nodemailer 9.0.5 → 9.1.0

package/CHANGELOG.md

@@ -1,5 +1,31 @@
 # CHANGELOG
 
+## [9.1.0](https://github.com/nodemailer/nodemailer/compare/v9.0.6...v9.1.0) (2026-08-31)
+
+
+### Features
+
+* **mailer:** cap recipients per message with maxRecipients ([7279ac8](https://github.com/nodemailer/nodemailer/commit/7279ac8dee4f66c032981e6e51e3e7210ad0dcbf))
+
+
+### Bug Fixes
+
+* **addressparser:** handle address lists in linear time ([9116da9](https://github.com/nodemailer/nodemailer/commit/9116da9528c6524cefaed75185602a7e85d20434))
+* **addressparser:** terminate the domain at an RFC 5322 comment ([902b63e](https://github.com/nodemailer/nodemailer/commit/902b63e935435c30f4025901c0902dce64cd8880))
+* **mime-node:** apply UTS-46 mapping when encoding a domain ([259c32d](https://github.com/nodemailer/nodemailer/commit/259c32d7d266301e3377a212776c3fff993c0148))
+* **mime-node:** dedupe envelope recipients in linear time ([7cc38af](https://github.com/nodemailer/nodemailer/commit/7cc38af418ffa6fc7e86085195ca5ca681694b3e))
+* **mime-node:** flatten parsed addresses without concat.apply ([83b8c48](https://github.com/nodemailer/nodemailer/commit/83b8c48cbdb8b3116f2e1ba84af755b2c5661c0f))
+* **mime-node:** keep the recipient dedupe linear across address headers ([34da642](https://github.com/nodemailer/nodemailer/commit/34da64282dcdc9b0581c721a27ab2fa226673150))
+* **mime-node:** keep URL delimiters away from the domain mapper ([b212ac4](https://github.com/nodemailer/nodemailer/commit/b212ac4e27bce8182478044fcb8d1642ccdad46e))
+
+## [9.0.6](https://github.com/nodemailer/nodemailer/compare/v9.0.5...v9.0.6) (2026-08-27)
+
+
+### Bug Fixes
+
+* **addressparser:** recover the addr-spec from an angle-addr holding whitespace ([e989a22](https://github.com/nodemailer/nodemailer/commit/e989a22ca4f5161929bf37be8fb07de635016fa7))
+* harden copies of user supplied keys and URL fetching ([2f667f4](https://github.com/nodemailer/nodemailer/commit/2f667f4272cb2d7cb479b2e3903ab10600fc0eae))
+
 ## [9.0.5](https://github.com/nodemailer/nodemailer/compare/v9.0.4...v9.0.5) (2026-08-07)
 
 

package/README.md

@@ -8,10 +8,7 @@ Send emails from Node.js – easy as cake! 🍰✉️
 
 See [nodemailer.com](https://nodemailer.com/) for documentation and terms.
 
-> [!TIP]
-> Check out **[EmailEngine](https://emailengine.app/?utm_source=github-nodemailer&utm_campaign=nodemailer&utm_medium=readme-link)** – a self-hosted email gateway that allows making **REST requests against IMAP and SMTP servers**. EmailEngine also sends webhooks whenever something changes on the registered accounts.\
-> \
-> Using the email accounts registered with EmailEngine, you can receive and [send emails](https://emailengine.app/sending-emails?utm_source=github-nodemailer&utm_campaign=nodemailer&utm_medium=readme-link). EmailEngine supports OAuth2, delayed sends, opens and clicks tracking, bounce detection, etc. All on top of regular email accounts without an external MTA service.
+> Nodemailer is developed by the team behind **[EmailEngine](https://emailengine.app/?utm_source=nodemailer-readme&utm_medium=readme&utm_campaign=oss-docs)**, a self-hosted email API that turns any Gmail, Microsoft 365, or IMAP account into a REST endpoint, with managed OAuth2, webhooks for incoming mail, and built-in [sending](https://emailengine.app/sending-emails?utm_source=nodemailer-readme&utm_medium=readme&utm_campaign=oss-docs). If you would rather call an HTTP API than maintain IMAP and SMTP connections yourself, that is what it is for.
 
 ## Having an issue?
 
@@ -25,7 +22,7 @@ You are using an older Node.js version than v6.0. Upgrade Node.js to get support
 
 #### I'm having issues with Gmail
 
-Gmail either works well, or it does not work at all. It is probably easier to switch to an alternative service instead of fixing issues with Gmail. If Gmail does not work for you, then don't use it. Read more about it [here](https://nodemailer.com/usage/using-gmail/).
+Gmail either works well, or it does not work at all. It is probably easier to switch to an alternative service instead of fixing issues with Gmail. If Gmail does not work for you, then don't use it. Read more about it [here](https://nodemailer.com/usage/using-gmail/). If the blocker is OAuth2 setup rather than Gmail itself, [EmailEngine](https://emailengine.app/?utm_source=nodemailer-readme&utm_medium=readme&utm_campaign=oss-docs&utm_content=faq-gmail) handles the OAuth2 flow and token refresh for you.
 
 #### I get ETIMEDOUT errors
 

package/lib/addressparser/index.js

@@ -34,6 +34,101 @@ function _quoteLocalPart(address) {
     return '"' + user.replace(/["\\]/g, '\\$&') + '"@' + address.substr(lastAt + 1);
 }
 
