nodemailer 8.0.11 → 9.0.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # CHANGELOG
 
+## [9.0.0](https://github.com/nodemailer/nodemailer/compare/v8.0.11...v9.0.0) (2026-06-14)
+
+
+### ⚠ BREAKING CHANGES
+
+* HTTPS requests made while fetching remote content (attachment href/path URLs, OAuth2 token endpoints, HTTP/HTTPS proxy CONNECT) now validate the server's TLS certificate by default. Requests to hosts with self-signed, expired, or hostname-mismatched certificates that previously succeeded will now fail. Opt back out per request with tls.rejectUnauthorized=false (transport options, or a per-attachment `tls` option).
+
+### Bug Fixes
+
+* replace deprecated url.parse with a WHATWG URL wrapper ([0c080fb](https://github.com/nodemailer/nodemailer/commit/0c080fbf3278926f013a5c2ad06f5f6f0e18f5ed))
+* validate TLS certificates by default when fetching remote content ([6a947ac](https://github.com/nodemailer/nodemailer/commit/6a947ac7114a16da1e6a50d9a6f4e17026ce145d))
+
 ## [8.0.11](https://github.com/nodemailer/nodemailer/compare/v8.0.10...v8.0.11) (2026-06-10)
 
 

package/lib/fetch/cookies.js

@@ -2,7 +2,7 @@
 
 // module to handle cookies
 
-const urllib = require('url');
+const urllib = require('../shared/url');
 
 const SESSION_TIMEOUT = 1800; // 30 min
 

package/lib/fetch/index.js

@@ -2,7 +2,7 @@
 
 const http = require('http');
 const https = require('https');
-const urllib = require('url');
+const urllib = require('../shared/url');
 const zlib = require('zlib');
 const { PassThrough } = require('stream');
 const Cookies = require('./cookies');
@@ -123,7 +123,10 @@ function nmfetch(url, options) {
         path: parsed.path,
         port: parsed.port ? parsed.port : parsed.protocol === 'https:' ? 443 : 80,
         headers,
-        rejectUnauthorized: false,
+        // Validate TLS certificates by default. Callers that genuinely need to
+        // reach a self-signed/internal host opt out explicitly with
+        // options.tls = { rejectUnauthorized: false }.
+        rejectUnauthorized: true,
         agent: false
     };
 
@@ -212,7 +215,27 @@ function nmfetch(url, options) {
             // redirect does not include POST body
             options.method = 'GET';
             options.body = false;
-            return nmfetch(urllib.resolve(url, res.headers.location), options);
+
+            const redirectUrl = urllib.resolve(url, res.headers.location);
+            const redirectParsed = urllib.parse(redirectUrl);
+
+            // Do not forward credentials when the redirect leaves the original
+            // security context: a different host, or a downgrade from https to
+            // http (which would otherwise put them on the wire in cleartext).
+            // Strip sensitive request headers so an attacker who controls the
+            // redirect target cannot harvest them.
+            const crossHost = redirectParsed.hostname !== parsed.hostname;
+            const downgrade = parsed.protocol === 'https:' && redirectParsed.protocol === 'http:';
+            if (options.headers && (crossHost || downgrade)) {
+                const sensitive = ['authorization', 'cookie', 'proxy-authorization'];
+                Object.keys(options.headers).forEach(key => {
+                    if (sensitive.includes(key.toLowerCase())) {
+                        delete options.headers[key];
+                    }
+                });
+            }
+
+            return nmfetch(redirectUrl, options);
         }
 
         fetchRes.statusCode = res.statusCode;

package/lib/mail-composer/index.js

@@ -142,7 +142,8 @@ class MailComposer {
             } else if (attachment.href) {
                 data.content = {
                     href: attachment.href,
-                    httpHeaders: attachment.httpHeaders
+                    httpHeaders: attachment.httpHeaders,
+                    tls: attachment.tls
                 };
             } else {
                 data.content = attachment.content || '';

