nodemailer 9.0.6 → 9.1.0

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # CHANGELOG
 
+## [9.1.0](https://github.com/nodemailer/nodemailer/compare/v9.0.6...v9.1.0) (2026-08-31)
+
+
+### Features
+
+* **mailer:** cap recipients per message with maxRecipients ([7279ac8](https://github.com/nodemailer/nodemailer/commit/7279ac8dee4f66c032981e6e51e3e7210ad0dcbf))
+
+
+### Bug Fixes
+
+* **addressparser:** handle address lists in linear time ([9116da9](https://github.com/nodemailer/nodemailer/commit/9116da9528c6524cefaed75185602a7e85d20434))
+* **addressparser:** terminate the domain at an RFC 5322 comment ([902b63e](https://github.com/nodemailer/nodemailer/commit/902b63e935435c30f4025901c0902dce64cd8880))
+* **mime-node:** apply UTS-46 mapping when encoding a domain ([259c32d](https://github.com/nodemailer/nodemailer/commit/259c32d7d266301e3377a212776c3fff993c0148))
+* **mime-node:** dedupe envelope recipients in linear time ([7cc38af](https://github.com/nodemailer/nodemailer/commit/7cc38af418ffa6fc7e86085195ca5ca681694b3e))
+* **mime-node:** flatten parsed addresses without concat.apply ([83b8c48](https://github.com/nodemailer/nodemailer/commit/83b8c48cbdb8b3116f2e1ba84af755b2c5661c0f))
+* **mime-node:** keep the recipient dedupe linear across address headers ([34da642](https://github.com/nodemailer/nodemailer/commit/34da64282dcdc9b0581c721a27ab2fa226673150))
+* **mime-node:** keep URL delimiters away from the domain mapper ([b212ac4](https://github.com/nodemailer/nodemailer/commit/b212ac4e27bce8182478044fcb8d1642ccdad46e))
+
 ## [9.0.6](https://github.com/nodemailer/nodemailer/compare/v9.0.5...v9.0.6) (2026-08-27)
 
 

package/lib/addressparser/index.js

@@ -184,7 +184,18 @@ function _handleAddress(tokens, depth) {
                 token.value = token.value.replace(/^[^<]*<\s*/, '');
             }
 
-            if (prevToken && prevToken.noBreak && data[state].length) {
+            // A comment is folding whitespace. It may sit inside an addr-spec, on either side
+            // of the '@', but it cannot join two atoms into one: gluing across it would read
+            // 'user@example.com(x)evil.com' as the single domain 'example.comevil.com' and
+            // deliver to a domain the sender never named.
+            const parts = data[state];
+            const joins =
+                prevToken &&
+                prevToken.noBreak &&
+                parts.length &&
+                (prevToken.value !== ')' || parts[parts.length - 1].slice(-1) === '@' || token.value.charAt(0) === '@');
+
+            if (joins) {
                 data[state][data[state].length - 1] += token.value;
                 if (state === 'text' && insideQuotes) {
                     data.textWasQuoted[data.textWasQuoted.length - 1] = true;
@@ -499,8 +510,10 @@ function addressparser(str, options) {
 
     addresses.forEach(addr => {
         const handled = _handleAddress(addr, depth);
-        if (handled.length) {
-            parsedAddresses = parsedAddresses.concat(handled);
+        // Appended in place. Rebuilding the accumulator with concat() would copy every
+        // entry collected so far on each address, making a flat list cost O(n^2).
+        for (let i = 0; i < handled.length; i++) {
+            parsedAddresses.push(handled[i]);
         }
     });
 
@@ -508,14 +521,20 @@ function addressparser(str, options) {
     // "Joe Foo, PhD <joe@example.com>" is split on the comma into
     // [{name:"Joe Foo", address:""}, {name:"PhD", address:"joe@example.com"}].
     // Recombine: a name-only entry followed by an entry with both name and address.
-    for (let i = parsedAddresses.length - 2; i >= 0; i--) {
+    // Walked back to front so that a run of fragments folds into one entry in a single
+    // pass. Splicing each fragment out of the list instead would cost O(n^2).
+    const mergedAddresses = [];
+    for (let i = parsedAddresses.length - 1; i >= 0; i--) {
         const current = parsedAddresses[i];
-        const next = parsedAddresses[i + 1];
-        if (current.address === '' && current.name && !current.group && next.address && next.name) {
+        const next = mergedAddresses.length ? mergedAddresses[mergedAddresses.length - 1] : null;
+        if (next && current.address === '' && current.name && !current.group && next.address && next.name) {
             next.name = current.name + ', ' + next.name;
-            parsedAddresses.splice(i, 1);
+        } else {
+            mergedAddresses.push(current);
         }
     }
+    mergedAddresses.reverse();
+    parsedAddresses = mergedAddresses;
 
