nodemailer 10.1.0 → 10.1.2

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # CHANGELOG
 
+## [10.1.2](https://github.com/nodemailer/nodemailer/compare/v10.1.1...v10.1.2) (2026-10-16)
+
+
+### Bug Fixes
+
+* bound the work a message can make the mailer do and keep per-message auth off the transport's token endpoint ([e347fa2](https://github.com/nodemailer/nodemailer/commit/e347fa2260a7e342e772a7e187937aa87ac96364))
+
+## [10.1.1](https://github.com/nodemailer/nodemailer/compare/v10.1.0...v10.1.1) (2026-10-14)
+
+
+### Bug Fixes
+
+* **fetch:** strip credentials on any cross-origin redirect ([a15360c](https://github.com/nodemailer/nodemailer/commit/a15360cd2cd12e4670e96ab0b7290e8c862391cf))
+
 ## [10.1.0](https://github.com/nodemailer/nodemailer/compare/v10.0.16...v10.1.0) (2026-10-10)
 
 

package/SECURITY.md

@@ -1,7 +1,9 @@
 # Security Policy
 
-Nodemailer is a widely deployed, zero-dependency e-mail library. We take security
-reports seriously and aim to respond quickly.
+Nodemailer is a widely deployed, zero-dependency email library. We welcome
+responsible reports of vulnerabilities that present a credible security risk to
+users. Please distinguish security vulnerabilities from ordinary bugs, unusual
+edge cases, and hardening suggestions.
 
 ## Supported Versions
 
@@ -17,45 +19,119 @@ the supported way to receive security updates.
 If you are on an older major, please upgrade. See the migration notes at
 <https://nodemailer.com/> before updating.
 
-## Reporting a Vulnerability
+## What Qualifies as a Security Vulnerability
 
-**Please do not report security vulnerabilities through public GitHub issues,
-pull requests, or discussions.**
+A security report should identify a realistic way for an attacker to cross a
+security boundary in a supported version of Nodemailer. Unexpected behavior,
+a failing test, or a technically correct proof of concept is not sufficient on
+its own to establish security impact.
 
-Report privately through one of the following channels:
+In particular, explain:
 
-1. **GitHub Security Advisories (preferred).** Open a private report at
-   <https://github.com/nodemailer/nodemailer/security/advisories/new>. This keeps
-   the discussion private until a fix is published and lets us credit you.
-2. **Email.** Send details to **andris@reinman.eu** (the contact listed in
-   [`SECURITY.txt`](SECURITY.txt)). Encrypt sensitive details if possible.
+- **Attacker capabilities:** Who is the attacker, and what inputs, systems, or
+  responses can they control _without_ already having the privileges or secrets
+  they are trying to gain?
+- **Attack path:** How does attacker-controlled input reach the affected code
+  through a supported Nodemailer API or a realistic application integration?
+- **Prerequisites:** What configuration and user actions are required? If the
+  attack depends on unusual options or deliberately malformed input, explain
+  why those conditions could arise in a real application.
+- **Impact:** What confidentiality, integrity, or availability boundary is
+  crossed, and what can the attacker achieve as a result?
 
-When reporting, please include as much of the following as you can:
+A vulnerability involving an optional or less common feature can still qualify
+if these conditions are met. Conversely, the existence of a defensive check in
+the code does not, by itself, establish that every bypass of that check has a
+realistic security impact.
 
-- The affected version(s) and environment (Node.js version, OS).
-- The component involved (e.g. SMTP connection, address parsing, MIME/header
-  generation, DKIM).
-- A clear description of the issue and its impact (e.g. header/SMTP command
-  injection, information disclosure, DoS).
-- A minimal proof of concept or reproduction steps.
-- Any suggested remediation, if you have one.
+## Reporting a Vulnerability
 
-Nodemailer is maintained by a single person, so there is no guaranteed response
-time: sometimes reports are handled within hours, sometimes they take longer.
-Accepted issues are fixed in a new release and coordinated through a GitHub
-Security Advisory, and reporters who wish to be named are credited.
+**Do not disclose suspected exploitable vulnerabilities through public GitHub
+issues, pull requests, or discussions before coordinating with the maintainer.**
 
-## CVEs
+Report privately through one of the following channels:
 
-We track and disclose vulnerabilities through GitHub Security Advisories. We do
-not request or manage CVE identifiers ourselves. If you need a CVE assigned for a
-reported issue, please request one yourself, for example through GitHub's own
-CVE request flow on the published advisory, or another CNA.
+1. **GitHub Security Advisories (preferred):**
+   <https://github.com/nodemailer/nodemailer/security/advisories/new>.
+2. **Email:** **andris@reinman.eu**, as listed in
+   [`SECURITY.txt`](SECURITY.txt). Encrypt sensitive details if possible.
+
+### Required Information
+
+Please provide enough information to evaluate both the defect and its security
+impact. Reports should include:
+
+1. The affected Nodemailer version or commit, Node.js version, and relevant
+   configuration.
+2. A concise description of the issue and the affected public API or code path.
+3. A minimal, tested reproduction, including steps to run it, expected behavior,
+   and observed behavior.
+4. A concrete threat model: attacker control, prerequisites, trust boundary, and
+   resulting impact. Clearly distinguish what your reproduction proves from what
+   you believe might be possible.
+5. An explanation of why the issue affects applications beyond a deliberately
+   constructed test setup, where this is not obvious.
+
+A suggested fix is welcome but does not replace an explanation of exploitability.
+A complete real-world exploit is not always necessary, but the report must make
+a credible security impact clear.
+
+### Reports That May Be Treated as Ordinary Bugs
+
+The following generally do **not** qualify for private security handling unless
+you can demonstrate an additional, meaningful security boundary crossing:
+
+- Issues that require the attacker to control trusted application code,
+  administrator-only configuration, or the secret they supposedly extract.
+- Problems caused solely by application-level misuse, exposed credentials, or
+  insecure deployment choices outside Nodemailer's control.
+- Contrived proof-of-concept setups where the tester controls both sides of a
+  request, without explaining how a separate attacker could trigger the issue.
+- Parser quirks, unexpected behavior, and bypasses of internal checks with no
+  demonstrated security impact.
+- Speculative findings based only on static analysis or an automated tool's
+  assessment, without a verified reproduction and credible attack scenario.
+
+These may still be valid bugs and may be considered through the normal issue
+tracker. Please coordinate before making any potentially exploitable details
+public. Classification as a bug does not guarantee a fix or a particular
+priority.
+
+### Automated and AI-Assisted Reports
+
+Automated analysis and AI tools are welcome as research aids, but the person
+submitting a report is responsible for verifying its claims. **Do not submit
+bulk, unverified, or speculative AI-generated findings.** Test each finding
+against a supported release and establish the actual security impact. Reports
+that do not meet the requirements above may be closed without further
+investigation or individual feedback; they can be resubmitted with stronger
+evidence.
+
+## Triage and Disclosure
+
+Nodemailer is maintained by a single person, and there is **no guaranteed
+response or resolution time**. Reports are prioritized based on demonstrated
+impact, exploitability, affected usage, and available maintenance resources.
+
+A private report does not automatically become a security advisory. Confirmed
+vulnerabilities may be fixed and disclosed through GitHub Security Advisories;
+other findings may be closed, deferred, or handled as ordinary bugs. Please do
+not disclose details of an unresolved, potentially exploitable issue publicly
+without coordinating with the maintainer.
+
+## CVEs and Credit
+
+We do not request or manage CVE identifiers. A report being acknowledged, a bug
+being fixed, or a pull request being merged does **not** mean that Nodemailer
+has confirmed a security vulnerability or endorsed a CVE assignment. We do not
+guarantee advisories, CVE identifiers, or public credit for reports. For
+confirmed vulnerabilities disclosed through an advisory, substantive reporters
+may be credited if they wish.
 
