nodemailer 7.0.5 → 7.0.6

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # CHANGELOG
 
+## [7.0.6](https://github.com/nodemailer/nodemailer/compare/v7.0.5...v7.0.6) (2025-08-27)
+
+
+### Bug Fixes
+
+* **encoder:** avoid silent data loss by properly flushing trailing base64 ([#1747](https://github.com/nodemailer/nodemailer/issues/1747)) ([01ae76f](https://github.com/nodemailer/nodemailer/commit/01ae76f2cfe991c0c3fe80170f236da60531496b))
+* handle multiple XOAUTH2 token requests correctly ([#1754](https://github.com/nodemailer/nodemailer/issues/1754)) ([dbe0028](https://github.com/nodemailer/nodemailer/commit/dbe00286351cddf012726a41a96ae613d30a34ee))
+* ReDoS vulnerability in parseDataURI and _processDataUrl ([#1755](https://github.com/nodemailer/nodemailer/issues/1755)) ([90b3e24](https://github.com/nodemailer/nodemailer/commit/90b3e24d23929ebf9f4e16261049b40ee4055a39))
+
 ## [7.0.5](https://github.com/nodemailer/nodemailer/compare/v7.0.4...v7.0.5) (2025-07-07)
 
 

package/lib/base64/index.js

@@ -35,15 +35,12 @@ function wrap(str, lineLength) {
     let pos = 0;
     let chunkLength = lineLength * 1024;
     while (pos < str.length) {
-        let wrappedLines = str
-            .substr(pos, chunkLength)
-            .replace(new RegExp('.{' + lineLength + '}', 'g'), '$&\r\n')
-            .trim();
+        let wrappedLines = str.substr(pos, chunkLength).replace(new RegExp('.{' + lineLength + '}', 'g'), '$&\r\n');
         result.push(wrappedLines);
         pos += chunkLength;
     }
 
-    return result.join('\r\n').trim();
+    return result.join('');
 }
 
 /**
@@ -56,7 +53,6 @@ function wrap(str, lineLength) {
 class Encoder extends Transform {
     constructor(options) {
         super();
-        // init Transform
         this.options = options || {};
 
         if (this.options.lineLength !== false) {
@@ -98,17 +94,20 @@ class Encoder extends Transform {
         if (this.options.lineLength) {
             b64 = wrap(b64, this.options.lineLength);
 
-            // remove last line as it is still most probably incomplete
             let lastLF = b64.lastIndexOf('\n');
             if (lastLF < 0) {
                 this._curLine = b64;
                 b64 = '';
-            } else if (lastLF === b64.length - 1) {
-                this._curLine = '';
             } else {
-                this._curLine = b64.substr(lastLF + 1);
-                b64 = b64.substr(0, lastLF + 1);
+                this._curLine = b64.substring(lastLF + 1);
+                b64 = b64.substring(0, lastLF + 1);
+
+                if (b64 && !b64.endsWith('\r\n')) {
+                    b64 += '\r\n';
+                }
             }
+        } else {
+            this._curLine = '';
         }
 
         if (b64) {
@@ -125,16 +124,14 @@ class Encoder extends Transform {
         }
 
         if (this._curLine) {
-            this._curLine = wrap(this._curLine, this.options.lineLength);
             this.outputBytes += this._curLine.length;
-            this.push(this._curLine, 'ascii');
+            this.push(Buffer.from(this._curLine, 'ascii'));
             this._curLine = '';
         }
         done();
     }
 }
 