     if (options.flatten) {
         const flatAddresses = [];

package/lib/errors.js

@@ -38,6 +38,7 @@ const ERROR_CODES = {
 
     // Resource errors
     EMAXLIMIT: 'Pool resource limit reached (max messages per connection)',
+    EMAXRECIPIENTS: 'Recipient count exceeds maxRecipients',
 
     // Transport-specific errors
     ESENDMAIL: 'Sendmail command error',

package/lib/mailer/index.js

@@ -15,6 +15,13 @@ const net = require('net');
 const dns = require('dns');
 const crypto = require('crypto');
 
+/**
+ * Recipients allowed on one message unless the caller sets its own maxRecipients. A backstop
+ * against a runaway or hostile recipient list rather than a delivery policy: RFC 5321 only
+ * asks a server to accept 100, so a real send is bounded far below this.
+ */
+const DEFAULT_MAX_RECIPIENTS = 100000;
+
 /**
  * Creates an object for exposing the Mail API
  *
@@ -191,6 +198,26 @@ class Mail extends EventEmitter {
             mail.setPriorityHeaders();
             mail.setListHeaders();
 
+            const maxRecipients = mail.data.maxRecipients === undefined ? DEFAULT_MAX_RECIPIENTS : mail.data.maxRecipients;
+            const recipientCount = mail.message.getEnvelope().to.length;
+
+            if (maxRecipients && recipientCount > maxRecipients) {
+                const err = new Error(
+                    `Message has ${recipientCount} recipients, which is over the ${maxRecipients} allowed by maxRecipients`
+                );
+                err.code = errors.EMAXRECIPIENTS;
+                this.logger.error(
+                    {
+                        err,
+                        tnx: 'transport',
+                        action: 'send'
+                    },
+                    'Send Error: %s',
+                    err.message
+                );
+                return callback(err);
+            }
+
             this._processPlugins('stream', mail, err => {
                 if (err) {
                     this.logger.error(

package/lib/mailer/mail-message.js

@@ -31,7 +31,7 @@ class MailMessage {
         shared.copyOwnKeys(this.data.headers, defaults.headers, key => hasOwn(this.data.headers, key));
 
         // force specific keys from transporter options
-        ['disableFileAccess', 'disableUrlAccess', 'normalizeHeaderKey'].forEach(key => {
+        ['disableFileAccess', 'disableUrlAccess', 'normalizeHeaderKey', 'maxRecipients'].forEach(key => {
             if (key in options) {
                 this.data[key] = options[key];
             }

package/lib/mime-node/index.js

@@ -7,6 +7,7 @@ const fs = require('fs');
 const punycode = require('../punycode');
 const { PassThrough } = require('stream');
 const shared = require('../shared');
+const urlModule = require('url');
 
 const mimeFuncs = require('../mime-funcs');
 const qp = require('../qp');
@@ -35,6 +36,45 @@ const QUOTED_STRING = /^"(?:[^"\\]|\\[\s\S])*"$/;
 // the envelope carries
 const PLAIN_ADDRESS = /^[^\s"(),:;<>@[\\\]]+@[^\s"(),:;<>@[\\\]]+$/;
 
