nodemailer 10.0.7 → 10.0.9

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # CHANGELOG
 
+## [10.0.9](https://github.com/nodemailer/nodemailer/compare/v10.0.8...v10.0.9) (2026-09-12)
+
+
+### Bug Fixes
+
+* **addressparser:** bound the '@' probe to the run being scanned ([1465c3f](https://github.com/nodemailer/nodemailer/commit/1465c3f5ff74a7c4fbbe9853bd01448bb92bf5b7))
+* **addressparser:** keep the text after a comment out of a quoted local part address ([2f36eb1](https://github.com/nodemailer/nodemailer/commit/2f36eb1aa1dd33e312411dc9b888548e14db54ee))
+
+## [10.0.8](https://github.com/nodemailer/nodemailer/compare/v10.0.7...v10.0.8) (2026-09-11)
+
+
+### Bug Fixes
+
+* **mime-node:** clean the boundary where it is written, not only where it is built ([e14278d](https://github.com/nodemailer/nodemailer/commit/e14278d2dae9427280c79450605a27b1c5d2c355))
+* **mime-node:** drop every control character from multipart boundary material ([a82a355](https://github.com/nodemailer/nodemailer/commit/a82a35554848a2e07485ff81f80aefe2736e5a04))
+
 ## [10.0.7](https://github.com/nodemailer/nodemailer/compare/v10.0.6...v10.0.7) (2026-09-11)
 
 