+/**
+ * Reached for every parsed address, so it is built once rather than per call.
+ */
+const HAS_WHITESPACE = /\s/;
+
+/**
+ * An addr-spec that carries its whitespace legally, inside a quoted local part. The
+ * optional tail is the malformed shape: a real mailbox with wreckage trailing it.
+ */
+const QUOTED_LOCAL_ADDR = /^("(?:[^"\\]|\\[\s\S])*"@\S+)(?:\s+([\s\S]+))?$/;
+
+/**
+ * One run holding a single '@' and no whitespace, the shape an addr-spec has to have.
+ */
+const ADDR_SPEC = /^[^@\s]+@[^@\s]+$/;
+
+/**
+ * The looser reading applied once the strict one finds nothing, which tolerates the
+ * further '@' that a domain should not have but malformed headers carry anyway.
+ */
+const LOOSE_ADDR_SPEC = /^[^@\s]+@\S+$/;
+
+/**
+ * Recovers the addr-spec from an angle-addr that came back holding unquoted whitespace.
+ *
+ * A malformed header can put more than a mailbox between the angle brackets, most often
+ * because the generator wrote the recipient twice: '<user@example.com user@example.com>'
+ * or '<example.com user@example.com>'. Whitespace is not addr-spec, so the whole run can
+ * never be a mailbox anyone could deliver to, and passing it on as the address loses the
+ * recipient that is sitting right there in the header.
+ *
+ * The run that still reads as an addr-spec is kept and whatever is left over becomes
+ * display text rather than being dropped. Candidates are read strictly first and then
+ * under the looser grammar, the same two tiers the unquoted-text branch below applies to
+ * the same problem, so that '<a@b@c.com junk>' and a bare 'a@b@c.com junk' agree on the
+ * recipient. When several runs qualify the first wins, which is what that branch's looser
+ * tier does within a token.
+ *
+ * A quoted local part is left alone: RFC 5321 allows whitespace inside it, so
+ * '<"user name"@example.com>' is well formed and means exactly what it says.
+ *
+ * @param {Object} data Collected address parts, mutated in place
+ */
+function _recoverAddrSpec(data) {
+    if (!HAS_WHITESPACE.test(data.address)) {
+        return;
+    }
+
+    let address;
+    let rest;
+
+    const quoted = data.address.match(QUOTED_LOCAL_ADDR);
+    if (quoted) {
+        if (!quoted[2]) {
+            // the whitespace sits inside the quoted local part, this is a well formed mailbox
+            return;
+        }
+
+        // a real mailbox with wreckage trailing it, so peel the addr-spec off whole rather
+        // than splitting into the quotes
+        address = quoted[1];
+        rest = [quoted[2]];
+    } else {
+        if (data.address.indexOf('"') >= 0) {
+            // Splitting on whitespace loses track of where the quoted string starts and ends,
+            // and this module does not take addresses out of quoted strings: the run picked out
+            // of '<junk "user@evil.com b"@good.com>' would be an address from the domain the
+            // quotes were hiding. Every well formed shape was already handled above, so what is
+            // left is wreckage either way and the original is the honest answer
+            return;
+        }
+
+        const parts = data.address.split(/\s+/);
+
+        let addrIndex = parts.findIndex(part => ADDR_SPEC.test(part));
+        if (addrIndex < 0) {
+            addrIndex = parts.findIndex(part => LOOSE_ADDR_SPEC.test(part));
+        }
+
+        if (addrIndex < 0) {
+            // nothing in there reads as an address, there is no better answer than the original
+            return;
+        }
+
+        address = parts.splice(addrIndex, 1)[0];
+        rest = parts;
+    }
+
+    data.address = address;
+    data.text = [data.text]
+        .concat(rest)
+        .filter(part => part)
+        .join(' ');
+}
+
 /**
  * Converts tokens for a single address into an address object
  *
@@ -89,7 +184,18 @@ function _handleAddress(tokens, depth) {
                 token.value = token.value.replace(/^[^<]*<\s*/, '');
             }
 
-            if (prevToken && prevToken.noBreak && data[state].length) {
+            // A comment is folding whitespace. It may sit inside an addr-spec, on either side
+            // of the '@', but it cannot join two atoms into one: gluing across it would read
+            // 'user@example.com(x)evil.com' as the single domain 'example.comevil.com' and
+            // deliver to a domain the sender never named.
+            const parts = data[state];
+            const joins =
+                prevToken &&
+                prevToken.noBreak &&
+                parts.length &&
+                (prevToken.value !== ')' || parts[parts.length - 1].slice(-1) === '@' || token.value.charAt(0) === '@');
+
+            if (joins) {
                 data[state][data[state].length - 1] += token.value;
                 if (state === 'text' && insideQuotes) {
                     data.textWasQuoted[data.textWasQuoted.length - 1] = true;
@@ -137,7 +243,7 @@ function _handleAddress(tokens, depth) {
                 // Security: Do not extract email addresses from quoted strings.
                 // RFC 5321 allows @ inside quoted local-parts like "user@domain"@example.com.
                 // Extracting emails from quoted text leads to misrouting vulnerabilities.
-                if (!data.textWasQuoted[i] && /^[^@\s]+@[^@\s]+$/.test(data.text[i])) {
+                if (!data.textWasQuoted[i] && ADDR_SPEC.test(data.text[i])) {
                     data.address = data.text.splice(i, 1);
                     data.textWasQuoted.splice(i, 1);
                     break;
@@ -187,6 +293,8 @@ function _handleAddress(tokens, depth) {
         data.text = data.text.join(' ');
         data.address = data.address.join(' ');
 
+        _recoverAddrSpec(data);
+
         const address = {
             address: data.address || data.text || '',
             name: data.text || data.address || ''
@@ -402,8 +510,10 @@ function addressparser(str, options) {
 
     addresses.forEach(addr => {
         const handled = _handleAddress(addr, depth);
-        if (handled.length) {
-            parsedAddresses = parsedAddresses.concat(handled);
+        // Appended in place. Rebuilding the accumulator with concat() would copy every
+        // entry collected so far on each address, making a flat list cost O(n^2).
+        for (let i = 0; i < handled.length; i++) {
+            parsedAddresses.push(handled[i]);
         }
     });
 