+// domainToASCII and domainToUnicode are WHATWG host parsers rather than plain IDNA
+// mappers, so they do more than map: they cut the host at '/', '\\', '?' and '#', drop C0
+// controls, and percent-decode. Handing them 'evil.example/mail.corp.example' returns the
+// deliverable 'evil.example', which would turn a value the bundled codec leaves as
+// unroutable garbage into mail for a domain the sender never named. None of these
+// characters are legal in a domain, so keep them away from the mapper.
+const URL_PARSER_UNSAFE = /[/\\?#%\x00-\x20\x7F]/;
+
+/**
+ * Encodes a domain the way browsers, the WHATWG URL Standard and DNS facing resolvers do,
+ * which is with UTS-46 mapping applied before the Punycode step.
+ *
+ * The bundled codec is plain RFC 3492 and maps nothing, so it disagrees with every
+ * conformant parser on any domain holding a mapped or ignored code point. An invisible
+ * U+00AD in 'compa\u00ADny.com' encoded to 'xn--company-pka.com' where a validator reads
+ * 'company.com', which let an allow-listed domain be checked and a different one mailed.
+ *
+ * Anything the URL parser does not accept as a hostname, an address literal such as
+ * '[127.0.0.1]' included, comes back empty and falls through to the bundled codec, which
+ * leaves those as they were supplied.
+ *
+ * @param {String} domain Domain to encode, already lowercased by the caller
+ * @param {Boolean} toUnicode Return the U-label form instead of the A-label form
+ * @return {String} Encoded domain
+ */
+function normalizeDomain(domain, toUnicode) {
+    // domainToASCII and domainToUnicode landed in Node 7, the bundled codec covers Node 6
+    const mapper = toUnicode ? urlModule.domainToUnicode : urlModule.domainToASCII;
+
+    if (typeof mapper === 'function' && !URL_PARSER_UNSAFE.test(domain)) {
+        const mapped = mapper(domain);
+        if (mapped) {
+            return mapped;
+        }
+    }
+
+    return toUnicode ? punycode.toUnicode(domain) : punycode.toASCII(domain);
+}
+
 /**
  * Creates a new mime tree node. Assumes 'multipart/*' as the content type
  * if it is a branch, anything else counts as leaf. If rootNode is missing from
@@ -872,9 +912,10 @@ class MimeNode {
                 this._envelope.from = list[0].address;
             }
         }
+        const seenRecipients = new Set();
         ['to', 'cc', 'bcc'].forEach(key => {
             if (envelope[key]) {
-                this._convertAddresses(this._parseEnvelopeAddresses(envelope[key]), this._envelope.to);
+                this._convertAddresses(this._parseEnvelopeAddresses(envelope[key]), this._envelope.to, seenRecipients);
             }
         });
 
@@ -893,15 +934,17 @@ class MimeNode {
      */
     getAddresses() {
         const addresses = {};
+        const seenByKey = new Map();
 
         this._headers.forEach(header => {
             const key = header.key.toLowerCase();
             if (['from', 'sender', 'reply-to', 'to', 'cc', 'bcc'].includes(key)) {
                 if (!Array.isArray(addresses[key])) {
                     addresses[key] = [];
+                    seenByKey.set(key, new Set());
                 }
 
-                this._convertAddresses(this._parseAddresses(header.value), addresses[key]);
+                this._convertAddresses(this._parseAddresses(header.value), addresses[key], seenByKey.get(key));
             }
         });
 
@@ -922,6 +965,12 @@ class MimeNode {
             from: false,
             to: []
         };
+
+        // Built once and carried across the headers. Letting _convertAddresses seed it per
+        // call would cost O(headers x recipients), and a message can carry many address
+        // headers: `headers: { to: [...] }` emits one To per entry.
+        const seenRecipients = new Set();
+
         this._headers.forEach(header => {
             const list = [];
             if (header.key === 'From' || (!envelope.from && ['Reply-To', 'Sender'].includes(header.key))) {
@@ -930,7 +979,7 @@ class MimeNode {
                     envelope.from = list[0].address;
                 }
             } else if (['To', 'Cc', 'Bcc'].includes(header.key)) {
-                this._convertAddresses(this._parseAddresses(header.value), envelope.to);
+                this._convertAddresses(this._parseAddresses(header.value), envelope.to, seenRecipients);
             }
         });
 
@@ -1057,28 +1106,38 @@ class MimeNode {
      * @return {Array} An array of address objects
      */
     _parseAddresses(addresses) {
-        return [].concat.apply(
-            [],
-            [].concat(addresses).map(address => {
-                if (address && address.address) {
-                    const normalized = this._normalizeAddress(address.address);
-                    if (normalized === address.address && typeof address.name === 'string') {
-                        // there is nothing to rewrite, so there is nothing to keep off the original
-                        return [address];
-                    }
-
-                    // rewriting would land on the object the caller passed in and might
-                    // still hold a reference to, so rewrite a copy of it instead. An own
-                    // "__proto__" key would make the copy inherit from caller data, and
-                    // _convertAddresses reads `group` off it straight into the envelope
-                    const copy = shared.copyOwnKeys({}, address);
-                    copy.address = normalized;
-                    copy.name = address.name || '';
-                    return [copy];
+        // Collected into one list as we go. concat.apply spreads the entries into arguments
+        // and throws a RangeError once a recipient array is long enough to pass the
+        // argument limit, which a large Bcc list reaches on its own.
+        const flattened = [];
+
+        [].concat(addresses).forEach(address => {
+            if (address && address.address) {
+                const normalized = this._normalizeAddress(address.address);
+                if (normalized === address.address && typeof address.name === 'string') {
+                    // there is nothing to rewrite, so there is nothing to keep off the original
+                    flattened.push(address);
+                    return;
                 }
-                return this._normalizeParsedAddresses(addressparser(address));
-            })
-        );
+
+                // rewriting would land on the object the caller passed in and might
+                // still hold a reference to, so rewrite a copy of it instead. An own
+                // "__proto__" key would make the copy inherit from caller data, and
+                // _convertAddresses reads `group` off it straight into the envelope
+                const copy = shared.copyOwnKeys({}, address);
+                copy.address = normalized;
+                copy.name = address.name || '';
+                flattened.push(copy);
+                return;
+            }
+
+            const parsed = this._normalizeParsedAddresses(addressparser(address));
+            for (let i = 0; i < parsed.length; i++) {
+                flattened.push(parsed[i]);
+            }
+        });
+
+        return flattened;
     }
 