package/dist/cjs/addressparser/index.js

@@ -88,6 +88,29 @@ function _isWordCode(code) {
 function _isBoundary(text, at) {
     return _isWordCode(text.charCodeAt(at - 1)) !== _isWordCode(text.charCodeAt(at));
 }
+/**
+ * Offset of the first '@' in `text` between `from` and `to`, or -1 when the range holds none.
+ *
+ * indexOf would scan on to the end of the value, and the value here is a whole header. The
+ * walk below steps one whitespace delimited run at a time and only ever uses a '@' that sits
+ * inside the run it is on, so an unbounded probe rescans everything behind that run once per
+ * run and grows with the square of the header: 400KB of free text carrying no '@' took a
+ * quarter of a second. GHSA-v53p-9fqp-m79j took the pattern search out of this walk and left
+ * the probe unbounded behind it.
+ *
+ * @param text Text to look in
+ * @param from Offset to start at
+ * @param to Offset to stop before
+ * @return Offset of the '@', or -1
+ */
+function _indexOfAt(text, from, to) {
+    for (let i = from; i < to; i++) {
+        if (text.charCodeAt(i) === 0x40) {
+            return i;
+        }
+    }
+    return -1;
+}
 /**
  * Finds the offset LOOSE_TEXT_ADDR matches at, or -1 when it does not match at all.
  *
@@ -118,8 +141,8 @@ function _looseAddressStart(text) {
         while (runEnd < len && !_isSpaceCode(text.charCodeAt(runEnd))) {
             runEnd++;
         }
-        let at = text.indexOf('@', runStart);
-        if (at >= 0 && at < runEnd) {
+        let at = _indexOfAt(text, runStart, runEnd);
+        if (at >= 0) {
             let lastBoundary = -1;
             for (let k = runEnd; k > runStart; k--) {
                 if (_isBoundary(text, k)) {
@@ -128,7 +151,7 @@ function _looseAddressStart(text) {
                 }
             }
             let atomStart = runStart;
-            while (lastBoundary >= 0 && at >= 0 && at < runEnd) {
+            while (lastBoundary >= 0 && at >= 0) {
                 // '[^@\s]+' has to cover a character before the '@' and '[^\s]+' one after it,
                 // and the boundary that ends the match has to sit past both
                 if (at > atomStart && runEnd > at + 1 && lastBoundary > at + 1) {
@@ -148,7 +171,7 @@ function _looseAddressStart(text) {
                     }
                 }
                 atomStart = at + 1;
-                at = text.indexOf('@', atomStart);
+                at = _indexOfAt(text, atomStart, runEnd);
             }
         }
         pos = runEnd;
@@ -275,6 +298,19 @@ function _handleAddress(tokens, depth) {
             }
         }
         else if (token.value) {
+            // An empty quoted string is dropped by the tokenizer, leaving no text token of its
+            // own for textWasQuoted to be recorded on, so the pair of quote operators right in
+            // front of this token is all that is left of it and the run it opens carries the
+            // quoting instead. Without this '""@example.com' reads as the bare '@example.com',
+            // the quotes never go back on, and the value is no longer an addr-spec a trailing
+            // comment can be peeled off of. It only ever opens a run: a run that already holds
+            // material collected outside the quotes is not a quoted string, whatever follows it
+            const prevPrevToken = i > 1 ? tokens[i - 2] : null;
+            const opensAfterEmptyQuotedString = prevToken?.type === 'operator' &&
+                prevToken.value === '"' &&
+                !!prevToken.noBreak &&
+                prevPrevToken?.type === 'operator' &&
+                prevPrevToken.value === '"';
             if (state === 'address') {
                 // Handle unquoted name that includes a "<".
                 // Apple Mail truncates everything between an unexpected < and an address.
@@ -302,7 +338,7 @@ function _handleAddress(tokens, depth) {
                 data[state].push(token.value);
                 lastChars[state] = token.value.charAt(token.value.length - 1);
                 if (state === 'text') {
-                    data.textWasQuoted.push(insideQuotes);
+                    data.textWasQuoted.push(insideQuotes || opensAfterEmptyQuotedString);
                 }
             }
         }
@@ -387,6 +423,18 @@ function _handleAddress(tokens, depth) {
         // Join values with spaces
         data.text = data.text.join(' ');
         data.address = data.address.join(' ');
+        if (addressFromQuotedText && data.text) {
+            // The mailbox is still sitting in the text, so it moves over here and is quoted
+            // before the recovery below rather than after it. Anything else the text holds
+            // came along with it: a comment ends the domain but leaves the atoms behind it in
+            // the same text, and '"user"@example.com(x)evil.com' was handed on as the address
+            // 'user@example.com evil.com', a second domain riding into the envelope recipient
+            // on a value that is no addr-spec at all (GHSA-g57g-f23g-4646). Putting the quotes
+            // back first is what lets the recovery tell the whitespace an addr-spec may carry
+            // from the wreckage trailing one, as only a quoted local part may hold whitespace
+            data.address = _quoteLocalPart(data.text);
+            data.text = '';
+        }
         _recoverAddrSpec(data);
         const address = {
             address: data.address || data.text || '',
@@ -400,9 +448,6 @@ function _handleAddress(tokens, depth) {
                 address.address = '';
             }
         }
-        if (addressFromQuotedText && address.address) {
-            address.address = _quoteLocalPart(address.address);
-        }
         addresses.push(address);
     }
     return addresses;