 ## Scope
 
 In scope: the `nodemailer` package source in this repository: message and MIME
-generation, SMTP/LMTP client behaviour, address parsing, header handling, DKIM
+generation, SMTP/LMTP client behavior, address parsing, header handling, DKIM
 signing, and the bundled transports.
 
 Out of scope: vulnerabilities in your own application code, misconfiguration of

package/dist/cjs/dkim/index.js

@@ -133,8 +133,9 @@ class DKIMSigner {
     }
     createWriteCache() {
         this.output.usingCache = true;
-        // pipe remainings to cache file
-        this.cache = node_fs_1.default.createWriteStream(this.cachePath);
+        // pipe remainings to cache file. It holds the message body and cacheDir is often a
+        // shared directory such as /tmp, so nobody but the owner gets to read it
+        this.cache = node_fs_1.default.createWriteStream(this.cachePath, { mode: 0o600 });
         this.cache.once('error', err => {
             // drain input
             this.relaxedBody.unpipe(this.cache);

package/dist/cjs/fetch/index.d.ts

@@ -27,6 +27,8 @@ export interface FetchOptions {
     } | undefined;
     /** Socket inactivity timeout in milliseconds, defaults to 60000, 0 disables it */
     timeout?: number | undefined;
+    /** Time limit for the whole request in milliseconds, redirects included, defaults to 120000, 0 disables it */
+    maxTime?: number | undefined;
     /** Maximum size of the (decoded) response body in bytes, defaults to 64 MB, Infinity disables the limit */
     maxBytes?: number | undefined;
     /** Maximum number of redirects to follow (default 5) */
@@ -37,6 +39,8 @@ export interface FetchOptions {
     redirects?: number | undefined;
     /** Response stream shared across redirects, set by nmfetch itself */
     fetchRes?: FetchResponse | undefined;
+    /** Timestamp the whole request has to be done by, shared across redirects, set by nmfetch itself */
+    deadline?: number | undefined;
 }
 /**
  * The stream nmfetch returns. The response body is piped into it, the status code and
@@ -50,6 +54,7 @@ declare function nmfetch(url: string, options?: FetchOptions): FetchResponse;
 declare namespace nmfetch {
     var Cookies: typeof import("./cookies.js").default;
     var DEFAULT_TIMEOUT: number;
+    var DEFAULT_MAX_TIME: number;
 }
 type CookiesJar = Cookies;
 /**