package/lib/mailer/index.js

@@ -8,7 +8,7 @@ const DKIM = require('../dkim');
 const httpProxyClient = require('../smtp-connection/http-proxy-client');
 const errors = require('../errors');
 const util = require('util');
-const urllib = require('url');
+const urllib = require('../shared/url');
 const packageData = require('../../package.json');
 const MailMessage = require('./mail-message');
 const net = require('net');
@@ -324,7 +324,7 @@ class Mail extends EventEmitter {
                 // Connect using a HTTP CONNECT method
                 case 'http':
                 case 'https':
-                    httpProxyClient(proxy.href, options.port, options.host, (err, socket) => {
+                    httpProxyClient(proxy.href, options.port, options.host, this.options.tls || {}, (err, socket) => {
                         if (err) {
                             return callback(err);
                         }

package/lib/mime-node/index.js

@@ -1006,7 +1006,7 @@ class MimeNode {
                 return contentStream;
             }
             // fetch URL
-            return nmfetch(content.href, { headers: content.httpHeaders });
+            return nmfetch(content.href, { headers: content.httpHeaders, tls: content.tls });
         }
 
         // pass string or buffer content as a stream

package/lib/nodemailer.js

@@ -102,10 +102,10 @@ module.exports.createTestAccount = function (apiUrl, callback) {
         body: Buffer.from(JSON.stringify(requestBody))
     };
 
-    // Credential-bearing request — opt back into strict cert validation when
-    // the API URL is HTTPS. lib/fetch defaults to rejectUnauthorized:false
-    // for attachment hosts that may be self-signed; the Ethereal API has a
-    // real cert, so the lax default was a free attack surface.
+    // Credential-bearing request to the Ethereal API. lib/fetch already
+    // validates certs by default; pin rejectUnauthorized:true here so this
+    // call stays strict regardless of any future default change and is never
+    // relaxed for a real-cert endpoint.
     if (/^https:/i.test(apiUrl)) {
         fetchOptions.tls = { rejectUnauthorized: true };
     }

package/lib/shared/index.js

@@ -2,7 +2,7 @@
 
 'use strict';
 
-const urllib = require('url');
+const urllib = require('./url');
 const util = require('util');
 const fs = require('fs');
 const nmfetch = require('../fetch');
@@ -569,7 +569,7 @@ function resolveContentValue(data, key, options, callback) {
                     callback(err);
                 });
             }
-            return resolveStream(nmfetch(content.path || content.href), callback);
+            return resolveStream(nmfetch(content.path || content.href, { headers: content.httpHeaders, tls: content.tls }), callback);
         } else if (/^data:/i.test(content.path || content.href)) {
             const parsedDataUri = module.exports.parseDataURI(content.path || content.href);
 