-// expose to the world
 module.exports = {
     encode,
     wrap,

package/lib/mail-composer/index.js

@@ -550,9 +550,33 @@ class MailComposer {
      * @return {Object} Parsed element
      */
     _processDataUrl(element) {
+        const dataUrl = element.path || element.href;
+
+        // Early validation to prevent ReDoS
+        if (!dataUrl || typeof dataUrl !== 'string') {
+            return element;
+        }
+
+        if (!dataUrl.startsWith('data:')) {
+            return element;
+        }
+
+        if (dataUrl.length > 100000) {
+            // 100KB limit for data URL string
+            // Return empty content for excessively long data URLs
+            return Object.assign({}, element, {
+                path: false,
+                href: false,
+                content: Buffer.alloc(0),
+                contentType: element.contentType || 'application/octet-stream'
+            });
+        }
+
         let parsedDataUri;
-        if ((element.path || element.href).match(/^data:/)) {
-            parsedDataUri = parseDataURI(element.path || element.href);
+        try {
+            parsedDataUri = parseDataURI(dataUrl);
+        } catch (err) {
+            return element;
         }
 
         if (!parsedDataUri) {

package/lib/mime-funcs/index.js

@@ -269,7 +269,7 @@ module.exports = {
 
             // first line includes the charset and language info and needs to be encoded
             // even if it does not contain any unicode characters
-            line = 'utf-8\x27\x27';
+            line = "utf-8''";
             let encoded = true;
             startPos = 0;
 

package/lib/shared/index.js

@@ -419,52 +419,74 @@ module.exports.callbackPromise = (resolve, reject) =>
     };
 
 module.exports.parseDataURI = uri => {
-    let input = uri;
-    let commaPos = input.indexOf(',');
-    if (!commaPos) {
-        return uri;
+    if (typeof uri !== 'string') {
+        return null;
     }
 
-    let data = input.substring(commaPos + 1);
-    let metaStr = input.substring('data:'.length, commaPos);
+    // Early return for non-data URIs to avoid unnecessary processing
+    if (!uri.startsWith('data:')) {
+        return null;
+    }
 
-    let encoding;
+    // Find the first comma safely - this prevents ReDoS
+    const commaPos = uri.indexOf(',');
+    if (commaPos === -1) {
+        return null;
+    }
 
-    let metaEntries = metaStr.split(';');
-    let lastMetaEntry = metaEntries.length > 1 ? metaEntries[metaEntries.length - 1] : false;
-    if (lastMetaEntry && lastMetaEntry.indexOf('=') < 0) {
-        encoding = lastMetaEntry.toLowerCase();
-        metaEntries.pop();
+    const data = uri.substring(commaPos + 1);
+    const metaStr = uri.substring('data:'.length, commaPos);
+
+    let encoding;
+    const metaEntries = metaStr.split(';');
+
+    if (metaEntries.length > 0) {
+        const lastEntry = metaEntries[metaEntries.length - 1].toLowerCase().trim();
+        // Only recognize valid encoding types to prevent manipulation
+        if (['base64', 'utf8', 'utf-8'].includes(lastEntry) && lastEntry.indexOf('=') === -1) {
+            encoding = lastEntry;
+            metaEntries.pop();
+        }
     }
 
-    let contentType = metaEntries.shift() || 'application/octet-stream';
-    let params = {};
-    for (let entry of metaEntries) {
-        let sep = entry.indexOf('=');
-        if (sep >= 0) {
-            let key = entry.substring(0, sep);
-            let value = entry.substring(sep + 1);
-            params[key] = value;
+    const contentType = metaEntries.length > 0 ? metaEntries.shift() : 'application/octet-stream';
+    const params = {};
+
+    for (let i = 0; i < metaEntries.length; i++) {
+        const entry = metaEntries[i];
+        const sepPos = entry.indexOf('=');
+        if (sepPos > 0) {
+            // Ensure there's a key before the '='
+            const key = entry.substring(0, sepPos).trim();
+            const value = entry.substring(sepPos + 1).trim();
+            if (key) {
+                params[key] = value;
+            }
         }
     }
 
-    switch (encoding) {
-        case 'base64':
-            data = Buffer.from(data, 'base64');
-            break;
-        case 'utf8':
-            data = Buffer.from(data);
-            break;
-        default:
+    // Decode data based on encoding with proper error handling
+    let bufferData;
+    try {
+        if (encoding === 'base64') {
+            bufferData = Buffer.from(data, 'base64');
+        } else {
             try {
-                data = Buffer.from(decodeURIComponent(data));
-            } catch (err) {
-                data = Buffer.from(data);
+                bufferData = Buffer.from(decodeURIComponent(data));
+            } catch (decodeError) {
+                bufferData = Buffer.from(data);
             }
-            data = Buffer.from(data);
+        }
+    } catch (bufferError) {
+        bufferData = Buffer.alloc(0);
     }
 