package/dist/cjs/fetch/index.js

@@ -49,6 +49,10 @@ const objects_js_1 = require("../shared/objects.js");
 const MAX_REDIRECTS = 5;
 // a stalled server would otherwise hold the request, and whatever waits on it, open forever
 const DEFAULT_TIMEOUT = 60 * 1000;
+// the inactivity timeout above is reset by every byte, so a server dripping one within each
+// window could still hold the request, and the message being built from it, open for as
+// long as it liked. The whole request, redirects included, has to be done within this
+const DEFAULT_MAX_TIME = 2 * 60 * 1000;
 // the body is usually buffered in memory by the caller, so an unbounded download is refused
 const DEFAULT_MAX_BYTES = 64 * 1024 * 1024;
 // Only genuine TLS settings are taken from options.tls. That object reaches us straight
@@ -116,12 +120,22 @@ function parseFetchUrl(url) {
     }
     return parsed;
 }
+// the port a request to the URL goes to, explicit or the default of its scheme
+function fetchPort(parsed) {
+    return parsed.port ? Number(parsed.port) : parsed.protocol === 'https:' ? 443 : 80;
+}
 function nmfetch(url, options) {
     options = options || {};
     options.fetchRes = options.fetchRes || new node_stream_1.PassThrough();
     options.cookies = options.cookies || new cookies_js_1.default();
     options.redirects = options.redirects || 0;
     options.maxRedirects = isNaN(options.maxRedirects) ? MAX_REDIRECTS : options.maxRedirects;
+    if (!options.deadline) {
+        options.maxTime = typeof options.maxTime === 'number' && options.maxTime >= 0 ? options.maxTime : DEFAULT_MAX_TIME;
+        // the one deadline is shared with the requests the redirects lead to, every hop
+        // gets the time that is left rather than starting over
+        options.deadline = options.maxTime ? Date.now() + options.maxTime : 0;
+    }
     const fetchRes = options.fetchRes;
     const parsed = parseFetchUrl(url);
     if (!parsed) {
@@ -232,7 +246,7 @@ function nmfetch(url, options) {
         method,
         host: parsed.hostname,
         path: parsed.path,
-        port: parsed.port ? parsed.port : parsed.protocol === 'https:' ? 443 : 80,
+        port: fetchPort(parsed),
         headers,
         // Validate TLS certificates by default. Callers that genuinely need to
         // reach a self-signed/internal host opt out explicitly with
@@ -267,12 +281,22 @@ function nmfetch(url, options) {
         });
         return fetchRes;
     }
+    // the whole request has to be done by options.deadline, see maxTime. The timer is
+    // released on every way out of the request, so it never outlives it
+    let deadlineTimer;
+    const clearDeadline = () => {
+        if (deadlineTimer) {
+            clearTimeout(deadlineTimer);
+            deadlineTimer = undefined;
+        }
+    };
     // reports the first failure of this request on fetchRes and releases the request
     const fail = (err, sourceUrl = url) => {
         if (finished) {
             return;
         }
         finished = true;
+        clearDeadline();
         setFetchCode(err);
         err.sourceUrl = sourceUrl;
         fetchRes.emit('error', err);
@@ -282,10 +306,16 @@ function nmfetch(url, options) {
     if (timeout) {
         req.setTimeout(timeout, () => fail(new Error('Request Timeout')));
     }
+    if (options.deadline) {
+        deadlineTimer = setTimeout(() => fail(new Error('Request exceeded the allowed ' + options.maxTime + ' ms')), Math.max(options.deadline - Date.now(), 1));
+        // a pending deadline is no reason to keep the process alive
+        deadlineTimer.unref();
+    }
     req.on('error', (err) => fail(err));
     // a consumer that destroys the response stream before it ended does not want the rest of
     // the body, release the request now instead of when the timeout fires
     fetchRes.once('close', () => {
+        clearDeadline();
         if (finished || fetchRes.readableEnded) {
             return;
         }
@@ -334,17 +364,19 @@ function nmfetch(url, options) {
                 // the shared fetchRes once it times out. Callers listen with req.once().
                 return fail(new Error('Unsupported protocol for URL ' + redirectUrl), redirectUrl);
             }
-            // Do not forward credentials when the redirect leaves the original
-            // security context: a different host, or a downgrade from https to
-            // http (which would otherwise put them on the wire in cleartext).
-            // Strip sensitive request headers so an attacker who controls the
-            // redirect target cannot harvest them.
-            const crossHost = redirectParsed.hostname !== parsed.hostname;
-            const downgrade = parsed.protocol === 'https:' && redirectParsed.protocol === 'http:';
-            if (options.headers && (crossHost || downgrade)) {
+            // Do not forward credentials when the redirect leaves the origin: a different
+            // scheme, host or port is a different security context (an https to http
+            // downgrade would also put them on the wire in cleartext). Strip sensitive
+            // request headers so an attacker who controls the redirect target cannot
+            // harvest them.
+            const crossOrigin = redirectParsed.protocol !== parsed.protocol ||
+                redirectParsed.hostname !== parsed.hostname ||
+                fetchPort(redirectParsed) !== fetchPort(parsed);
+            if (options.headers && crossOrigin) {
                 const sensitive = ['authorization', 'cookie', 'proxy-authorization'];
                 Object.keys(options.headers).forEach(key => {
-                    if (sensitive.includes(key.toLowerCase())) {
+                    // normalized the way the request headers are built above, a padded name is sent too
+                    if (sensitive.includes(key.toLowerCase().trim())) {
                         delete options.headers[key];
                     }
                 });
@@ -352,6 +384,7 @@ function nmfetch(url, options) {
             // this request is done with, release it so its socket and timeout do not
             // outlive it and report a late error on the shared fetchRes
             finished = true;
+            clearDeadline();
             res.resume();
             req.abort();
             return nmfetch(redirectUrl, options);
@@ -362,6 +395,8 @@ function nmfetch(url, options) {
             return fail(new Error('Invalid status code ' + res.statusCode));
         }
         res.on('error', (err) => fail(err));
+        // the response is in, whatever is left of it is in memory and no longer on the network
+        res.once('end', () => clearDeadline());
         const maxBytes = typeof options.maxBytes === 'number' && options.maxBytes > 0 ? options.maxBytes : DEFAULT_MAX_BYTES;
         const source = inflate || res;
         let received = 0;
@@ -399,6 +434,7 @@ function nmfetch(url, options) {
 }
 nmfetch.Cookies = cookies_js_1.default;
 nmfetch.DEFAULT_TIMEOUT = DEFAULT_TIMEOUT;
+nmfetch.DEFAULT_MAX_TIME = DEFAULT_MAX_TIME;
 exports.default = nmfetch;
 module.exports = exports.default;
 Object.defineProperty(module.exports, 'default', { value: exports.default, enumerable: false, writable: true, configurable: true });

package/dist/cjs/mailer/index.js

@@ -398,9 +398,12 @@ class Mail extends node_events_1.EventEmitter {
                 return callback(err);
             }
             let cidCounter = 0;
+            // the media type is a bounded token: a quote, whitespace, '>' or '<' ends the
+            // attribute value and with it the type, so one img tag never scans ahead to a
+            // ';' that belongs to a later tag, which was quadratic
             html = (html || '')
                 .toString()
-                .replace(/(<img\b[^<>]{0,1024} src\s{0,20}=[\s"']{0,20})(data:([^;]+);[^"'>\s]+)/gi, (match, prefix, dataUri, mimeType) => {
+                .replace(/(<img\b[^<>]{0,1024} src\s{0,20}=[\s"']{0,20})(data:([^;"'<>\s]{1,255});[^"'>\s]+)/gi, (match, prefix, dataUri, mimeType) => {
                 const cid = node_crypto_1.default.randomBytes(10).toString('hex') + '@localhost';
                 if (!mail.data.attachments) {
                     mail.data.attachments = [];

package/dist/cjs/mailer/mail-message.d.ts

@@ -23,7 +23,11 @@ export interface SendMailOptions extends MailComposerOptions {
     dsn?: SMTPEnvelopeDsn | undefined;
     /** SMTP transports: RFC 8689, send the REQUIRETLS parameter with MAIL FROM */
     requireTLSExtensionEnabled?: boolean | undefined;
-    /** SMTP transports: per-message authentication settings, used instead of the transport level auth */
+    /**
+     * SMTP transports: per-message authentication settings, used instead of the transport level auth.
+     * Only the credential fields are taken from it (type, user, pass, accessToken, refreshToken, expires),
+     * the token endpoint and client settings stay those of the transport
+     */
     auth?: SMTPTransportAuthOptions | undefined;
     /** SES transport: extra SendEmailCommand parameters merged into the API call */
     ses?: SESSendEmailRequest | undefined;

package/dist/cjs/mime-funcs/index.js

@@ -186,26 +186,38 @@ function encodeWord(data, mimeWordEncoding, maxLength) {
  */
 function encodeWords(value, mimeWordEncoding, maxLength, encodeAll) {
     maxLength = maxLength || 0;
-    // find first word with a non-printable ascii or special symbol in it
-    const firstMatch = value.match(/(?:^|\s)([^\s]*["\u0080-\uFFFF])/);
-    if (!firstMatch) {
+    // find the first and the last character that needs encoding, a quote or anything outside
+    // printable ascii. A scan rather than a regex: matching the last such word with a
+    // backtracking pattern took quadratic time on a long word of non-ascii characters
+    let firstSpecial = -1;
+    let lastSpecial = -1;
+    for (let i = 0; i < value.length; i++) {
+        const code = value.charCodeAt(i);
+        if (code === 0x22 || code >= 0x80) {
+            if (firstSpecial < 0) {
+                firstSpecial = i;
+            }
+            lastSpecial = i;
+        }
+    }
+    if (firstSpecial < 0) {
         return value;
     }
     if (encodeAll) {
         // if it is requested to encode everything or the string contains something that resebles encoded word, then encode everything
         return encodeWord(value, mimeWordEncoding, maxLength);
     }
-    // find the last word with a non-printable ascii in it
-    const lastMatch = value.match(/(["\u0080-\uFFFF][^\s]*)[^"\u0080-\uFFFF]*$/);
-    if (!lastMatch) {
-        // should not happen
-        return value;
+    // encode from the start of the word holding the first such character to the end of the
+    // word holding the last one, so the encoded words stay separated from the plain text by
+    // the whitespace that was already there
+    let startIndex = firstSpecial;
+    while (startIndex > 0 && !/\s/.test(value.charAt(startIndex - 1))) {
+        startIndex--;
+    }
+    let endIndex = lastSpecial + 1;
+    while (endIndex < value.length && !/\s/.test(value.charAt(endIndex))) {
+        endIndex++;
     }
-    const startIndex = firstMatch.index +
-        (firstMatch[0].match(/[^\s]/) || {
-            index: 0
-        }).index;
-    const endIndex = lastMatch.index + (lastMatch[1] || '').length;
     return ((startIndex ? value.substr(0, startIndex) : '') +
         encodeWord(value.substring(startIndex, endIndex), mimeWordEncoding || 'Q', maxLength) +
         (endIndex < value.length ? value.substr(endIndex) : ''));