package/dist/cjs/mime-node/index.js

@@ -100,13 +100,21 @@ function normalizeDomain(domain, toUnicode) {
     return toUnicode ? punycode.toUnicode(domain) : punycode.toASCII(domain);
 }
 /**
- * Removes the line breaks that would split a value across lines once it is written out.
+ * Removes the characters that must never reach a multipart delimiter line.
+ *
+ * A line break splits the delimiter, so the boundary declared in the header can never
+ * match it again and the parts go out as body lines instead. The other C0 controls and
+ * DEL do not split anything but must not be written either: RFC 5321 does not allow a
+ * NUL in DATA at all, and an MTA or a scanner that stops at one reads a different
+ * message than a client that does not, which is the same parser disagreement a split
+ * delimiter creates. Both sides are cleaned together, since the declared value and the
+ * delimiters come from this one result.
  *
  * @param value Value to clean
- * @return Value with every CR and LF removed
+ * @return Value with every control character removed
  */
-function _stripLineBreaks(value) {
-    return value.replace(/[\r\n]+/g, '');
+function _stripBoundaryControls(value) {
+    return value.replace(/[\x00-\x1f\x7f]+/g, '');
 }
 /**
  * Creates a new mime tree node. Assumes 'multipart/*' as the content type
@@ -128,12 +136,11 @@ class MimeNode {
         this.nodeCounter = 0;
         options = options || {};
         /**
-         * shared part of the unique multipart boundary. A line break here would split
-         * the delimiter lines the tree is streamed with, so the declared boundary could
-         * never match them again and the remainder would go out as body lines
+         * shared part of the unique multipart boundary. Control characters are dropped
+         * here rather than at the delimiter, see _stripBoundaryControls
          */
-        this.baseBoundary = _stripLineBreaks(options.baseBoundary || node_crypto_1.default.randomBytes(8).toString('hex'));
-        this.boundaryPrefix = _stripLineBreaks(options.boundaryPrefix || '--_NmP');
+        this.baseBoundary = _stripBoundaryControls(options.baseBoundary || node_crypto_1.default.randomBytes(8).toString('hex'));
+        this.boundaryPrefix = _stripBoundaryControls(options.boundaryPrefix || '--_NmP');
         this.disableFileAccess = !!options.disableFileAccess;
         this.disableUrlAccess = !!options.disableUrlAccess;
         this.normalizeHeaderKey = options.normalizeHeaderKey;
@@ -1180,19 +1187,20 @@ class MimeNode {
         this.contentType = structured.value.trim().toLowerCase();
         this.multipart = /^multipart\//i.test(this.contentType) ? this.contentType.substr(this.contentType.indexOf('/') + 1) : false;
         if (this.multipart) {
-            // A line break in the boundary would split the delimiter lines the tree is
-            // streamed with, so the declared boundary could never match them again and
-            // the remainder would go out as body lines. The declared value and the
-            // delimiters are assigned from the same expression here, so whatever the
-            // header emitter then does with it, the two sides cannot disagree.
+            // The declared value and the delimiters are assigned from the same expression
+            // here, so whatever the header emitter then does with it, the two sides cannot
+            // disagree about which characters the boundary is made of.
             //
             // Stripping runs before the fallback rather than over the whole chain: a
-            // boundary that was nothing but line breaks would otherwise strip to '' and
+            // boundary made only of control characters would otherwise strip to '' and
             // leave the node declaring no boundary and streaming bare '--' delimiters.
-            // The generated boundary is stripped too, since baseBoundary and
-            // boundaryPrefix are public and may have been written after construction.
-            const declared = _stripLineBreaks(structured.params.boundary || this.boundary || '');
-            this.boundary = structured.params.boundary = declared || _stripLineBreaks(this._generateBoundary());
+            // _generateBoundary cleans what it builds, but this is the one place the boundary
+            // is written, so it cleans the value it is about to write rather than trusting
+            // where it came from. MimeNode is exported and subclassable, so the generator is
+            // not necessarily the one below. Stripping twice costs nothing, it is idempotent.
+            const declared = _stripBoundaryControls(structured.params.boundary || this.boundary || '');
+            this.boundary = structured.params.boundary =
+                declared || _stripBoundaryControls(this._generateBoundary());
         }
         else {
             this.boundary = false;
@@ -1205,7 +1213,9 @@ class MimeNode {
      * @internal
      */
     _generateBoundary() {
-        return this.rootNode.boundaryPrefix + '-' + this.rootNode.baseBoundary + '-Part_' + this._nodeId;
+        // baseBoundary and boundaryPrefix are public, so they may hold something the
+        // constructor never cleaned, and the -Part_ suffix keeps the result non empty
+        return _stripBoundaryControls(this.rootNode.boundaryPrefix + '-' + this.rootNode.baseBoundary) + '-Part_' + this._nodeId;
     }
     /**
      * Encodes a header value for use in the generated rfc2822 email.