-    return { data, encoding, contentType, params };
+    return {
+        data: bufferData,
+        encoding: encoding || null,
+        contentType: contentType || 'application/octet-stream',
+        params
+    };
 };
 
 /**

package/lib/smtp-connection/index.js

@@ -1619,7 +1619,7 @@ class SMTPConnection extends EventEmitter {
         }
 
         if (!this._envelope.rcptQueue.length) {
-            return callback(this._formatError('Can\x27t send mail - no recipients defined', 'EENVELOPE', false, 'API'));
+            return callback(this._formatError("Can't send mail - no recipients defined", 'EENVELOPE', false, 'API'));
         } else {
             this._recipientQueue = [];
 
@@ -1675,7 +1675,7 @@ class SMTPConnection extends EventEmitter {
                 });
                 this._sendCommand('DATA');
             } else {
-                err = this._formatError('Can\x27t send mail - all recipients were rejected', 'EENVELOPE', str, 'RCPT TO');
+                err = this._formatError("Can't send mail - all recipients were rejected", 'EENVELOPE', str, 'RCPT TO');
                 err.rejected = this._envelope.rejected;
                 err.rejectedErrors = this._envelope.rejectedErrors;
                 return callback(err);

package/lib/well-known/services.json

@@ -43,6 +43,16 @@
         "port": 587
     },
 
+    "Aruba": {
+        "description": "Aruba PEC (Italian email provider)",
+        "domains": ["aruba.it", "pec.aruba.it"],
+        "aliases": ["Aruba PEC"],
+        "host": "smtps.aruba.it",
+        "port": 465,
+        "secure": true,
+        "authMethod": "LOGIN"
+    },
+
     "Bluewin": {
         "description": "Bluewin (Swiss email provider)",
         "host": "smtpauths.bluewin.ch",
@@ -50,12 +60,29 @@
         "port": 465
     },
 
+    "BOL": {
+        "description": "BOL Mail (Brazilian provider)",
+        "domains": ["bol.com.br"],
+        "host": "smtp.bol.com.br",
+        "port": 587,
+        "requireTLS": true
+    },
+
     "DebugMail": {
         "description": "DebugMail (email testing service)",
         "host": "debugmail.io",
         "port": 25
     },
 
+    "Disroot": {
+        "description": "Disroot (privacy-focused provider)",
+        "domains": ["disroot.org"],
+        "host": "disroot.org",
+        "port": 587,
+        "secure": false,
+        "authMethod": "LOGIN"
+    },
+
     "DynectEmail": {
         "description": "Dyn Email Delivery",
         "aliases": ["Dynect"],
@@ -173,6 +200,16 @@
         "port": 587
     },
 
+    "KolabNow": {
+        "description": "KolabNow (secure email service)",
+        "domains": ["kolabnow.com"],
+        "aliases": ["Kolab"],
+        "host": "smtp.kolabnow.com",
+        "port": 465,
+        "secure": true,
+        "authMethod": "LOGIN"
+    },
+
     "Loopia": {
         "description": "Loopia (Swedish hosting provider)",
         "host": "mailcluster.loopia.se",
@@ -328,6 +365,14 @@
         "secure": true
     },
 
+    "Runbox": {
+        "description": "Runbox (Norwegian email provider)",
+        "domains": ["runbox.com"],
+        "host": "smtp.runbox.com",
+        "port": 465,
+        "secure": true
+    },
+
     "SendCloud": {
         "description": "SendCloud (Chinese email delivery)",
         "host": "smtp.sendcloud.net",
@@ -548,6 +593,14 @@
         "secure": true
     },
 