@@ -411,14 +521,20 @@ function addressparser(str, options) {
     // "Joe Foo, PhD <joe@example.com>" is split on the comma into
     // [{name:"Joe Foo", address:""}, {name:"PhD", address:"joe@example.com"}].
     // Recombine: a name-only entry followed by an entry with both name and address.
-    for (let i = parsedAddresses.length - 2; i >= 0; i--) {
+    // Walked back to front so that a run of fragments folds into one entry in a single
+    // pass. Splicing each fragment out of the list instead would cost O(n^2).
+    const mergedAddresses = [];
+    for (let i = parsedAddresses.length - 1; i >= 0; i--) {
         const current = parsedAddresses[i];
-        const next = parsedAddresses[i + 1];
-        if (current.address === '' && current.name && !current.group && next.address && next.name) {
+        const next = mergedAddresses.length ? mergedAddresses[mergedAddresses.length - 1] : null;
+        if (next && current.address === '' && current.name && !current.group && next.address && next.name) {
             next.name = current.name + ', ' + next.name;
-            parsedAddresses.splice(i, 1);
+        } else {
+            mergedAddresses.push(current);
         }
     }
+    mergedAddresses.reverse();
+    parsedAddresses = mergedAddresses;
 
     if (options.flatten) {
         const flatAddresses = [];

package/lib/dkim/index.js

@@ -10,6 +10,7 @@ const { PassThrough } = require('stream');
 const fs = require('fs');
 const path = require('path');
 const crypto = require('crypto');
+const { copyOwnKeys } = require('../shared/objects');
 
 const DKIM_ALGO = 'sha256';
 const MAX_MESSAGE_SIZE = 2 * 1024 * 1024; // buffer messages larger than this to disk
@@ -225,7 +226,11 @@ class DKIM {
 
         let options = this.options;
         if (extraOptions && Object.keys(extraOptions).length) {
-            options = Object.assign({}, extraOptions, this.options);
+            // extraOptions is mail.data._dkim, caller supplied message data. An own
+            // "__proto__" key there would let every option this signer reads and the
+            // transport did not set, such as skipFields, answer from the caller
+            options = copyOwnKeys({}, extraOptions);
+            copyOwnKeys(options, this.options);
         }
 
         const signer = new DKIMSigner(options, this.keys, inputStream, output);

package/lib/errors.js

@@ -38,6 +38,7 @@ const ERROR_CODES = {
 
     // Resource errors
     EMAXLIMIT: 'Pool resource limit reached (max messages per connection)',
+    EMAXRECIPIENTS: 'Recipient count exceeds maxRecipients',
 
     // Transport-specific errors
     ESENDMAIL: 'Sendmail command error',

package/lib/fetch/index.js

@@ -9,9 +9,67 @@ const Cookies = require('./cookies');
 const packageData = require('../../package.json');
 const net = require('net');
 const errors = require('../errors');
+const { isProtoKey } = require('../shared/objects');
 
 const MAX_REDIRECTS = 5;
 
+// Only genuine TLS settings are taken from options.tls. That object reaches us straight
+// from a user supplied attachment (content.tls), so keys like host, port, path, socketPath
+// or lookup would otherwise repoint the request at a destination that never went through
+// the URL checks below.
+//
+// The source of truth is the tls.connect() option list in the Node docs. A key missing
+// here is dropped silently, so extend this list rather than working around it.
+const TLS_OPTION_KEYS = [
+    'ALPNProtocols',
+    'ca',
+    'cert',
+    'checkServerIdentity',
+    'ciphers',
+    'crl',
+    'dhparam',
+    'ecdhCurve',
+    'honorCipherOrder',
+    'key',
+    'maxVersion',
+    'minVersion',
+    'passphrase',
+    'pfx',
+    'rejectUnauthorized',
+    'secureContext',
+    'secureOptions',
+    'secureProtocol',
+    'servername',
+    'sessionIdContext',
+    'sigalgs'
+];
+
+/**
+ * Resolves a URL only if it is one this module is willing to request.
+ *
+ * urllib.parse throws for a host that contains forbidden bytes, and it is called for
+ * every URL that reaches nmfetch, including ones that arrive from a message attachment
+ * or from a redirect Location header. An uncaught throw here takes the process down,
+ * so a URL that does not parse is reported the same way as one with a scheme we refuse.
+ *
+ * @param {String} url URL to parse
+ * @returns {Object|Boolean} Parsed URL, or false if it is not a usable http(s) URL
+ */
+function parseFetchUrl(url) {
+    let parsed;
+    try {
+        parsed = urllib.parse(url);
+    } catch (_err) {
+        return false;
+    }
+
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+        return false;
+    }
+
+    return parsed;
+}
+
 module.exports = function (url, options) {
     return nmfetch(url, options);
 };
@@ -26,6 +84,30 @@ function nmfetch(url, options) {
     options.redirects = options.redirects || 0;
     options.maxRedirects = isNaN(options.maxRedirects) ? MAX_REDIRECTS : options.maxRedirects;
 
+    const fetchRes = options.fetchRes;
+    const parsed = parseFetchUrl(url);
+
+    if (!parsed) {
+        // Only http(s) URLs can be fetched. Any other scheme (file:, gopher:, a
+        // protocol-relative redirect target etc.) would otherwise be silently served over
+        // plain HTTP, possibly against an unintended host. Bail out before the cookie jar
+        // is touched so a refused URL can not seed it, and release a caller supplied body:
+        // this is the one exit that runs before the error handler below is attached to it,
+        // so an error on that stream would have nowhere to go and the fd or socket behind
+        // it would never be released.
+        if (options.body && typeof options.body.destroy === 'function') {
+            options.body.on('error', () => false);
+            options.body.destroy();
+        }
+        setImmediate(() => {
+            const err = new Error('Unsupported protocol for URL ' + url);
+            err.code = errors.EFETCH;
+            err.sourceUrl = url;
+            fetchRes.emit('error', err);
+        });
+        return fetchRes;
+    }
+
     if (options.cookie) {
         [].concat(options.cookie || []).forEach(cookie => {
             options.cookies.set(cookie, url);
@@ -33,8 +115,6 @@ function nmfetch(url, options) {
         options.cookie = false;
     }
 
-    const fetchRes = options.fetchRes;
-    const parsed = urllib.parse(url);
     let method = (options.method || '').toString().trim().toUpperCase() || 'GET';
     let finished = false;
     let cookies;
@@ -48,6 +128,10 @@ function nmfetch(url, options) {
     };
 