package/dist/cjs/package-info.d.ts

@@ -1,3 +1,3 @@
 export declare const name = "nodemailer";
-export declare const version = "10.0.7";
+export declare const version = "10.0.9";
 export declare const homepage = "https://nodemailer.com/";

package/dist/cjs/package-info.js

@@ -3,5 +3,5 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.homepage = exports.version = exports.name = void 0;
 exports.name = 'nodemailer';
-exports.version = '10.0.7';
+exports.version = '10.0.9';
 exports.homepage = 'https://nodemailer.com/';

package/dist/esm/addressparser/index.js

@@ -85,6 +85,29 @@ function _isWordCode(code) {
 function _isBoundary(text, at) {
     return _isWordCode(text.charCodeAt(at - 1)) !== _isWordCode(text.charCodeAt(at));
 }
+/**
+ * Offset of the first '@' in `text` between `from` and `to`, or -1 when the range holds none.
+ *
+ * indexOf would scan on to the end of the value, and the value here is a whole header. The
+ * walk below steps one whitespace delimited run at a time and only ever uses a '@' that sits
+ * inside the run it is on, so an unbounded probe rescans everything behind that run once per
+ * run and grows with the square of the header: 400KB of free text carrying no '@' took a
+ * quarter of a second. GHSA-v53p-9fqp-m79j took the pattern search out of this walk and left
+ * the probe unbounded behind it.
+ *
+ * @param text Text to look in
+ * @param from Offset to start at
+ * @param to Offset to stop before
+ * @return Offset of the '@', or -1
+ */
+function _indexOfAt(text, from, to) {
+    for (let i = from; i < to; i++) {
+        if (text.charCodeAt(i) === 0x40) {
+            return i;
+        }
+    }
+    return -1;
+}
 /**
  * Finds the offset LOOSE_TEXT_ADDR matches at, or -1 when it does not match at all.
  *
@@ -115,8 +138,8 @@ function _looseAddressStart(text) {
         while (runEnd < len && !_isSpaceCode(text.charCodeAt(runEnd))) {
             runEnd++;
         }
-        let at = text.indexOf('@', runStart);
-        if (at >= 0 && at < runEnd) {
+        let at = _indexOfAt(text, runStart, runEnd);
+        if (at >= 0) {
             let lastBoundary = -1;
             for (let k = runEnd; k > runStart; k--) {
                 if (_isBoundary(text, k)) {
@@ -125,7 +148,7 @@ function _looseAddressStart(text) {
                 }
             }
             let atomStart = runStart;
-            while (lastBoundary >= 0 && at >= 0 && at < runEnd) {
+            while (lastBoundary >= 0 && at >= 0) {
                 // '[^@\s]+' has to cover a character before the '@' and '[^\s]+' one after it,
                 // and the boundary that ends the match has to sit past both
                 if (at > atomStart && runEnd > at + 1 && lastBoundary > at + 1) {
@@ -145,7 +168,7 @@ function _looseAddressStart(text) {
                     }
                 }
                 atomStart = at + 1;
-                at = text.indexOf('@', atomStart);
+                at = _indexOfAt(text, atomStart, runEnd);
             }
         }
         pos = runEnd;
@@ -272,6 +295,19 @@ function _handleAddress(tokens, depth) {
             }
         }
         else if (token.value) {
+            // An empty quoted string is dropped by the tokenizer, leaving no text token of its
+            // own for textWasQuoted to be recorded on, so the pair of quote operators right in
+            // front of this token is all that is left of it and the run it opens carries the
+            // quoting instead. Without this '""@example.com' reads as the bare '@example.com',
+            // the quotes never go back on, and the value is no longer an addr-spec a trailing
+            // comment can be peeled off of. It only ever opens a run: a run that already holds
+            // material collected outside the quotes is not a quoted string, whatever follows it
+            const prevPrevToken = i > 1 ? tokens[i - 2] : null;
+            const opensAfterEmptyQuotedString = prevToken?.type === 'operator' &&
+                prevToken.value === '"' &&
+                !!prevToken.noBreak &&
+                prevPrevToken?.type === 'operator' &&
+                prevPrevToken.value === '"';
             if (state === 'address') {
                 // Handle unquoted name that includes a "<".
                 // Apple Mail truncates everything between an unexpected < and an address.
@@ -299,7 +335,7 @@ function _handleAddress(tokens, depth) {
                 data[state].push(token.value);
                 lastChars[state] = token.value.charAt(token.value.length - 1);
                 if (state === 'text') {
-                    data.textWasQuoted.push(insideQuotes);
+                    data.textWasQuoted.push(insideQuotes || opensAfterEmptyQuotedString);
                 }
             }
         }
@@ -384,6 +420,18 @@ function _handleAddress(tokens, depth) {
         // Join values with spaces
         data.text = data.text.join(' ');
         data.address = data.address.join(' ');
+        if (addressFromQuotedText && data.text) {
+            // The mailbox is still sitting in the text, so it moves over here and is quoted
+            // before the recovery below rather than after it. Anything else the text holds
+            // came along with it: a comment ends the domain but leaves the atoms behind it in
+            // the same text, and '"user"@example.com(x)evil.com' was handed on as the address
+            // 'user@example.com evil.com', a second domain riding into the envelope recipient
+            // on a value that is no addr-spec at all (GHSA-g57g-f23g-4646). Putting the quotes
+            // back first is what lets the recovery tell the whitespace an addr-spec may carry
+            // from the wreckage trailing one, as only a quoted local part may hold whitespace
+            data.address = _quoteLocalPart(data.text);
+            data.text = '';
+        }
         _recoverAddrSpec(data);
         const address = {
             address: data.address || data.text || '',
@@ -397,9 +445,6 @@ function _handleAddress(tokens, depth) {
                 address.address = '';
             }
         }
-        if (addressFromQuotedText && address.address) {
-            address.address = _quoteLocalPart(address.address);
-        }
         addresses.push(address);
     }
     return addresses;