package/dist/cjs/mime-node/index.js

@@ -71,6 +71,13 @@ const PLAIN_ADDRESS = /^[^\s"(),:;<>@[\\\]]+@[^\s"(),:;<>@[\\\]]+$/;
 // unroutable garbage into mail for a domain the sender never named. None of these
 // characters are legal in a domain, so keep them away from the mapper.
 const URL_PARSER_UNSAFE = /[/\\?#%\x00-\x20\x7F]/;
+// RFC 1035 bounds a label at 63 octets and a domain at 253. An A-label is never shorter than
+// the code points it encodes, so anything past these bounds could not have become a valid
+// domain whichever way it is encoded. The bundled codec is super-linear in the length of a
+// label, a 60 KB label of distinct code points took seconds to encode, several times per
+// address, so it is only handed what could be a domain
+const MAX_DOMAIN_LENGTH = 253;
+const MAX_LABEL_LENGTH = 63;
 // pipeline() needs a callback to not throw, the errors it sees reach the last stream anyway
 const PIPELINE_NOOP = () => false;
 // The error a node streaming into an output that was destroyed stops with
@@ -79,6 +86,27 @@ function abortedError() {
     err.code = errors.ESTREAM;
     return err;
 }
+/**
+ * Checks a domain against the DNS length limits, counted in code points per label and in
+ * total. The label separators are the ones the bundled codec splits on.
+ *
+ * @param domain Domain to check
+ * @return true if a label or the domain as a whole is too long to be a valid domain
+ */
+function exceedsDomainLimits(domain) {
+    let total = 0;
+    let label = 0;
+    for (const char of domain) {
+        total++;
+        if (char === '.' || char === '。' || char === '．' || char === '｡') {
+            label = 0;
+        }
+        else if (++label > MAX_LABEL_LENGTH) {
+            return true;
+        }
+    }
+    return total > MAX_DOMAIN_LENGTH;
+}
 /**
  * Encodes a domain the way browsers, the WHATWG URL Standard and DNS facing resolvers do,
  * which is with UTS-46 mapping applied before the Punycode step.
@@ -110,6 +138,10 @@ function normalizeDomain(domain, toUnicode) {
             return mapped;
         }
     }
+    if (exceedsDomainLimits(domain)) {
+        // too long to be a domain whichever way it is encoded, keep it as supplied
+        return domain;
+    }
     return toUnicode ? punycode.toUnicode(domain) : punycode.toASCII(domain);
 }
 /**
@@ -614,6 +646,17 @@ class MimeNode {
                         /[\u0080-\uFFFF]/.test(this.content)) {
                         structured.params.charset = 'utf-8';
                     }
+                    if (this.filename) {
+                        // the name parameter is derived from the filename below, so a name that
+                        // arrived inside the content type is dropped first (a plain parameter or
+                        // rfc2231 continuation sections), otherwise the header carries two and a
+                        // receiver that reads the first sees a name the filename does not match
+                        for (const paramKey of Object.keys(structured.params)) {
+                            if (/^name(\*|$)/i.test(paramKey)) {
+                                delete structured.params[paramKey];
+                            }
+                        }
+                    }
                     value = mimeFuncs.buildHeaderValue(structured);
                     if (this.filename) {
                         // add support for non-compliant clients like QQ webmail
@@ -1223,12 +1266,12 @@ class MimeNode {
     _normalizeHeaderKey(key) {
         key = (key || '')
             .toString()
-            // no newlines in keys
-            .replace(/\r?\n|\r/g, ' ')
-            // a field name is printable ascii without the colon, so a control char or DEL
-            // can only be dropped, there is no quoting construct around a field name
-            .replace(/[\x00-\x1f\x7f]/g, '')
-            .trim()
+            // a field name is printable ascii without the colon, so a control char, DEL,
+            // whitespace or a colon can only be dropped, there is no quoting construct
+            // around a field name. A colon or a space left in place ends the name early on
+            // the wire: the key 'From: ceo@example.com (' with the value ')' was emitted as a
+            // second From header that neither setHeader() nor the Bcc filter could match
+            .replace(/[\s\x00-\x20\x7f:]/g, '')
             .toLowerCase()
             // use uppercase words, except MIME
             .replace(/^X-SMTPAPI$|^(MIME|DKIM|ARC|BIMI)\b|^[a-z]|-(SPF|FBL|ID|MD5)$|-[a-z]/gi, c => c.toUpperCase())

package/dist/cjs/package-info.d.ts

@@ -1,3 +1,3 @@
 export declare const name = "nodemailer";
-export declare const version = "10.1.0";
+export declare const version = "10.1.2";
 export declare const homepage = "https://nodemailer.com/";

package/dist/cjs/package-info.js

@@ -3,5 +3,5 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.homepage = exports.version = exports.name = void 0;
 exports.name = 'nodemailer';
-exports.version = '10.1.0';
+exports.version = '10.1.2';
 exports.homepage = 'https://nodemailer.com/';

package/dist/cjs/smtp-connection/index.js

@@ -114,6 +114,21 @@ function isPartialResponse(str) {
 function isPartialLine(line) {
     return /^\d+-/.test(line);
 }
+/**
+ * The log form of a command a custom authentication handler sends. Such a command carries
+ * the credentials in whatever shape its mechanism uses, so only an AUTH verb with its
+ * mechanism name is kept, the way the built-in mechanisms hide their own secrets.
+ *
+ * @param cmd Command the handler sends
+ * @return What the transaction log gets instead
+ */
+function maskAuthCommand(cmd) {
+    const match = (cmd || '').toString().match(/^AUTH\s+[^\s]+/i);
+    if (!match) {
+        return '/* secret */';
+    }
+    return match[0].length === cmd.length ? cmd : match[0] + ' /* secret */';
+}
 /**
  * Generates a SMTP connection object
  *
@@ -601,7 +616,7 @@ class SMTPConnection extends node_events_1.EventEmitter {
                     }
                     done(null, data);
                 });
-                setImmediate(() => this._sendCommand(cmd));
+                setImmediate(() => this._sendCommand(cmd, maskAuthCommand(cmd)));
                 return promise;
             };
             const handlerResponse = handler({