     /**
@@ -1267,11 +1326,22 @@ class MimeNode {
      * @param {Array} [uniqueList] An array to be populated with addresses
      * @return {String} address string
      */
-    _convertAddresses(addresses, uniqueList) {
+    _convertAddresses(addresses, uniqueList, seenAddresses) {
         const values = [];
 
         uniqueList = uniqueList || [];
 
+        // Membership is checked once per address, so scanning uniqueList itself would make
+        // a recipient list cost O(n^2). Groups recurse with the same set so that a nested
+        // group still dedupes against the addresses collected around it, and a caller that
+        // passes a partly filled list (To, then Cc, then Bcc) keeps deduping across headers.
+        if (!seenAddresses) {
+            seenAddresses = new Set();
+            for (let i = 0; i < uniqueList.length; i++) {
+                seenAddresses.add(uniqueList[i].address);
+            }
+        }
+
         [].concat(addresses || []).forEach(address => {
             if (address.address) {
                 address.address = this._normalizeAddress(address.address);
@@ -1286,11 +1356,14 @@ class MimeNode {
                     values.push(`${this._encodeAddressName(address.name)} <${address.address}>`);
                 }
 
-                if (!uniqueList.some(a => a.address === address.address)) {
+                if (!seenAddresses.has(address.address)) {
+                    seenAddresses.add(address.address);
                     uniqueList.push(address);
                 }
             } else if (address.group) {
-                const groupListAddresses = (address.group.length ? this._convertAddresses(address.group, uniqueList) : '').trim();
+                const groupListAddresses = (
+                    address.group.length ? this._convertAddresses(address.group, uniqueList, seenAddresses) : ''
+                ).trim();
                 values.push(`${this._encodeAddressName(address.name)}:${groupListAddresses};`);
             }
         });
@@ -1333,12 +1406,12 @@ class MimeNode {
 
         let encodedDomain = domain;
 
+        // A non-ASCII local part already requires SMTPUTF8, so the domain stays UTF-8 for
+        // symmetry on both sides of the '@' rather than being encoded to an A-label
+        const smtputf8 = /[\x80-\uFFFF]/.test(user);
+
         try {
-            if (/[\x80-\uFFFF]/.test(user)) {
-                encodedDomain = punycode.toUnicode(domain.toLowerCase());
-            } else {
-                encodedDomain = punycode.toASCII(domain.toLowerCase());
-            }
+            encodedDomain = normalizeDomain(domain.toLowerCase(), smtputf8);
         } catch (_err) {
             // keep domain as supplied
         }

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "nodemailer",
-    "version": "9.0.6",
+    "version": "9.1.0",
     "description": "Easy as cake e-mail sending from your Node.js applications",
     "main": "lib/nodemailer.js",
     "scripts": {
@@ -27,7 +27,7 @@
     },
     "homepage": "https://nodemailer.com/",
     "devDependencies": {
-        "@aws-sdk/client-sesv2": "3.1119.0",
+        "@aws-sdk/client-sesv2": "3.1121.0",
         "bunyan": "1.8.15",
         "c8": "12.0.0",
         "eslint": "10.9.1",
@@ -39,7 +39,7 @@
         "prettier": "3.9.6",
         "proxy": "1.0.2",
         "proxy-test-server": "1.0.0",
-        "smtp-server": "3.19.3"
+        "smtp-server": "3.19.4"
     },
     "engines": {
         "node": ">=6.0.0"