package/dist/esm/mime-node/index.js

@@ -62,13 +62,21 @@ function normalizeDomain(domain, toUnicode) {
     return toUnicode ? punycode.toUnicode(domain) : punycode.toASCII(domain);
 }
 /**
- * Removes the line breaks that would split a value across lines once it is written out.
+ * Removes the characters that must never reach a multipart delimiter line.
+ *
+ * A line break splits the delimiter, so the boundary declared in the header can never
+ * match it again and the parts go out as body lines instead. The other C0 controls and
+ * DEL do not split anything but must not be written either: RFC 5321 does not allow a
+ * NUL in DATA at all, and an MTA or a scanner that stops at one reads a different
+ * message than a client that does not, which is the same parser disagreement a split
+ * delimiter creates. Both sides are cleaned together, since the declared value and the
+ * delimiters come from this one result.
  *
  * @param value Value to clean
- * @return Value with every CR and LF removed
+ * @return Value with every control character removed
  */
-function _stripLineBreaks(value) {
-    return value.replace(/[\r\n]+/g, '');
+function _stripBoundaryControls(value) {
+    return value.replace(/[\x00-\x1f\x7f]+/g, '');
 }
 /**
  * Creates a new mime tree node. Assumes 'multipart/*' as the content type
@@ -90,12 +98,11 @@ class MimeNode {
         this.nodeCounter = 0;
         options = options || {};
         /**
-         * shared part of the unique multipart boundary. A line break here would split
-         * the delimiter lines the tree is streamed with, so the declared boundary could
-         * never match them again and the remainder would go out as body lines
+         * shared part of the unique multipart boundary. Control characters are dropped
+         * here rather than at the delimiter, see _stripBoundaryControls
          */
-        this.baseBoundary = _stripLineBreaks(options.baseBoundary || crypto.randomBytes(8).toString('hex'));
-        this.boundaryPrefix = _stripLineBreaks(options.boundaryPrefix || '--_NmP');
+        this.baseBoundary = _stripBoundaryControls(options.baseBoundary || crypto.randomBytes(8).toString('hex'));
+        this.boundaryPrefix = _stripBoundaryControls(options.boundaryPrefix || '--_NmP');
         this.disableFileAccess = !!options.disableFileAccess;
         this.disableUrlAccess = !!options.disableUrlAccess;
         this.normalizeHeaderKey = options.normalizeHeaderKey;
@@ -1142,19 +1149,20 @@ class MimeNode {
         this.contentType = structured.value.trim().toLowerCase();
         this.multipart = /^multipart\//i.test(this.contentType) ? this.contentType.substr(this.contentType.indexOf('/') + 1) : false;
         if (this.multipart) {
-            // A line break in the boundary would split the delimiter lines the tree is
-            // streamed with, so the declared boundary could never match them again and
-            // the remainder would go out as body lines. The declared value and the
-            // delimiters are assigned from the same expression here, so whatever the
-            // header emitter then does with it, the two sides cannot disagree.
+            // The declared value and the delimiters are assigned from the same expression
+            // here, so whatever the header emitter then does with it, the two sides cannot
+            // disagree about which characters the boundary is made of.
             //
             // Stripping runs before the fallback rather than over the whole chain: a
-            // boundary that was nothing but line breaks would otherwise strip to '' and
+            // boundary made only of control characters would otherwise strip to '' and
             // leave the node declaring no boundary and streaming bare '--' delimiters.
-            // The generated boundary is stripped too, since baseBoundary and
-            // boundaryPrefix are public and may have been written after construction.
-            const declared = _stripLineBreaks(structured.params.boundary || this.boundary || '');
-            this.boundary = structured.params.boundary = declared || _stripLineBreaks(this._generateBoundary());
+            // _generateBoundary cleans what it builds, but this is the one place the boundary
+            // is written, so it cleans the value it is about to write rather than trusting
+            // where it came from. MimeNode is exported and subclassable, so the generator is
+            // not necessarily the one below. Stripping twice costs nothing, it is idempotent.
+            const declared = _stripBoundaryControls(structured.params.boundary || this.boundary || '');
+            this.boundary = structured.params.boundary =
+                declared || _stripBoundaryControls(this._generateBoundary());
         }
         else {
             this.boundary = false;
@@ -1167,7 +1175,9 @@ class MimeNode {
      * @internal
      */
     _generateBoundary() {
-        return this.rootNode.boundaryPrefix + '-' + this.rootNode.baseBoundary + '-Part_' + this._nodeId;
+        // baseBoundary and boundaryPrefix are public, so they may hold something the
+        // constructor never cleaned, and the -Part_ suffix keeps the result non empty
+        return _stripBoundaryControls(this.rootNode.boundaryPrefix + '-' + this.rootNode.baseBoundary) + '-Part_' + this._nodeId;
     }
     /**
      * Encodes a header value for use in the generated rfc2822 email.

