nodemailer 8.0.3 → 8.0.5

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # CHANGELOG
 
+## [8.0.5](https://github.com/nodemailer/nodemailer/compare/v8.0.4...v8.0.5) (2026-04-07)
+
+
+### Bug Fixes
+
+* decode SMTP server responses as UTF-8 at line boundary ([95876b1](https://github.com/nodemailer/nodemailer/commit/95876b103e587e49583e43f88cb2c3a61556f3ac))
+* sanitize CRLF in transport name option to prevent SMTP command injection (GHSA-vvjj-xcjg-gr5g) ([0a43876](https://github.com/nodemailer/nodemailer/commit/0a43876801a420ca528f492eaa01bfc421cc306e))
+
+## [8.0.4](https://github.com/nodemailer/nodemailer/compare/v8.0.3...v8.0.4) (2026-03-25)
+
+
+### Bug Fixes
+
+* sanitize envelope size to prevent SMTP command injection ([2d7b971](https://github.com/nodemailer/nodemailer/commit/2d7b9710e63555a1eb13d721296c51186d4b5651))
+
 ## [8.0.3](https://github.com/nodemailer/nodemailer/compare/v8.0.2...v8.0.3) (2026-03-18)
 
 

package/CLAUDE.md

@@ -0,0 +1,55 @@
+# Nodemailer
+
+E-mail sending library for Node.js. Zero runtime dependencies. Entry point is `lib/nodemailer.js`, which exposes `createTransport(transporter, defaults)` and routes to one of the bundled transports based on the options object.
+
+## Layout
+
+- `lib/nodemailer.js` — public entry, transport dispatch (`createTransport`).
+- `lib/mailer/` — `Mail` class: the user-facing transport wrapper that normalizes messages, runs the DKIM signer, and hands off to the underlying transport's `.send()`.
+- `lib/mail-composer/` + `lib/mime-node/` — message → MIME tree → raw RFC822 stream.
+- `lib/smtp-connection/` — low-level SMTP/LMTP/ESMTP client. Hot path; security-sensitive. Used by `smtp-transport` and `smtp-pool`.
+- `lib/smtp-transport/` — single-shot SMTP transport.
+- `lib/smtp-pool/` — pooled SMTP transport with rate limiting.
+- `lib/sendmail-transport/`, `lib/ses-transport/`, `lib/stream-transport/`, `lib/json-transport/` — alternate transports.
+- `lib/dkim/`, `lib/addressparser/`, `lib/mime-funcs/`, `lib/base64/`, `lib/qp/`, `lib/punycode/`, `lib/well-known/`, `lib/xoauth2/`, `lib/fetch/`, `lib/shared/` — supporting modules.
+- `test/` — mirrors `lib/` structure. Most suites spin up real `smtp-server` instances on ephemeral ports; raw `net` servers are used when byte-exact reply control is needed (e.g. injecting non-ASCII or invalid UTF-8).
+
+Each transport must implement `name`, `version`, and `send(mail, callback)`. `Mail` discovers them via duck typing.
+
+## Engine target
+
+`engines.node = ">=6.0.0"`. The library is shipped as ES2017 script-mode CommonJS — no `import`, no top-level `await`, no optional chaining, no nullish coalescing, no class fields. ESLint enforces `ecmaVersion: 2017` and `sourceType: 'script'`. There is a Node 6 syntax-compat check (`npm run test:syntax`, runs `test/syntax-compat.js` inside `node:6-alpine`) that must keep passing — do not introduce syntax that breaks it. `'use strict';` directive at the top of every file.
+
+## Conventions
+
+- CommonJS only: `const x = require('...')`, `module.exports = ...`.
+- Callback-first style throughout the public API. Many internals are still callback-based — match the style of the file you are editing rather than introducing promises mid-module.
+- Prettier handles formatting; ESLint handles correctness. Run `npm run format` and `npm run lint` before sending changes. The lint config disables Prettier-overlapping rules.
+- Snake_case is not used; camelCase for variables and methods, PascalCase for classes.
+- Prefer small, surgical diffs. The codebase is mature and load-bearing — avoid drive-by refactors, comment churn, or "improvements" outside the scope of the change.
+- Every change to security-sensitive code (anything in `lib/smtp-connection/`, address parsing, header generation, DKIM) needs tests that exercise the failure mode, not just the happy path.
+
+## Testing
+
+- `npm test` — full suite via `node --test` (~150s, 480+ tests, runs serially).
+- `npm run test:coverage` — same suite under `c8`.
+- `npm run test:syntax` — Node 6 syntax compatibility check in Docker.
+- `npm run lint` / `npm run lint:fix`.
+- `npm run format` / `npm run format:check`.
+
+Always run `npm test` and `npm run lint` before considering a change done. Tests are required to pass on every commit because release-please cuts releases directly from `master`.
+
+## Releases
+
+Releases, version numbers, the `version` field in `package.json`, git tags, `CHANGELOG.md` entries, and npm publication are all managed automatically by the release-please GitHub Action (`.github/workflows/release.yaml`, configured by `.release-please-config.json`). **Never edit any of these manually and never propose manual edits to them.**
+
+Release-please derives the next version and changelog from Conventional Commit messages on `master`, opens a release PR (`chore: release X.Y.Z [skip-ci]`), and publishes to npm with provenance when that PR is merged. The only thing that should land on `master` between releases is normal commits with Conventional Commit prefixes — release-please takes care of the rest.
+
+Conventional Commit prefixes used in this repo: `fix:`, `feat:`, `chore:`, `docs:`, `refactor:`, `test:`. Use `fix:` for anything users would benefit from seeing in the changelog, including security fixes (reference the GHSA in the body).
+
+## Security
+
+This is a widely-deployed library — security-sensitive changes get extra scrutiny:
+- SMTP command injection: any user-controllable value that flows into a written SMTP command (envelope addresses, sizes, the `name`/EHLO option, headers) must be CRLF-stripped or rejected at the boundary. Sanitize at the assignment, not at every call site.
+- Server reply parsing in `lib/smtp-connection/index.js` uses a `'binary'` byte-container intermediate to reassemble multi-byte UTF-8 across socket chunks; the actual decode happens at line boundaries via `decodeServerResponse`. Don't change the chunk-buffering encoding without understanding why.
+- Reference the GHSA ID in commit messages for advisories.