package/dist/cjs/smtp-transport/index.js

@@ -43,6 +43,13 @@ const shared = __importStar(require("../shared/index.js"));
 const index_js_3 = __importDefault(require("../xoauth2/index.js"));
 const errors = __importStar(require("../errors.js"));
 const packageData = __importStar(require("../package-info.js"));
+// The keys a message's `auth` may set on top of the transport's auth settings: the ones that
+// say who logs in and with what. Everything else in the auth block (accessUrl, clientId,
+// clientSecret, customHeaders, customParams, tls, privateKey, serviceClient and the rest)
+// names the endpoint the credentials go to or is a secret of the application itself, and
+// a message that could set `auth.accessUrl` and force a refresh would have the transport's
+// client secret and refresh token posted to a URL of its choosing
+const MESSAGE_AUTH_KEYS = ['type', 'user', 'pass', 'accessToken', 'refreshToken', 'expires'];
 /**
  * Creates a SMTP transport object for Nodemailer
  *
@@ -102,7 +109,11 @@ class SMTPTransport extends node_events_1.EventEmitter {
             }
             return this.auth;
         }
-        const authData = Object.assign({}, this.options.auth && typeof this.options.auth === 'object' ? this.options.auth : {}, typeof authOpts === 'object' ? authOpts : {});
+        const authData = Object.assign({}, this.options.auth && typeof this.options.auth === 'object' ? this.options.auth : {});
+        if (typeof authOpts === 'object') {
+            // see MESSAGE_AUTH_KEYS
+            shared.copyOwnKeys(authData, authOpts, key => !MESSAGE_AUTH_KEYS.includes(key));
+        }
         if (Object.keys(authData).length === 0) {
             return false;
         }

package/dist/cjs/well-known/services.js

@@ -363,6 +363,13 @@ exports.services = {
         "port": 587,
         "secure": false
     },
+    "Oveyon": {
+        "description": "Oveyon",
+        "host": "smtp.oveyon.com",
+        "port": 587,
+        "secure": false,
+        "requireTLS": true
+    },
     "Postmark": {
         "description": "Postmark",
         "aliases": [

package/dist/cjs/xoauth2/index.js

@@ -264,8 +264,14 @@ class XOAuth2 extends node_stream_1.Stream {
                 grant_type: 'refresh_token'
             };
         }
-        Object.assign(urlOptions, this.options.customParams);
-        Object.assign(loggedUrlOptions, this.options.customParams);
+        const customParams = this.options.customParams || {};
+        Object.assign(urlOptions, customParams);
+        // a custom param is as likely to be a client assertion or an API key as a tenant
+        // name, so the log gets the same glimpse of it that it gets of the client secret
+        for (const key of Object.keys(customParams)) {
+            const param = customParams[key];
+            loggedUrlOptions[key] = (param === undefined || param === null ? '' : String(param)).substr(0, 6) + '...';
+        }
         this.logger.debug({
             tnx: 'OAUTH2',
             user: this.options.user,

package/dist/esm/dkim/index.js

@@ -128,8 +128,9 @@ class DKIMSigner {
     }
     createWriteCache() {
         this.output.usingCache = true;
-        // pipe remainings to cache file
-        this.cache = fs.createWriteStream(this.cachePath);
+        // pipe remainings to cache file. It holds the message body and cacheDir is often a
+        // shared directory such as /tmp, so nobody but the owner gets to read it
+        this.cache = fs.createWriteStream(this.cachePath, { mode: 0o600 });
         this.cache.once('error', err => {
             // drain input
             this.relaxedBody.unpipe(this.cache);

package/dist/esm/fetch/index.d.ts

@@ -27,6 +27,8 @@ export interface FetchOptions {
     } | undefined;
     /** Socket inactivity timeout in milliseconds, defaults to 60000, 0 disables it */
     timeout?: number | undefined;
+    /** Time limit for the whole request in milliseconds, redirects included, defaults to 120000, 0 disables it */
+    maxTime?: number | undefined;
     /** Maximum size of the (decoded) response body in bytes, defaults to 64 MB, Infinity disables the limit */
     maxBytes?: number | undefined;
     /** Maximum number of redirects to follow (default 5) */
@@ -37,6 +39,8 @@ export interface FetchOptions {
     redirects?: number | undefined;
     /** Response stream shared across redirects, set by nmfetch itself */
     fetchRes?: FetchResponse | undefined;
+    /** Timestamp the whole request has to be done by, shared across redirects, set by nmfetch itself */
+    deadline?: number | undefined;
 }
 /**
  * The stream nmfetch returns. The response body is piped into it, the status code and
@@ -50,6 +54,7 @@ declare function nmfetch(url: string, options?: FetchOptions): FetchResponse;
 declare namespace nmfetch {
     var Cookies: typeof import("./cookies.js").default;
     var DEFAULT_TIMEOUT: number;
+    var DEFAULT_MAX_TIME: number;
 }
 type CookiesJar = Cookies;
 /**