     Object.keys(options.headers || {}).forEach(key => {
+        // options.headers is the caller's httpHeaders, straight off an attachment
+        if (isProtoKey(key.toLowerCase().trim())) {
+            return;
+        }
         headers[key.toLowerCase().trim()] = options.headers[key];
     });
 
@@ -131,7 +215,12 @@ function nmfetch(url, options) {
     };
 
     if (options.tls) {
-        Object.assign(reqOptions, options.tls);
+        // see TLS_OPTION_KEYS
+        Object.keys(options.tls).forEach(key => {
+            if (TLS_OPTION_KEYS.includes(key)) {
+                reqOptions[key] = options.tls[key];
+            }
+        });
     }
 
     if (
@@ -216,8 +305,29 @@ function nmfetch(url, options) {
             options.method = 'GET';
             options.body = false;
 
-            const redirectUrl = urllib.resolve(url, res.headers.location);
-            const redirectParsed = urllib.parse(redirectUrl);
+            let redirectUrl;
+            try {
+                redirectUrl = urllib.resolve(url, res.headers.location);
+            } catch (_err) {
+                // the legacy resolver throws on a Location the WHATWG parser also refused,
+                // so fall through to the check below with what the server actually sent
+                redirectUrl = res.headers.location;
+            }
+            const redirectParsed = parseFetchUrl(redirectUrl);
+
+            if (!redirectParsed) {
+                // Refuse the redirect target here rather than leaving it to the recursive
+                // call: that call gets its own `finished` flag and no handle on this
+                // request, so this one would stay open and could emit a second error on
+                // the shared fetchRes once it times out. Callers listen with req.once().
+                finished = true;
+                const err = new Error('Unsupported protocol for URL ' + redirectUrl);
+                err.code = errors.EFETCH;
+                err.sourceUrl = redirectUrl;
+                fetchRes.emit('error', err);
+                req.abort();
+                return;
+            }
 
             // Do not forward credentials when the redirect leaves the original
             // security context: a different host, or a downgrade from https to

package/lib/mail-composer/index.js

@@ -4,7 +4,7 @@
 
 const MimeNode = require('../mime-node');
 const mimeFuncs = require('../mime-funcs');
-const { parseDataURI } = require('../shared');
+const { parseDataURI, copyOwnKeys } = require('../shared');
 
 /**
  * Creates the object for composing a MimeNode instance out from the mail options
@@ -205,7 +205,9 @@ class MailComposer {
                 typeof this.mail.icalEvent === 'object' &&
                 (this.mail.icalEvent.content || this.mail.icalEvent.path || this.mail.icalEvent.href || this.mail.icalEvent.raw)
             ) {
-                icalEvent = Object.assign({}, this.mail.icalEvent);
+                // an own "__proto__" key would make the copy inherit path/href from caller
+                // data, and the mapping below then replaces the content the caller did set
+                icalEvent = copyOwnKeys({}, this.mail.icalEvent);
             } else {
                 icalEvent = {
                     content: this.mail.icalEvent
@@ -600,7 +602,7 @@ class MailComposer {
             }
 
             // Return empty content for excessively long data URLs
-            return Object.assign({}, element, {
+            return Object.assign(copyOwnKeys({}, element), {
                 path: false,
                 href: false,
                 content: Buffer.alloc(0),

package/lib/mailer/index.js

@@ -15,6 +15,13 @@ const net = require('net');
 const dns = require('dns');
 const crypto = require('crypto');
 
+/**
+ * Recipients allowed on one message unless the caller sets its own maxRecipients. A backstop
+ * against a runaway or hostile recipient list rather than a delivery policy: RFC 5321 only
+ * asks a server to accept 100, so a real send is bounded far below this.
+ */
+const DEFAULT_MAX_RECIPIENTS = 100000;
+
 /**
  * Creates an object for exposing the Mail API
  *
@@ -191,6 +198,26 @@ class Mail extends EventEmitter {
             mail.setPriorityHeaders();
             mail.setListHeaders();
 
+            const maxRecipients = mail.data.maxRecipients === undefined ? DEFAULT_MAX_RECIPIENTS : mail.data.maxRecipients;
+            const recipientCount = mail.message.getEnvelope().to.length;
+
+            if (maxRecipients && recipientCount > maxRecipients) {
+                const err = new Error(
+                    `Message has ${recipientCount} recipients, which is over the ${maxRecipients} allowed by maxRecipients`
+                );
+                err.code = errors.EMAXRECIPIENTS;
+                this.logger.error(
+                    {
+                        err,
+                        tnx: 'transport',
+                        action: 'send'
+                    },
+                    'Send Error: %s',
+                    err.message
+                );
+                return callback(err);
+            }
+
             this._processPlugins('stream', mail, err => {
                 if (err) {
                     this.logger.error(

package/lib/mailer/mail-message.js

@@ -4,6 +4,11 @@ const shared = require('../shared');
 const MimeNode = require('../mime-node');
 const mimeFuncs = require('../mime-funcs');
 
+// Only an own key counts as already set. `key in obj` also matches every member of
+// Object.prototype, which silently drops a transporter default legitimately named
+// toString or constructor.
+const hasOwn = (obj, key) => Object.prototype.hasOwnProperty.call(obj, key);
+
 class MailMessage {
     constructor(mailer, data) {
         this.mailer = mailer;
@@ -14,26 +19,19 @@ class MailMessage {
         const options = mailer.options || {};
         const defaults = mailer._defaults || {};
 
-        Object.assign(this.data, data);
+        shared.copyOwnKeys(this.data, data);
 
         this.data.headers = this.data.headers || {};
 
-        // apply defaults
-        Object.keys(defaults).forEach(key => {
-            if (!(key in this.data)) {
-                this.data[key] = defaults[key];
-            } else if (key === 'headers') {
-                // headers is a special case. Allow setting individual default headers
-                Object.keys(defaults.headers).forEach(key => {
-                    if (!(key in this.data.headers)) {
-                        this.data.headers[key] = defaults.headers[key];
-                    }
-                });
-            }
-        });
+        // Apply defaults. `_defaults` is caller supplied too, it is the second argument of
+        // createTransport, so it needs the same treatment as `data` above
+        shared.copyOwnKeys(this.data, defaults, key => hasOwn(this.data, key));
+
+        // headers is a special case. Allow setting individual default headers
+        shared.copyOwnKeys(this.data.headers, defaults.headers, key => hasOwn(this.data.headers, key));
 