package/lib/smtp-connection/index.js

@@ -17,6 +17,28 @@ const GREETING_TIMEOUT = 30 * 1000; // how much to wait after connection is esta
 const DNS_TIMEOUT = 30 * 1000; // how much to wait for resolveHostname
 const TEARDOWN_NOOP = () => {}; // reusable no-op handler for absorbing errors during socket teardown
 
+/**
+ * Re-interpret a server response stored in fake 8-bit byte-container form
+ * (the result of chunk.toString('binary') in _onData) as UTF-8.
+ *
+ * Server reply text has no formally defined charset (RFC 5321 §4.2.1), but
+ * modern MTAs commonly use UTF-8. The byte-container plumbing in _onData is
+ * required to reassemble multi-byte sequences split across socket chunks;
+ * this helper performs the actual decode at the line boundary, falling back
+ * to the byte-container form when the bytes are not valid UTF-8 so that
+ * legacy 8-bit replies are still recoverable byte-for-byte.
+ */
+function decodeServerResponse(str) {
+    if (!str) {
+        return str;
+    }
+    const utf8 = Buffer.from(str, 'binary').toString('utf8');
+    // The input is a byte container (each char is in U+0000..U+00FF) so it can never
+    // already contain U+FFFD; any \uFFFD in the result was inserted by Node's UTF-8
+    // decoder for invalid bytes, which means we should return the original bytes intact.
+    return utf8.includes('\uFFFD') ? str : utf8;
+}
+
 /**
  * Generates a SMTP connection object
  *
@@ -68,7 +90,7 @@ class SMTPConnection extends EventEmitter {
             this.secureConnection = true;
         }
 
-        this.name = this.options.name || this._getHostname();
+        this.name = (this.options.name || this._getHostname()).toString().replace(/[\r\n]+/g, '');
 
         this.logger = shared.getLogger(this.options, {
             component: this.options.component || 'smtp-connection',
@@ -895,15 +917,15 @@ class SMTPConnection extends EventEmitter {
         let serverResponse = false;
 
         if (this._remainder && this._remainder.trim()) {
+            this.lastServerResponse = serverResponse = decodeServerResponse(this._remainder.trim());
             if (this.options.debug || this.options.transactionLog) {
                 this.logger.debug(
                     {
                         tnx: 'server'
                     },
-                    this._remainder.replace(/\r?\n$/, '')
+                    serverResponse
                 );
             }
-            this.lastServerResponse = serverResponse = this._remainder.trim();
         }
 
         this.logger.info(
@@ -1023,7 +1045,7 @@ class SMTPConnection extends EventEmitter {
             return false;
         }
 
-        let str = (this.lastServerResponse = (this._responseQueue.shift() || '').toString());
+        let str = (this.lastServerResponse = decodeServerResponse((this._responseQueue.shift() || '').toString()));
 
         if (/^\d+-/.test(str.split('\n').pop())) {
             // keep waiting for the final part of multiline response
@@ -1159,7 +1181,10 @@ class SMTPConnection extends EventEmitter {
         }
 
         if (this._envelope.size && this._supportedExtensions.includes('SIZE')) {
-            args.push('SIZE=' + this._envelope.size);
+            const sizeValue = Number(this._envelope.size) || 0;
+            if (sizeValue > 0) {
+                args.push('SIZE=' + sizeValue);
+            }
         }
 
         // If the server supports DSN and the envelope includes an DSN prop

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "nodemailer",
-    "version": "8.0.3",
+    "version": "8.0.5",
     "description": "Easy as cake e-mail sending from your Node.js applications",
     "main": "lib/nodemailer.js",
     "scripts": {
@@ -27,10 +27,10 @@
     },
     "homepage": "https://nodemailer.com/",
     "devDependencies": {
-        "@aws-sdk/client-sesv2": "3.1011.0",
+        "@aws-sdk/client-sesv2": "3.1025.0",
         "bunyan": "1.8.15",
         "c8": "11.0.0",
-        "eslint": "10.0.3",
+        "eslint": "10.2.0",
         "eslint-config-prettier": "10.1.8",
         "globals": "17.4.0",
         "libbase64": "1.3.0",
@@ -40,7 +40,7 @@
         "prettier": "3.8.1",
         "proxy": "1.0.2",
         "proxy-test-server": "1.0.0",
-        "smtp-server": "3.18.1"
+        "smtp-server": "3.18.3"
     },
     "engines": {
         "node": ">=6.0.0"