+        // available and are torn down below instead of leaking with a
+        // cleared timer that never fires
+        this._clearRateLimit();
         if (!len && !this._queue.length) {
             return;
         }

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "nodemailer",
-    "version": "10.0.6",
+    "version": "10.0.8",
     "description": "Easy as cake e-mail sending from your Node.js applications",
     "type": "module",
     "main": "./dist/cjs/nodemailer.js",