         // force specific keys from transporter options
-        ['disableFileAccess', 'disableUrlAccess', 'normalizeHeaderKey'].forEach(key => {
+        ['disableFileAccess', 'disableUrlAccess', 'normalizeHeaderKey', 'maxRecipients'].forEach(key => {
             if (key in options) {
                 this.data[key] = options[key];
             }
@@ -123,11 +121,12 @@ class MailMessage {
                         content: value
                     };
                     if (args[0][args[1]] && typeof args[0][args[1]] === 'object' && !Buffer.isBuffer(args[0][args[1]])) {
-                        Object.keys(args[0][args[1]]).forEach(key => {
-                            if (!(key in node) && !['content', 'path', 'href', 'raw'].includes(key)) {
-                                node[key] = args[0][args[1]][key];
-                            }
-                        });
+                        // The keys are the caller's, so copying them takes the same "__proto__"
+                        // rule as the constructor. `key in node` stays as the already-set test
+                        // here, unlike for the defaults: it also skips the Object.prototype
+                        // member names, and letting message data land a `toString` string on a
+                        // node only buys a TypeError the first time something stringifies it.
+                        shared.copyOwnKeys(node, args[0][args[1]], key => key in node || ['content', 'path', 'href', 'raw'].includes(key));
                     }
 
                     args[0][args[1]] = node;
@@ -186,6 +185,9 @@ class MailMessage {
 
             data.normalizedHeaders = {};
             Object.keys(data.headers || {}).forEach(key => {
+                if (shared.isProtoKey(key)) {
+                    return;
+                }
                 let value = [].concat(data.headers[key] || []).shift();
                 value = (value && value.value) || value;
                 if (value) {

package/lib/mime-funcs/index.js

@@ -5,6 +5,7 @@
 const base64 = require('../base64');
 const qp = require('../qp');
 const mimeTypes = require('./mime-types');
+const { isProtoKey } = require('../shared/objects');
 
 module.exports = {
     /**
@@ -381,6 +382,16 @@ module.exports = {
             value: false,
             params: {}
         };
+
+        // Parameter names come from a caller supplied contentType/contentDisposition. A
+        // "__proto__" name would target the prototype chain of the params object instead of
+        // an own property of it, and read back as Object.prototype, so it is dropped.
+        const setParam = (name, value) => {
+            if (!isProtoKey(name)) {
+                response.params[name] = value;
+            }
+        };
+
         let key = false;
         let value = '';
         let type = 'value';
@@ -412,7 +423,7 @@ module.exports = {
                     if (key === false) {
                         response.value = value.trim();
                     } else {
-                        response.params[key] = value.trim();
+                        setParam(key, value.trim());
                     }
                     type = 'key';
                     value = '';
@@ -427,10 +438,10 @@ module.exports = {
             if (key === false) {
                 response.value = value.trim();
             } else {
-                response.params[key] = value.trim();
+                setParam(key, value.trim());
             }
         } else if (value.trim()) {
-            response.params[value.trim().toLowerCase()] = '';
+            setParam(value.trim().toLowerCase(), '');
         }
 
         // handle parameter value continuations
@@ -443,6 +454,14 @@ module.exports = {
                 actualKey = key.substr(0, match.index);
                 nr = Number(match[2] || match[3]) || 0;
 
+                if (isProtoKey(actualKey)) {
+                    // see setParam. Reading it back would yield Object.prototype, which is
+                    // an object, so the initializer below would be skipped and the write
+                    // that follows would throw out of a header build the caller can not catch
+                    delete response.params[key];
+                    return;
+                }
+
                 if (!response.params[actualKey] || typeof response.params[actualKey] !== 'object') {
                     response.params[actualKey] = {
                         charset: false,
@@ -569,7 +588,7 @@ module.exports = {
      */
     splitMimeEncodedString: (str, maxlen) => {
         const lines = [];
-        let curLine, match, chr, done;
+        let curLine, fallbackLine, match, chr, done;
 
         // require at least 12 symbols to fit possible 4 octet UTF-8 sequences
         maxlen = Math.max(maxlen || 0, 12);
@@ -582,8 +601,14 @@ module.exports = {
                 curLine = curLine.substr(0, match.index);
             }
 
+            // Malformed input (a run of stray UTF-8 continuation bytes) has no split point
+            // that keeps a character sequence whole, so the loop below walks back to an
+            // empty line looking for one. Keep the widest chunk that at least does not cut
+            // a "=XX" escape in half, so the part stays a decodable encoded word.
+            fallbackLine = curLine.length ? curLine : str.substr(0, maxlen);
+
             done = false;
-            while (!done) {
+            while (!done && curLine.length) {
                 done = true;
                 // check if not middle of a unicode char sequence
                 if ((match = str.substr(curLine.length).match(/^[=]([0-9A-F]{2})/i))) {
@@ -596,9 +621,11 @@ module.exports = {
                 }
             }
 
-            if (curLine.length) {
-                lines.push(curLine);
+            if (!curLine.length) {
+                curLine = fallbackLine;
             }
+
+            lines.push(curLine);
             str = str.substr(curLine.length);
         }
 

package/lib/mime-node/index.js

@@ -7,6 +7,7 @@ const fs = require('fs');
 const punycode = require('../punycode');
 const { PassThrough } = require('stream');
 const shared = require('../shared');
+const urlModule = require('url');
 
 const mimeFuncs = require('../mime-funcs');
 const qp = require('../qp');
@@ -35,6 +36,45 @@ const QUOTED_STRING = /^"(?:[^"\\]|\\[\s\S])*"$/;
 // the envelope carries
 const PLAIN_ADDRESS = /^[^\s"(),:;<>@[\\\]]+@[^\s"(),:;<>@[\\\]]+$/;
 