+    "Zimbra": {
+        "description": "Zimbra Mail Server",
+        "aliases": ["Zimbra Collaboration"],
+        "host": "smtp.zimbra.com",
+        "port": 587,
+        "requireTLS": true
+    },
+
     "Zoho": {
         "description": "Zoho Mail",
         "host": "smtp.zoho.com",

package/lib/xoauth2/index.js

@@ -72,6 +72,9 @@ class XOAuth2 extends Stream {
             let timeout = Math.max(Number(this.options.timeout) || 0, 0);
             this.expires = (timeout && Date.now() + timeout * 1000) || 0;
         }
+
+        this.renewing = false; // Track if renewal is in progress
+        this.renewalQueue = []; // Queue for pending requests during renewal
     }
 
     /**
@@ -82,14 +85,61 @@ class XOAuth2 extends Stream {
      */
     getToken(renew, callback) {
         if (!renew && this.accessToken && (!this.expires || this.expires > Date.now())) {
+            this.logger.debug(
+                {
+                    tnx: 'OAUTH2',
+                    user: this.options.user,
+                    action: 'reuse'
+                },
+                'Reusing existing access token for %s',
+                this.options.user
+            );
             return callback(null, this.accessToken);
         }
 
-        let generateCallback = (...args) => {
-            if (args[0]) {
+        // check if it is possible to renew, if not, return the current token or error
+        if (!this.provisionCallback && !this.options.refreshToken && !this.options.serviceClient) {
+            if (this.accessToken) {
+                this.logger.debug(
+                    {
+                        tnx: 'OAUTH2',
+                        user: this.options.user,
+                        action: 'reuse'
+                    },
+                    'Reusing existing access token (no refresh capability) for %s',
+                    this.options.user
+                );
+                return callback(null, this.accessToken);
+            }
+            this.logger.error(
+                {
+                    tnx: 'OAUTH2',
+                    user: this.options.user,
+                    action: 'renew'
+                },
+                'Cannot renew access token for %s: No refresh mechanism available',
+                this.options.user
+            );
+            return callback(new Error("Can't create new access token for user"));
+        }
+
+        // If renewal already in progress, queue this request instead of starting another
+        if (this.renewing) {
+            return this.renewalQueue.push({ renew, callback });
+        }
+
+        this.renewing = true;
+
+        // Handles token renewal completion - processes queued requests and cleans up
+        const generateCallback = (err, accessToken) => {
+            this.renewalQueue.forEach(item => item.callback(err, accessToken));
+            this.renewalQueue = [];
+            this.renewing = false;
+
+            if (err) {
                 this.logger.error(
                     {
-                        err: args[0],
+                        err,
                         tnx: 'OAUTH2',
                         user: this.options.user,
                         action: 'renew'
@@ -108,7 +158,8 @@ class XOAuth2 extends Stream {
                     this.options.user
                 );
             }
-            callback(...args);
+            // Complete original request
+            callback(err, accessToken);
         };
 
         if (this.provisionCallback) {
@@ -167,7 +218,7 @@ class XOAuth2 extends Stream {
             try {
                 token = this.jwtSignRS256(tokenData);
             } catch (err) {
-                return callback(new Error('Can\x27t generate token. Check your auth options'));
+                return callback(new Error("Can't generate token. Check your auth options"));
             }
 
             urlOptions = {
@@ -181,7 +232,7 @@ class XOAuth2 extends Stream {
             };
         } else {
             if (!this.options.refreshToken) {
-                return callback(new Error('Can\x27t create new access token for user'));
+                return callback(new Error("Can't create new access token for user"));
             }
 
             // web app - https://developers.google.com/identity/protocols/OAuth2WebServer

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "nodemailer",
-    "version": "7.0.5",
+    "version": "7.0.6",
     "description": "Easy as cake e-mail sending from your Node.js applications",
     "main": "lib/nodemailer.js",
     "scripts": {
@@ -23,7 +23,7 @@
     },
     "homepage": "https://nodemailer.com/",
     "devDependencies": {
-        "@aws-sdk/client-sesv2": "3.839.0",
+        "@aws-sdk/client-sesv2": "3.876.0",
         "bunyan": "1.8.15",
         "c8": "10.1.3",
         "eslint": "8.57.0",