package/dist/esm/package-info.d.ts

@@ -1,3 +1,3 @@
 export declare const name = "nodemailer";
-export declare const version = "10.0.7";
+export declare const version = "10.0.9";
 export declare const homepage = "https://nodemailer.com/";

package/dist/esm/package-info.js

@@ -1,4 +1,4 @@
 // Generated by scripts/build.js from package.json. Do not edit by hand.
 export const name = 'nodemailer';
-export const version = '10.0.7';
+export const version = '10.0.9';
 export const homepage = 'https://nodemailer.com/';

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "nodemailer",
-    "version": "10.0.7",
+    "version": "10.0.9",
     "description": "Easy as cake e-mail sending from your Node.js applications",
     "type": "module",
     "main": "./dist/cjs/nodemailer.js",
@@ -147,24 +147,24 @@
     },
     "homepage": "https://nodemailer.com/",
     "devDependencies": {
-        "@aws-sdk/client-sesv2": "3.1124.0",
+        "@aws-sdk/client-sesv2": "3.1131.0",
         "@types/node": "20.19.43",
         "bunyan": "1.8.15",
         "c8": "12.0.0",
-        "eslint": "10.9.1",
+        "eslint": "10.10.0",
         "eslint-config-prettier": "10.1.8",
         "globals": "17.12.0",
         "libbase64": "1.3.0",
         "libmime": "5.4.3",
         "libqp": "2.1.1",
-        "mailauth": "5.0.2",
+        "mailauth": "5.0.3",
         "prettier": "3.9.6",
         "proxy": "1.0.2",
         "proxy-test-server": "1.0.0",
-        "smtp-server": "3.19.7",
+        "smtp-server": "3.19.11",
         "tsx": "4.23.13",
         "typescript": "6.0.3",
-        "typescript-eslint": "8.69.0"
+        "typescript-eslint": "8.70.0"
     },
     "engines": {
         "node": ">=20.0.0"