package/lib/shared/url.js

@@ -0,0 +1,151 @@
+'use strict';
+
+// URL parsing wrapper. Prefers the WHATWG `URL` (a global on Node 10+, and
+// available as `require('url').URL` since Node 6.13+) and only falls back to the
+// legacy, deprecation-warning-emitting `url.parse()` / `url.resolve()` on ancient
+// Node versions that predate the WHATWG implementation.
+//
+// The WHATWG `URL` exposes a different shape than the legacy parser, so results
+// are normalized back into the legacy field names the rest of the codebase reads
+// (`protocol`, `hostname`, `port`, `pathname`, `path`, `search`, `auth`, `query`,
+// `href`). This keeps every existing call site unchanged.
+//
+// Known, accepted divergences from the legacy parser:
+//  - non-special schemes (smtp:/smtps:/direct:) are not host-lowercased by
+//    WHATWG; cosmetic only, SMTP/DNS hosts are case-insensitive. (IDNA mapping
+//    and IPv6 brackets are normalized back by normalizeHostname below.)
+//  - a literal unescaped ':' inside a password is percent-encoded by WHATWG;
+//    such passwords should be percent-encoded by the caller anyway.
+
+const urllib = require('url');
+const punycode = require('../punycode');
+
+// WHATWG URL constructor if available, otherwise undefined (Node < 6.13).
+const URLImpl = (typeof URL !== 'undefined' && URL) || urllib.URL;
+
+// Matches a "scheme:" not followed by "//" (and with something after it), used
+// to re-insert the authority separator the legacy parser did not require.
+const SLASHLESS_AUTHORITY = /^([a-zA-Z][a-zA-Z0-9+.-]*:)(?!\/\/)(.+)$/;
+
+// decodeURIComponent that never throws. Legacy url.parse() decodes the auth
+// component but tolerates malformed percent sequences, so mirror that.
+function safeDecode(str) {
+    try {
+        return decodeURIComponent(str);
+    } catch (_err) {
+        return str;
+    }
+}
+
+// Derives the legacy-shaped bare hostname from a WHATWG URL. WHATWG keeps IPv6
+// literals bracketed ('[::1]') and, for non-special schemes (smtp:/smtps:/socks:),
+// percent-encodes a non-ASCII host instead of IDNA-mapping it. Both forms are
+// un-resolvable when handed to net/dns/http.request — which is what every call
+// site does — so map them back to what legacy url.parse() returned: the bare
+// address and the punycode form. Idempotent on plain ASCII and already-punycode
+// hosts, so special-scheme hosts (already IDNA-mapped by WHATWG) pass through.
+function normalizeHostname(raw) {
+    let hostname = raw || '';
+    if (!hostname) {
+        // Host-less URL (e.g. 'direct:'): legacy returned '' here, not null;
+        // consumers do `hostname.length` / `'.' + hostname`, so keep it a string.
+        return '';
+    }
+    if (hostname.charAt(0) === '[' && hostname.charAt(hostname.length - 1) === ']') {
+        return hostname.slice(1, -1);
+    }
+    return punycode.toASCII(safeDecode(hostname));
+}
+
+module.exports.parse = (input, parseQueryString) => {
+    input = input || '';
+
+    if (!URLImpl) {
+        // Node < 6.13: no WHATWG URL available, use the legacy parser.
+        return urllib.parse(input, parseQueryString);
+    }
+
+    // Legacy url.parse() parses a "user:pass@host:port" authority that follows
+    // the scheme even without the "//" separator, for schemes outside its
+    // built-in slashed-protocol list (smtp:/smtps:/socks:/...). The WHATWG
+    // parser instead treats a scheme not followed by "//" as an opaque path.
+    // Re-insert the "//" so slash-less connection/proxy URLs keep resolving to
+    // an authority, as they did before. This assumes a slash-authority scheme,
+    // which every consumer here uses (http/https/smtp/smtps/socks/direct); an
+    // opaque scheme like mailto:/data:/tel: would be mis-split, but none reach
+    // this module.
+    const slashless = SLASHLESS_AUTHORITY.exec(input);
+    const normalized = slashless ? slashless[1] + '//' + slashless[2] : input;
+
+    let u;
+    try {
+        u = new URLImpl(normalized);
+    } catch (_err) {
+        // WHATWG rejects some input the legacy parser tolerated (empty/relative
+        // strings, scheme-relative '//host/path', out-of-range ports, ...). Fall
+        // back to the legacy parser so behavior — including the downstream errors
+        // callers rely on — is preserved. This is the only path that can still
+        // emit a deprecation warning; it fires for anything WHATWG cannot
+        // represent, including legitimate relative URLs, not just malformed input.
+        return urllib.parse(input, parseQueryString);
+    }
+
+    const hostname = normalizeHostname(u.hostname);
+    const port = u.port || null;
+    const pathname = u.pathname || null;
+    const search = u.search || null;
+
+    // Legacy `.auth` is the decoded "user[:pass]" string; WHATWG keeps the
+    // username/password percent-encoded, so decode to stay byte-compatible with
+    // existing consumers (parseConnectionUrl, Basic/Proxy-Authorization headers).
+    let auth = null;
+    if (u.username || u.password) {
+        // Gate on password too: legacy url.parse('smtps://:pass@host').auth was
+        // ':pass'. Dropping it would silently connect unauthenticated.
+        auth = safeDecode(u.username) + (u.password ? ':' + safeDecode(u.password) : '');
+    }
+
+    let query;
+    if (parseQueryString) {
+        // Mirror querystring.parse(): null-prototype object, repeated keys → array.
+        query = Object.create(null);
+        u.searchParams.forEach((value, key) => {
+            if (Object.prototype.hasOwnProperty.call(query, key)) {
+                if (Array.isArray(query[key])) {
+                    query[key].push(value);
+                } else {
+                    query[key] = [query[key], value];
+                }
+            } else {
+                query[key] = value;
+            }
+        });
+    } else {
+        query = search ? search.slice(1) : null;
+    }
+
+    return {
+        protocol: u.protocol || null,
+        host: u.host || null,
+        hostname,
+        port,
+        pathname,
+        search,
+        path: (pathname || '') + (search || '') || null,
+        href: u.href,
+        auth,
+        query
+    };
+};
+
+module.exports.resolve = (from, to) => {
+    if (!URLImpl) {
+        return urllib.resolve(from, to);
+    }
+    try {
+        return new URLImpl(to, from).href;
+    } catch (_err) {
+        // Malformed target — fall back to the legacy resolver.
+        return urllib.resolve(from, to);
+    }
+};