+// domainToASCII and domainToUnicode are WHATWG host parsers rather than plain IDNA
+// mappers, so they do more than map: they cut the host at '/', '\\', '?' and '#', drop C0
+// controls, and percent-decode. Handing them 'evil.example/mail.corp.example' returns the
+// deliverable 'evil.example', which would turn a value the bundled codec leaves as
+// unroutable garbage into mail for a domain the sender never named. None of these
+// characters are legal in a domain, so keep them away from the mapper.
+const URL_PARSER_UNSAFE = /[/\\?#%\x00-\x20\x7F]/;
+
+/**
+ * Encodes a domain the way browsers, the WHATWG URL Standard and DNS facing resolvers do,
+ * which is with UTS-46 mapping applied before the Punycode step.
+ *
+ * The bundled codec is plain RFC 3492 and maps nothing, so it disagrees with every
+ * conformant parser on any domain holding a mapped or ignored code point. An invisible
+ * U+00AD in 'compa\u00ADny.com' encoded to 'xn--company-pka.com' where a validator reads
+ * 'company.com', which let an allow-listed domain be checked and a different one mailed.
+ *
+ * Anything the URL parser does not accept as a hostname, an address literal such as
+ * '[127.0.0.1]' included, comes back empty and falls through to the bundled codec, which
+ * leaves those as they were supplied.
+ *
+ * @param {String} domain Domain to encode, already lowercased by the caller
+ * @param {Boolean} toUnicode Return the U-label form instead of the A-label form
+ * @return {String} Encoded domain
+ */
+function normalizeDomain(domain, toUnicode) {
+    // domainToASCII and domainToUnicode landed in Node 7, the bundled codec covers Node 6
+    const mapper = toUnicode ? urlModule.domainToUnicode : urlModule.domainToASCII;
+
+    if (typeof mapper === 'function' && !URL_PARSER_UNSAFE.test(domain)) {
+        const mapped = mapper(domain);
+        if (mapped) {
+            return mapped;
+        }
+    }
+
+    return toUnicode ? punycode.toUnicode(domain) : punycode.toASCII(domain);
+}
+
 /**
  * Creates a new mime tree node. Assumes 'multipart/*' as the content type
  * if it is a branch, anything else counts as leaf. If rootNode is missing from
@@ -533,11 +573,10 @@ class MimeNode {
             const formattedHeaders = FORMATTED_HEADERS;
 
             if (value && typeof value === 'object' && !formattedHeaders.includes(key)) {
-                Object.keys(value).forEach(key => {
-                    if (key !== 'value') {
-                        options[key] = value[key];
-                    }
-                });
+                // the keys come from a caller supplied header object and `options.prepared`
+                // below decides whether the value is emitted raw, so an own "__proto__" key
+                // here would turn an unfolded value into header injection
+                shared.copyOwnKeys(options, value, optionKey => optionKey === 'value');
                 value = (value.value || '').toString();
                 if (!value.trim()) {
                     return;
@@ -873,20 +912,17 @@ class MimeNode {
                 this._envelope.from = list[0].address;
             }
         }
+        const seenRecipients = new Set();
         ['to', 'cc', 'bcc'].forEach(key => {
             if (envelope[key]) {
-                this._convertAddresses(this._parseEnvelopeAddresses(envelope[key]), this._envelope.to);
+                this._convertAddresses(this._parseEnvelopeAddresses(envelope[key]), this._envelope.to, seenRecipients);
             }
         });
 
         this._envelope.to = this._envelope.to.map(to => to.address).filter(address => address);
 
         const standardFields = ['to', 'cc', 'bcc', 'from'];
-        Object.keys(envelope).forEach(key => {
-            if (!standardFields.includes(key)) {
-                this._envelope[key] = envelope[key];
-            }
-        });
+        shared.copyOwnKeys(this._envelope, envelope, key => standardFields.includes(key));
 
         return this;
     }
@@ -898,15 +934,17 @@ class MimeNode {
      */
     getAddresses() {
         const addresses = {};
+        const seenByKey = new Map();
 
         this._headers.forEach(header => {
             const key = header.key.toLowerCase();
             if (['from', 'sender', 'reply-to', 'to', 'cc', 'bcc'].includes(key)) {
                 if (!Array.isArray(addresses[key])) {
                     addresses[key] = [];
+                    seenByKey.set(key, new Set());
                 }
 
-                this._convertAddresses(this._parseAddresses(header.value), addresses[key]);
+                this._convertAddresses(this._parseAddresses(header.value), addresses[key], seenByKey.get(key));
             }
         });
 
@@ -927,6 +965,12 @@ class MimeNode {
             from: false,
             to: []
         };
+
+        // Built once and carried across the headers. Letting _convertAddresses seed it per
+        // call would cost O(headers x recipients), and a message can carry many address
+        // headers: `headers: { to: [...] }` emits one To per entry.
+        const seenRecipients = new Set();
+
         this._headers.forEach(header => {
             const list = [];
             if (header.key === 'From' || (!envelope.from && ['Reply-To', 'Sender'].includes(header.key))) {
@@ -935,7 +979,7 @@ class MimeNode {
                     envelope.from = list[0].address;
                 }
             } else if (['To', 'Cc', 'Bcc'].includes(header.key)) {
-                this._convertAddresses(this._parseAddresses(header.value), envelope.to);
+                this._convertAddresses(this._parseAddresses(header.value), envelope.to, seenRecipients);
             }
         });
 
@@ -1035,7 +1079,9 @@ class MimeNode {
                 });
                 return contentStream;
             }
-            // fetch URL
+            // fetch URL. nmfetch refuses any scheme that is not http(s), and it decides
+            // that on the parsed URL. Testing the raw string here instead would reject
+            // forms the parser accepts, such as a leading space or a slash-less authority
             return nmfetch(content.href, { headers: content.httpHeaders, tls: content.tls });
         }
 