package/dist/esm/fetch/index.js

@@ -11,6 +11,10 @@ import { isProtoKey } from '../shared/objects.js';
 const MAX_REDIRECTS = 5;
 // a stalled server would otherwise hold the request, and whatever waits on it, open forever
 const DEFAULT_TIMEOUT = 60 * 1000;
+// the inactivity timeout above is reset by every byte, so a server dripping one within each
+// window could still hold the request, and the message being built from it, open for as
+// long as it liked. The whole request, redirects included, has to be done within this
+const DEFAULT_MAX_TIME = 2 * 60 * 1000;
 // the body is usually buffered in memory by the caller, so an unbounded download is refused
 const DEFAULT_MAX_BYTES = 64 * 1024 * 1024;
 // Only genuine TLS settings are taken from options.tls. That object reaches us straight
@@ -78,12 +82,22 @@ function parseFetchUrl(url) {
     }
     return parsed;
 }
+// the port a request to the URL goes to, explicit or the default of its scheme
+function fetchPort(parsed) {
+    return parsed.port ? Number(parsed.port) : parsed.protocol === 'https:' ? 443 : 80;
+}
 function nmfetch(url, options) {
     options = options || {};
     options.fetchRes = options.fetchRes || new PassThrough();
     options.cookies = options.cookies || new Cookies();
     options.redirects = options.redirects || 0;
     options.maxRedirects = isNaN(options.maxRedirects) ? MAX_REDIRECTS : options.maxRedirects;
+    if (!options.deadline) {
+        options.maxTime = typeof options.maxTime === 'number' && options.maxTime >= 0 ? options.maxTime : DEFAULT_MAX_TIME;
+        // the one deadline is shared with the requests the redirects lead to, every hop
+        // gets the time that is left rather than starting over
+        options.deadline = options.maxTime ? Date.now() + options.maxTime : 0;
+    }
     const fetchRes = options.fetchRes;
     const parsed = parseFetchUrl(url);
     if (!parsed) {
@@ -194,7 +208,7 @@ function nmfetch(url, options) {
         method,
         host: parsed.hostname,
         path: parsed.path,
-        port: parsed.port ? parsed.port : parsed.protocol === 'https:' ? 443 : 80,
+        port: fetchPort(parsed),
         headers,
         // Validate TLS certificates by default. Callers that genuinely need to
         // reach a self-signed/internal host opt out explicitly with
@@ -229,12 +243,22 @@ function nmfetch(url, options) {
         });
         return fetchRes;
     }
+    // the whole request has to be done by options.deadline, see maxTime. The timer is
+    // released on every way out of the request, so it never outlives it
+    let deadlineTimer;
+    const clearDeadline = () => {
+        if (deadlineTimer) {
+            clearTimeout(deadlineTimer);
+            deadlineTimer = undefined;
+        }
+    };
     // reports the first failure of this request on fetchRes and releases the request
     const fail = (err, sourceUrl = url) => {
         if (finished) {
             return;
         }
         finished = true;
+        clearDeadline();
         setFetchCode(err);
         err.sourceUrl = sourceUrl;
         fetchRes.emit('error', err);
@@ -244,10 +268,16 @@ function nmfetch(url, options) {
     if (timeout) {
         req.setTimeout(timeout, () => fail(new Error('Request Timeout')));
     }
+    if (options.deadline) {
+        deadlineTimer = setTimeout(() => fail(new Error('Request exceeded the allowed ' + options.maxTime + ' ms')), Math.max(options.deadline - Date.now(), 1));
+        // a pending deadline is no reason to keep the process alive
+        deadlineTimer.unref();
+    }
     req.on('error', (err) => fail(err));
     // a consumer that destroys the response stream before it ended does not want the rest of
     // the body, release the request now instead of when the timeout fires
     fetchRes.once('close', () => {
+        clearDeadline();
         if (finished || fetchRes.readableEnded) {
             return;
         }
@@ -296,17 +326,19 @@ function nmfetch(url, options) {
                 // the shared fetchRes once it times out. Callers listen with req.once().
                 return fail(new Error('Unsupported protocol for URL ' + redirectUrl), redirectUrl);
             }
-            // Do not forward credentials when the redirect leaves the original
-            // security context: a different host, or a downgrade from https to
-            // http (which would otherwise put them on the wire in cleartext).
-            // Strip sensitive request headers so an attacker who controls the
-            // redirect target cannot harvest them.
-            const crossHost = redirectParsed.hostname !== parsed.hostname;
-            const downgrade = parsed.protocol === 'https:' && redirectParsed.protocol === 'http:';
-            if (options.headers && (crossHost || downgrade)) {
+            // Do not forward credentials when the redirect leaves the origin: a different
+            // scheme, host or port is a different security context (an https to http
+            // downgrade would also put them on the wire in cleartext). Strip sensitive
+            // request headers so an attacker who controls the redirect target cannot
+            // harvest them.
+            const crossOrigin = redirectParsed.protocol !== parsed.protocol ||
+                redirectParsed.hostname !== parsed.hostname ||
+                fetchPort(redirectParsed) !== fetchPort(parsed);
+            if (options.headers && crossOrigin) {
                 const sensitive = ['authorization', 'cookie', 'proxy-authorization'];
                 Object.keys(options.headers).forEach(key => {
-                    if (sensitive.includes(key.toLowerCase())) {
+                    // normalized the way the request headers are built above, a padded name is sent too
+                    if (sensitive.includes(key.toLowerCase().trim())) {
                         delete options.headers[key];
                     }
                 });
@@ -314,6 +346,7 @@ function nmfetch(url, options) {
             // this request is done with, release it so its socket and timeout do not
             // outlive it and report a late error on the shared fetchRes
             finished = true;
+            clearDeadline();
             res.resume();
             req.abort();
             return nmfetch(redirectUrl, options);
@@ -324,6 +357,8 @@ function nmfetch(url, options) {
             return fail(new Error('Invalid status code ' + res.statusCode));
         }
         res.on('error', (err) => fail(err));
+        // the response is in, whatever is left of it is in memory and no longer on the network
+        res.once('end', () => clearDeadline());
         const maxBytes = typeof options.maxBytes === 'number' && options.maxBytes > 0 ? options.maxBytes : DEFAULT_MAX_BYTES;
         const source = inflate || res;
         let received = 0;
@@ -361,4 +396,5 @@ function nmfetch(url, options) {
 }
 nmfetch.Cookies = Cookies;
 nmfetch.DEFAULT_TIMEOUT = DEFAULT_TIMEOUT;
+nmfetch.DEFAULT_MAX_TIME = DEFAULT_MAX_TIME;
 export default nmfetch;

package/dist/esm/mailer/index.js

@@ -360,9 +360,12 @@ class Mail extends EventEmitter {
                 return callback(err);
             }
             let cidCounter = 0;
+            // the media type is a bounded token: a quote, whitespace, '>' or '<' ends the
+            // attribute value and with it the type, so one img tag never scans ahead to a
+            // ';' that belongs to a later tag, which was quadratic
             html = (html || '')
                 .toString()
-                .replace(/(<img\b[^<>]{0,1024} src\s{0,20}=[\s"']{0,20})(data:([^;]+);[^"'>\s]+)/gi, (match, prefix, dataUri, mimeType) => {
+                .replace(/(<img\b[^<>]{0,1024} src\s{0,20}=[\s"']{0,20})(data:([^;"'<>\s]{1,255});[^"'>\s]+)/gi, (match, prefix, dataUri, mimeType) => {
                 const cid = crypto.randomBytes(10).toString('hex') + '@localhost';
                 if (!mail.data.attachments) {
                     mail.data.attachments = [];

package/dist/esm/mailer/mail-message.d.ts

@@ -23,7 +23,11 @@ export interface SendMailOptions extends MailComposerOptions {
     dsn?: SMTPEnvelopeDsn | undefined;
     /** SMTP transports: RFC 8689, send the REQUIRETLS parameter with MAIL FROM */
     requireTLSExtensionEnabled?: boolean | undefined;
-    /** SMTP transports: per-message authentication settings, used instead of the transport level auth */
+    /**
+     * SMTP transports: per-message authentication settings, used instead of the transport level auth.
+     * Only the credential fields are taken from it (type, user, pass, accessToken, refreshToken, expires),
+     * the token endpoint and client settings stay those of the transport
+     */
     auth?: SMTPTransportAuthOptions | undefined;
     /** SES transport: extra SendEmailCommand parameters merged into the API call */
     ses?: SESSendEmailRequest | undefined;