package/lib/smtp-connection/http-proxy-client.js

@@ -6,7 +6,7 @@
 
 const net = require('net');
 const tls = require('tls');
-const urllib = require('url');
+const urllib = require('../shared/url');
 const errors = require('../errors');
 
 /**
@@ -19,20 +19,29 @@ const errors = require('../errors');
  * @param {String} proxyUrl proxy configuration, etg "http://proxy.host:3128/"
  * @param {Number} destinationPort Port to open in destination host
  * @param {String} destinationHost Destination hostname
+ * @param {Object} [tlsOptions] Optional TLS options for an HTTPS proxy (e.g. { rejectUnauthorized: false })
  * @param {Function} callback Callback to run with the rocket object once connection is established
  */
-function httpProxyClient(proxyUrl, destinationPort, destinationHost, callback) {
+function httpProxyClient(proxyUrl, destinationPort, destinationHost, tlsOptions, callback) {
+    if (typeof tlsOptions === 'function') {
+        callback = tlsOptions;
+        tlsOptions = {};
+    }
+    tlsOptions = tlsOptions || {};
+
     const proxy = urllib.parse(proxyUrl);
 
-    const options = {
+    const connectOptions = {
         host: proxy.hostname,
         port: Number(proxy.port) ? Number(proxy.port) : proxy.protocol === 'https:' ? 443 : 80
     };
 
     let connect;
     if (proxy.protocol === 'https:') {
-        // we can use untrusted proxies as long as we verify actual SMTP certificates
-        options.rejectUnauthorized = false;
+        // Validate the proxy's TLS certificate by default. A caller that uses a
+        // self-signed proxy (e.g. integration tests) opts out explicitly with
+        // tls.rejectUnauthorized === false.
+        connectOptions.rejectUnauthorized = tlsOptions.rejectUnauthorized !== false;
         connect = tls.connect.bind(tls);
     } else {
         connect = net.connect.bind(net);
@@ -62,7 +71,7 @@ function httpProxyClient(proxyUrl, destinationPort, destinationHost, callback) {
         tempSocketErr(err);
     };
 
-    socket = connect(options, () => {
+    socket = connect(connectOptions, () => {
         if (finished) {
             return;
         }

package/lib/xoauth2/index.js

@@ -378,12 +378,11 @@ class XOAuth2 extends Stream {
             allowErrorResponse: true
         };
 
-        // OAuth2 token endpoints are credential-bearing. lib/fetch defaults to
-        // rejectUnauthorized:false (intentional for self-signed attachment
-        // hosts), so opt back in to strict cert validation here when the
-        // access URL is HTTPS. params.tls (the user's options.tls) is layered
-        // on top so callers with a self-hosted provider on a private CA can
-        // still override.
+        // OAuth2 token endpoints are credential-bearing. lib/fetch already
+        // validates certs by default; pin rejectUnauthorized:true here so the
+        // token fetch stays strict, while still layering params.tls (the
+        // user's options.tls) on top so callers with a self-hosted provider on
+        // a private CA can override.
         if (/^https:/i.test(url)) {
             fetchOptions.tls = Object.assign({ rejectUnauthorized: true }, params.tls || {});
         }

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "nodemailer",
-    "version": "8.0.11",
+    "version": "9.0.0",
     "description": "Easy as cake e-mail sending from your Node.js applications",
     "main": "lib/nodemailer.js",
     "scripts": {