@@ -1060,26 +1106,38 @@ class MimeNode {
      * @return {Array} An array of address objects
      */
     _parseAddresses(addresses) {
-        return [].concat.apply(
-            [],
-            [].concat(addresses).map(address => {
-                if (address && address.address) {
-                    const normalized = this._normalizeAddress(address.address);
-                    if (normalized === address.address && typeof address.name === 'string') {
-                        // there is nothing to rewrite, so there is nothing to keep off the original
-                        return [address];
-                    }
-
-                    // rewriting would land on the object the caller passed in and might
-                    // still hold a reference to, so rewrite a copy of it instead
-                    const copy = Object.assign({}, address);
-                    copy.address = normalized;
-                    copy.name = address.name || '';
-                    return [copy];
+        // Collected into one list as we go. concat.apply spreads the entries into arguments
+        // and throws a RangeError once a recipient array is long enough to pass the
+        // argument limit, which a large Bcc list reaches on its own.
+        const flattened = [];
+
+        [].concat(addresses).forEach(address => {
+            if (address && address.address) {
+                const normalized = this._normalizeAddress(address.address);
+                if (normalized === address.address && typeof address.name === 'string') {
+                    // there is nothing to rewrite, so there is nothing to keep off the original
+                    flattened.push(address);
+                    return;
                 }
-                return this._normalizeParsedAddresses(addressparser(address));
-            })
-        );
+
+                // rewriting would land on the object the caller passed in and might
+                // still hold a reference to, so rewrite a copy of it instead. An own
+                // "__proto__" key would make the copy inherit from caller data, and
+                // _convertAddresses reads `group` off it straight into the envelope
+                const copy = shared.copyOwnKeys({}, address);
+                copy.address = normalized;
+                copy.name = address.name || '';
+                flattened.push(copy);
+                return;
+            }
+
+            const parsed = this._normalizeParsedAddresses(addressparser(address));
+            for (let i = 0; i < parsed.length; i++) {
+                flattened.push(parsed[i]);
+            }
+        });
+
+        return flattened;
     }
 
     /**
@@ -1268,11 +1326,22 @@ class MimeNode {
      * @param {Array} [uniqueList] An array to be populated with addresses
      * @return {String} address string
      */
-    _convertAddresses(addresses, uniqueList) {
+    _convertAddresses(addresses, uniqueList, seenAddresses) {
         const values = [];
 
         uniqueList = uniqueList || [];
 
+        // Membership is checked once per address, so scanning uniqueList itself would make
+        // a recipient list cost O(n^2). Groups recurse with the same set so that a nested
+        // group still dedupes against the addresses collected around it, and a caller that
+        // passes a partly filled list (To, then Cc, then Bcc) keeps deduping across headers.
+        if (!seenAddresses) {
+            seenAddresses = new Set();
+            for (let i = 0; i < uniqueList.length; i++) {
+                seenAddresses.add(uniqueList[i].address);
+            }
+        }
+
         [].concat(addresses || []).forEach(address => {
             if (address.address) {
                 address.address = this._normalizeAddress(address.address);
@@ -1287,11 +1356,14 @@ class MimeNode {
                     values.push(`${this._encodeAddressName(address.name)} <${address.address}>`);
                 }
 
-                if (!uniqueList.some(a => a.address === address.address)) {
+                if (!seenAddresses.has(address.address)) {
+                    seenAddresses.add(address.address);
                     uniqueList.push(address);
                 }
             } else if (address.group) {
-                const groupListAddresses = (address.group.length ? this._convertAddresses(address.group, uniqueList) : '').trim();
+                const groupListAddresses = (
+                    address.group.length ? this._convertAddresses(address.group, uniqueList, seenAddresses) : ''
+                ).trim();
                 values.push(`${this._encodeAddressName(address.name)}:${groupListAddresses};`);
             }
         });
@@ -1334,12 +1406,12 @@ class MimeNode {
 
         let encodedDomain = domain;
 
+        // A non-ASCII local part already requires SMTPUTF8, so the domain stays UTF-8 for
+        // symmetry on both sides of the '@' rather than being encoded to an A-label
+        const smtputf8 = /[\x80-\uFFFF]/.test(user);
+
         try {
-            if (/[\x80-\uFFFF]/.test(user)) {
-                encodedDomain = punycode.toUnicode(domain.toLowerCase());
-            } else {
-                encodedDomain = punycode.toASCII(domain.toLowerCase());
-            }
+            encodedDomain = normalizeDomain(domain.toLowerCase(), smtputf8);
         } catch (_err) {
             // keep domain as supplied
         }

package/lib/ses-transport/index.js

@@ -130,7 +130,8 @@ class SESTransport extends EventEmitter {
                     return callback(err);
                 }
 
-                const sesMessage = Object.assign(
+                // mail.data.ses is caller supplied message data, so copy its own keys only
+                const sesMessage = shared.copyOwnKeys(
                     {
                         Content: {
                             Raw: {
@@ -143,7 +144,7 @@ class SESTransport extends EventEmitter {
                             ToAddresses: envelope.to
                         }
                     },
-                    mail.data.ses || {}
+                    mail.data.ses
                 );
 
                 this.getRegion((err, region) => {

package/lib/shared/index.js

@@ -7,10 +7,15 @@ const util = require('util');
 const fs = require('fs');
 const nmfetch = require('../fetch');
 const errors = require('../errors');
+const objects = require('./objects');
 const dns = require('dns');
 const net = require('net');
 const os = require('os');
 
+// re-exported for the callers that already depend on this module, see ./objects
+const isProtoKey = (module.exports.isProtoKey = objects.isProtoKey);
+module.exports.copyOwnKeys = objects.copyOwnKeys;
+
 const DNS_TTL = 5 * 60 * 1000;
 const CACHE_CLEANUP_INTERVAL = 30 * 1000; // Minimum 30 seconds between cleanups
 const MAX_CACHE_SIZE = 1000; // Maximum number of entries in cache
@@ -355,7 +360,9 @@ module.exports.parseConnectionUrl = str => {
             return;
         }
 