package/dist/esm/mime-funcs/index.js

@@ -137,26 +137,38 @@ export function encodeWord(data, mimeWordEncoding, maxLength) {
  */
 export function encodeWords(value, mimeWordEncoding, maxLength, encodeAll) {
     maxLength = maxLength || 0;
-    // find first word with a non-printable ascii or special symbol in it
-    const firstMatch = value.match(/(?:^|\s)([^\s]*["\u0080-\uFFFF])/);
-    if (!firstMatch) {
+    // find the first and the last character that needs encoding, a quote or anything outside
+    // printable ascii. A scan rather than a regex: matching the last such word with a
+    // backtracking pattern took quadratic time on a long word of non-ascii characters
+    let firstSpecial = -1;
+    let lastSpecial = -1;
+    for (let i = 0; i < value.length; i++) {
+        const code = value.charCodeAt(i);
+        if (code === 0x22 || code >= 0x80) {
+            if (firstSpecial < 0) {
+                firstSpecial = i;
+            }
+            lastSpecial = i;
+        }
+    }
+    if (firstSpecial < 0) {
         return value;
     }
     if (encodeAll) {
         // if it is requested to encode everything or the string contains something that resebles encoded word, then encode everything
         return encodeWord(value, mimeWordEncoding, maxLength);
     }
-    // find the last word with a non-printable ascii in it
-    const lastMatch = value.match(/(["\u0080-\uFFFF][^\s]*)[^"\u0080-\uFFFF]*$/);
-    if (!lastMatch) {
-        // should not happen
-        return value;
+    // encode from the start of the word holding the first such character to the end of the
+    // word holding the last one, so the encoded words stay separated from the plain text by
+    // the whitespace that was already there
+    let startIndex = firstSpecial;
+    while (startIndex > 0 && !/\s/.test(value.charAt(startIndex - 1))) {
+        startIndex--;
+    }
+    let endIndex = lastSpecial + 1;
+    while (endIndex < value.length && !/\s/.test(value.charAt(endIndex))) {
+        endIndex++;
     }
-    const startIndex = firstMatch.index +
-        (firstMatch[0].match(/[^\s]/) || {
-            index: 0
-        }).index;
-    const endIndex = lastMatch.index + (lastMatch[1] || '').length;
     return ((startIndex ? value.substr(0, startIndex) : '') +
         encodeWord(value.substring(startIndex, endIndex), mimeWordEncoding || 'Q', maxLength) +
         (endIndex < value.length ? value.substr(endIndex) : ''));

package/dist/esm/mime-node/index.js

@@ -33,6 +33,13 @@ const PLAIN_ADDRESS = /^[^\s"(),:;<>@[\\\]]+@[^\s"(),:;<>@[\\\]]+$/;
 // unroutable garbage into mail for a domain the sender never named. None of these
 // characters are legal in a domain, so keep them away from the mapper.
 const URL_PARSER_UNSAFE = /[/\\?#%\x00-\x20\x7F]/;
+// RFC 1035 bounds a label at 63 octets and a domain at 253. An A-label is never shorter than
+// the code points it encodes, so anything past these bounds could not have become a valid
+// domain whichever way it is encoded. The bundled codec is super-linear in the length of a
+// label, a 60 KB label of distinct code points took seconds to encode, several times per
+// address, so it is only handed what could be a domain
+const MAX_DOMAIN_LENGTH = 253;
+const MAX_LABEL_LENGTH = 63;
 // pipeline() needs a callback to not throw, the errors it sees reach the last stream anyway
 const PIPELINE_NOOP = () => false;
 // The error a node streaming into an output that was destroyed stops with
@@ -41,6 +48,27 @@ function abortedError() {
     err.code = errors.ESTREAM;
     return err;
 }
+/**
+ * Checks a domain against the DNS length limits, counted in code points per label and in
+ * total. The label separators are the ones the bundled codec splits on.
+ *
+ * @param domain Domain to check
+ * @return true if a label or the domain as a whole is too long to be a valid domain
+ */
+function exceedsDomainLimits(domain) {
+    let total = 0;
+    let label = 0;
+    for (const char of domain) {
+        total++;
+        if (char === '.' || char === '。' || char === '．' || char === '｡') {
+            label = 0;
+        }
+        else if (++label > MAX_LABEL_LENGTH) {
+            return true;
+        }
+    }
+    return total > MAX_DOMAIN_LENGTH;
+}
 /**
  * Encodes a domain the way browsers, the WHATWG URL Standard and DNS facing resolvers do,
  * which is with UTS-46 mapping applied before the Punycode step.
@@ -72,6 +100,10 @@ function normalizeDomain(domain, toUnicode) {
             return mapped;
         }
     }
+    if (exceedsDomainLimits(domain)) {
+        // too long to be a domain whichever way it is encoded, keep it as supplied
+        return domain;
+    }
     return toUnicode ? punycode.toUnicode(domain) : punycode.toASCII(domain);
 }
 /**
@@ -576,6 +608,17 @@ class MimeNode {
                         /[\u0080-\uFFFF]/.test(this.content)) {
                         structured.params.charset = 'utf-8';
                     }
+                    if (this.filename) {
+                        // the name parameter is derived from the filename below, so a name that
+                        // arrived inside the content type is dropped first (a plain parameter or
+                        // rfc2231 continuation sections), otherwise the header carries two and a
+                        // receiver that reads the first sees a name the filename does not match
+                        for (const paramKey of Object.keys(structured.params)) {
+                            if (/^name(\*|$)/i.test(paramKey)) {
+                                delete structured.params[paramKey];
+                            }
+                        }
+                    }
                     value = mimeFuncs.buildHeaderValue(structured);
                     if (this.filename) {
                         // add support for non-compliant clients like QQ webmail
@@ -1185,12 +1228,12 @@ class MimeNode {
     _normalizeHeaderKey(key) {
         key = (key || '')
             .toString()
-            // no newlines in keys
-            .replace(/\r?\n|\r/g, ' ')
-            // a field name is printable ascii without the colon, so a control char or DEL
-            // can only be dropped, there is no quoting construct around a field name
-            .replace(/[\x00-\x1f\x7f]/g, '')
-            .trim()
+            // a field name is printable ascii without the colon, so a control char, DEL,
+            // whitespace or a colon can only be dropped, there is no quoting construct
+            // around a field name. A colon or a space left in place ends the name early on
+            // the wire: the key 'From: ceo@example.com (' with the value ')' was emitted as a
+            // second From header that neither setHeader() nor the Bcc filter could match
+            .replace(/[\s\x00-\x20\x7f:]/g, '')
             .toLowerCase()
             // use uppercase words, except MIME
             .replace(/^X-SMTPAPI$|^(MIME|DKIM|ARC|BIMI)\b|^[a-z]|-(SPF|FBL|ID|MD5)$|-[a-z]/gi, c => c.toUpperCase())

package/dist/esm/package-info.d.ts

@@ -1,3 +1,3 @@
 export declare const name = "nodemailer";
-export declare const version = "10.1.0";
+export declare const version = "10.1.2";
 export declare const homepage = "https://nodemailer.com/";

package/dist/esm/package-info.js

@@ -1,4 +1,4 @@
 // Generated by scripts/build.js from package.json. Do not edit by hand.
 export const name = 'nodemailer';
-export const version = '10.1.0';
+export const version = '10.1.2';
 export const homepage = 'https://nodemailer.com/';

package/dist/esm/smtp-connection/index.js

@@ -76,6 +76,21 @@ function isPartialResponse(str) {
 function isPartialLine(line) {
     return /^\d+-/.test(line);
 }
+/**
+ * The log form of a command a custom authentication handler sends. Such a command carries
+ * the credentials in whatever shape its mechanism uses, so only an AUTH verb with its
+ * mechanism name is kept, the way the built-in mechanisms hide their own secrets.
+ *
+ * @param cmd Command the handler sends
+ * @return What the transaction log gets instead
+ */
+function maskAuthCommand(cmd) {
+    const match = (cmd || '').toString().match(/^AUTH\s+[^\s]+/i);
+    if (!match) {
+        return '/* secret */';
+    }
+    return match[0].length === cmd.length ? cmd : match[0] + ' /* secret */';
+}
 /**
  * Generates a SMTP connection object
  *
@@ -563,7 +578,7 @@ class SMTPConnection extends EventEmitter {
                     }
                     done(null, data);
                 });
-                setImmediate(() => this._sendCommand(cmd));
+                setImmediate(() => this._sendCommand(cmd, maskAuthCommand(cmd)));
                 return promise;
             };
             const handlerResponse = handler({

package/dist/esm/smtp-transport/index.js

@@ -5,6 +5,13 @@ import * as shared from '../shared/index.js';
 import XOAuth2 from '../xoauth2/index.js';
 import * as errors from '../errors.js';
 import * as packageData from '../package-info.js';
+// The keys a message's `auth` may set on top of the transport's auth settings: the ones that
+// say who logs in and with what. Everything else in the auth block (accessUrl, clientId,
+// clientSecret, customHeaders, customParams, tls, privateKey, serviceClient and the rest)
+// names the endpoint the credentials go to or is a secret of the application itself, and
+// a message that could set `auth.accessUrl` and force a refresh would have the transport's
+// client secret and refresh token posted to a URL of its choosing
+const MESSAGE_AUTH_KEYS = ['type', 'user', 'pass', 'accessToken', 'refreshToken', 'expires'];
 /**
  * Creates a SMTP transport object for Nodemailer
  *
@@ -64,7 +71,11 @@ class SMTPTransport extends EventEmitter {
             }
             return this.auth;
         }
-        const authData = Object.assign({}, this.options.auth && typeof this.options.auth === 'object' ? this.options.auth : {}, typeof authOpts === 'object' ? authOpts : {});
+        const authData = Object.assign({}, this.options.auth && typeof this.options.auth === 'object' ? this.options.auth : {});
+        if (typeof authOpts === 'object') {
+            // see MESSAGE_AUTH_KEYS
+            shared.copyOwnKeys(authData, authOpts, key => !MESSAGE_AUTH_KEYS.includes(key));
+        }
         if (Object.keys(authData).length === 0) {
             return false;
         }

package/dist/esm/well-known/services.js

@@ -360,6 +360,13 @@ export const services = {
         "port": 587,
         "secure": false
     },
+    "Oveyon": {
+        "description": "Oveyon",
+        "host": "smtp.oveyon.com",
+        "port": 587,
+        "secure": false,
+        "requireTLS": true
+    },
     "Postmark": {
         "description": "Postmark",
         "aliases": [

package/dist/esm/xoauth2/index.js

@@ -226,8 +226,14 @@ class XOAuth2 extends Stream {
                 grant_type: 'refresh_token'
             };
         }
-        Object.assign(urlOptions, this.options.customParams);
-        Object.assign(loggedUrlOptions, this.options.customParams);
+        const customParams = this.options.customParams || {};
+        Object.assign(urlOptions, customParams);
+        // a custom param is as likely to be a client assertion or an API key as a tenant
+        // name, so the log gets the same glimpse of it that it gets of the client secret
+        for (const key of Object.keys(customParams)) {
+            const param = customParams[key];
+            loggedUrlOptions[key] = (param === undefined || param === null ? '' : String(param)).substr(0, 6) + '...';
+        }
         this.logger.debug({
             tnx: 'OAUTH2',
             user: this.options.user,

package/dist/well-known/services.json

@@ -333,6 +333,14 @@
         "secure": false
     },
 
+    "Oveyon": {
+        "description": "Oveyon",
+        "host": "smtp.oveyon.com",
+        "port": 587,
+        "secure": false,
+        "requireTLS": true
+    },
+
     "Postmark": {
         "description": "Postmark",
         "aliases": ["PostmarkApp"],

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "nodemailer",
-    "version": "10.1.0",
+    "version": "10.1.2",
     "description": "Easy as cake e-mail sending from your Node.js applications",
     "type": "module",
     "main": "./dist/cjs/nodemailer.js",
@@ -151,7 +151,7 @@
     },
     "homepage": "https://nodemailer.com/",
     "devDependencies": {
-        "@aws-sdk/client-sesv2": "3.1146.0",
+        "@aws-sdk/client-sesv2": "3.1151.0",
         "@types/node": "20.19.43",
         "bunyan": "1.8.15",
         "c8": "12.0.0",
@@ -161,14 +161,14 @@
         "libbase64": "1.3.2",
         "libmime": "5.4.7",
         "libqp": "2.1.2",
-        "mailauth": "7.1.1",
-        "prettier": "3.9.9",
+        "mailauth": "7.3.0",
+        "prettier": "3.9.10",
         "proxy": "1.0.2",
         "proxy-test-server": "1.0.0",
-        "smtp-server": "3.19.17",
+        "smtp-server": "3.19.21",
         "tsx": "4.23.15",
         "typescript": "6.0.3",
-        "typescript-eslint": "8.71.1"
+        "typescript-eslint": "8.71.2"
     },
     "engines": {
         "node": ">=20.0.0"