-        if (!(lKey in obj)) {
+        // `in` already keeps "__proto__" out, but only as a side effect of it being an
+        // Object.prototype member. Say it, so the protection survives a change to the check
+        if (!isProtoKey(lKey) && !(lKey in obj)) {
             obj[lKey] = value;
         }
     });
@@ -470,7 +477,7 @@ module.exports.parseDataURI = uri => {
             // Ensure there's a key before the '='
             const key = entry.substring(0, sepPos).trim();
             const value = entry.substring(sepPos + 1).trim();
-            if (key) {
+            if (key && !isProtoKey(key)) {
                 params[key] = value;
             }
         }
@@ -561,19 +568,24 @@ function resolveContentValue(data, key, options, callback) {
                 }
                 callback(null, value);
             });
-        } else if (/^https?:\/\//i.test(content.path || content.href)) {
+        } else if (/^data:/i.test(content.path || content.href)) {
+            const parsedDataUri = module.exports.parseDataURI(content.path || content.href);
+
+            return callback(null, parsedDataUri && parsedDataUri.data ? parsedDataUri.data : Buffer.alloc(0));
+        } else if (content.href || /^https?:\/\//i.test(content.path)) {
+            // An href is always a URL, and so is a path that looks like one. Let nmfetch
+            // decide whether it is fetchable, it validates the parsed URL. Testing the raw
+            // string here instead would let a file: href fall through to the "return as is"
+            // default below and travel on inside the resolved message.
+            const url = content.href || content.path;
             if (options.disableUrlAccess) {
                 return setImmediate(() => {
-                    const err = new Error('Url access rejected for ' + (content.path || content.href));
+                    const err = new Error('Url access rejected for ' + url);
                     err.code = errors.EURLACCESS;
                     callback(err);
                 });
             }
-            return resolveStream(nmfetch(content.path || content.href, { headers: content.httpHeaders, tls: content.tls }), callback);
-        } else if (/^data:/i.test(content.path || content.href)) {
-            const parsedDataUri = module.exports.parseDataURI(content.path || content.href);
-
-            return callback(null, parsedDataUri && parsedDataUri.data ? parsedDataUri.data : Buffer.alloc(0));
+            return resolveStream(nmfetch(url, { headers: content.httpHeaders, tls: content.tls }), callback);
         } else if (content.path) {
             if (options.disableFileAccess) {
                 return setImmediate(() => {
@@ -603,10 +615,14 @@ module.exports.assign = function (/* target, ... sources */) {
 
     args.forEach(source => {
         Object.keys(source || {}).forEach(key => {
+            if (isProtoKey(key)) {
+                return;
+            }
             if (['tls', 'auth'].includes(key) && source[key] && typeof source[key] === 'object') {
                 // tls and auth are special keys that need to be enumerated separately
-                // other objects are passed as is
-                target[key] = Object.assign(target[key] || {}, source[key]);
+                // other objects are passed as is. Enumerating is a copy of user supplied
+                // keys just like the loop above, so it gets the same treatment
+                target[key] = module.exports.copyOwnKeys(target[key] || {}, source[key]);
             } else {
                 target[key] = source[key];
             }

package/lib/shared/objects.js

@@ -0,0 +1,42 @@
+'use strict';
+
+// Safe copying of objects whose keys come from the caller.
+//
+// This lives in its own leaf module, like ./url.js, so that every layer can reach it.
+// lib/shared/index.js requires lib/fetch, so lib/fetch can not require lib/shared back,
+// and lib/mime-funcs is a leaf that would otherwise pull in dns/net/os/fs for a string
+// comparison. lib/shared/index.js re-exports both functions for the callers that already
+// depend on it.
+
+/**
+ * Detects a key that can not be copied onto a plain object with `target[key] = value`.
+ *
+ * "__proto__" is the only one: assigning it runs the inherited setter and replaces the
+ * prototype of the target instead of adding a property to it, so a caller can smuggle
+ * values past validation that only inspects own keys. JSON.parse produces such a key
+ * where an object literal can not. "constructor" and "prototype" have no such setter and
+ * become ordinary own properties, so dropping them would only discard legitimate values.
+ *
+ * @param {String} key Key to check
+ * @returns {Boolean} true if the key must not be copied
+ */
+module.exports.isProtoKey = key => key === '__proto__';
+
+/**
+ * Copies own enumerable keys from a source object to a target object. Every copy that
+ * walks the keys of user supplied data goes through here, see isProtoKey.
+ *
+ * @param {Object} target Object to copy the keys to
+ * @param {Object} source Object to copy the keys from
+ * @param {Function} [skip] Optional predicate, return true to leave a key out
+ * @returns {Object} The target object
+ */
+module.exports.copyOwnKeys = (target, source, skip) => {
+    Object.keys(source || {}).forEach(key => {
+        if (module.exports.isProtoKey(key) || (skip && skip(key))) {
+            return;
+        }
+        target[key] = source[key];
+    });
+    return target;
+};

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "nodemailer",
-    "version": "9.0.5",
+    "version": "9.1.0",
     "description": "Easy as cake e-mail sending from your Node.js applications",
     "main": "lib/nodemailer.js",
     "scripts": {
@@ -27,19 +27,19 @@
     },
     "homepage": "https://nodemailer.com/",
     "devDependencies": {
-        "@aws-sdk/client-sesv2": "3.1104.0",
+        "@aws-sdk/client-sesv2": "3.1121.0",
         "bunyan": "1.8.15",
         "c8": "12.0.0",
-        "eslint": "10.8.0",
+        "eslint": "10.9.1",
         "eslint-config-prettier": "10.1.8",
-        "globals": "17.9.0",
+        "globals": "17.11.0",
         "libbase64": "1.3.0",
-        "libmime": "5.4.1",
+        "libmime": "5.4.2",
         "libqp": "2.1.1",
         "prettier": "3.9.6",
         "proxy": "1.0.2",
         "proxy-test-server": "1.0.0",
-        "smtp-server": "3.19.2"
+        "smtp-server": "3.19.4"
     },
     "engines": {
         "node": ">=6.0.0"