nodemailer 9.1.0 → 9.1.1

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # CHANGELOG
 
+## [9.1.1](https://github.com/nodemailer/nodemailer/compare/v9.1.0...v9.1.1) (2026-09-01)
+
+
+### Bug Fixes
+
+* **mailer:** apply the message access policy in resolveContent ([dc48ed3](https://github.com/nodemailer/nodemailer/commit/dc48ed395c4d6c79ee5c95eb6eff17bafe391474))
+* **mailer:** keep message data from reopening the access sandbox ([ab7ef34](https://github.com/nodemailer/nodemailer/commit/ab7ef348b9a97b1fd70e7bfbeb56d4ea4a07946b))
+* **mime-node:** inherit the access policy from the tree a node hangs in ([262d550](https://github.com/nodemailer/nodemailer/commit/262d550b1e121e3ff4ef6675d6771a5b2b4ddcec))
+
 ## [9.1.0](https://github.com/nodemailer/nodemailer/compare/v9.0.6...v9.1.0) (2026-08-31)
 
 

package/README.md

@@ -52,7 +52,7 @@ let configOptions = {
 
 #### I have issues with DNS / hosts file
 
-Node.js uses [c-ares](https://nodejs.org/en/docs/meta/topics/dependencies/#c-ares) to resolve domain names, not the DNS library provided by the system, so if you have some custom DNS routing set up, it might be ignored. Nodemailer runs [dns.resolve4()](https://nodejs.org/dist/latest-v16.x/docs/api/dns.html#dnsresolve4hostname-options-callback) and [dns.resolve6()](https://nodejs.org/dist/latest-v16.x/docs/api/dns.html#dnsresolve6hostname-options-callback) to resolve hostname into an IP address. If both calls fail, then Nodemailer will fall back to [dns.lookup()](https://nodejs.org/dist/latest-v16.x/docs/api/dns.html#dnslookuphostname-options-callback). If this does not work for you, you can hard code the IP address into the configuration like shown below. In that case, Nodemailer would not perform any DNS lookups.
+Node.js uses [c-ares](https://github.com/c-ares/c-ares) to resolve domain names, not the DNS library provided by the system, so if you have some custom DNS routing set up, it might be ignored. Nodemailer runs [dns.resolve4()](https://nodejs.org/dist/latest-v16.x/docs/api/dns.html#dnsresolve4hostname-options-callback) and [dns.resolve6()](https://nodejs.org/dist/latest-v16.x/docs/api/dns.html#dnsresolve6hostname-options-callback) to resolve hostname into an IP address. If both calls fail, then Nodemailer will fall back to [dns.lookup()](https://nodejs.org/dist/latest-v16.x/docs/api/dns.html#dnslookuphostname-options-callback). If this does not work for you, you can hard code the IP address into the configuration like shown below. In that case, Nodemailer would not perform any DNS lookups.
 
 ```js
 let configOptions = {

package/SECURITY.md

@@ -11,8 +11,8 @@ supported way to receive security updates.
 
 | Version | Supported          |
 | ------- | ------------------ |
-| 8.x     | :white_check_mark: |
-| < 8.0   | :x:                |
+| 9.x     | :white_check_mark: |
+| < 9.0   | :x:                |
 
 If you are on an older major, please upgrade. See the migration notes at
 <https://nodemailer.com/> before updating.

package/lib/mailer/mail-message.js

@@ -36,10 +36,36 @@ class MailMessage {
                 this.data[key] = options[key];
             }
         });
+
+        // The access flags are a sandbox rather than a message field, so `defaults` counts as
+        // transporter configuration for them. For a transporter plugin it is the only channel
+        // there is, createTransport leaves `options` undefined for one, and the defaults copy
+        // above yields to anything the message already set, which let message data switch the
+        // sandbox back off. Closing is one way here, same as in resolveContent below: either
+        // side may switch a flag on, neither can switch off what the other closed.
+        ['disableFileAccess', 'disableUrlAccess'].forEach(key => {
+            if (!(key in options) && hasOwn(defaults, key)) {
+                this.data[key] = this.data[key] || defaults[key];
+            }
+        });
     }
 
-    resolveContent(...args) {
-        return shared.resolveContent(...args);
+    resolveContent(data, key, options, callback) {
+        // Most plugins call this with the legacy (data, key, callback) signature, which carries
+        // no access policy. The policy belongs to the message, so apply it here. Explicit
+        // options may only tighten it, never reopen what the transporter closed.
+        if (!callback && typeof options === 'function') {
+            callback = options;
+            options = false;
+        }
+        options = options || {};
+
+        const policy = {
+            disableFileAccess: this.data.disableFileAccess || options.disableFileAccess,
+            disableUrlAccess: this.data.disableUrlAccess || options.disableUrlAccess
+        };
+
+        return shared.resolveContent(data, key, policy, callback);
     }
 
     resolveAll(callback) {

package/lib/mime-node/index.js

@@ -244,6 +244,14 @@ class MimeNode {
      * @return {Object} Appended node object
      */
     appendChild(childNode) {
+        // Take the node out of the tree it is in first. Leaving it there keeps it in that
+        // parent's childNodes, so it still streams as part of the old tree while parentNode
+        // already points at the new one, and anything read off the parent chain answers for
+        // the wrong tree.
+        if (childNode.parentNode && childNode.parentNode !== this) {
+            childNode.remove();
+        }
+
         if (childNode.rootNode !== this.rootNode) {
             childNode.rootNode = this.rootNode;
             childNode._nodeId = ++this.rootNode.nodeCounter;
@@ -1026,6 +1034,26 @@ class MimeNode {
 
     /////// PRIVATE METHODS
 
+    /**
+     * Checks an access policy flag for this node and every node above it. The flags are set
+     * from the options the node was built with, and createChild only ever sees the options
+     * the caller passed, so a child of a closed tree starts out open. Reading the answer off
+     * the parent chain keeps it right whatever order the tree was assembled in.
+     *
+     * @param {String} flag Either 'disableFileAccess' or 'disableUrlAccess'
+     * @return {Boolean} true if this node or an ancestor closed that access
+     */
+    _accessDisabled(flag) {
+        let node = this;
+        while (node) {
+            if (node[flag]) {
+                return true;
+            }
+            node = node.parentNode;
+        }
+        return false;
+    }
+
     /**
      * Detects and returns handle to a stream related with the content.
      *
@@ -1056,7 +1084,7 @@ class MimeNode {
         }
 
         if (content && typeof content.path === 'string' && !content.href) {
-            if (this.disableFileAccess) {
+            if (this._accessDisabled('disableFileAccess')) {
                 contentStream = new PassThrough();
                 setImmediate(() => {
                     const err = new Error('File access rejected for ' + content.path);
@@ -1070,7 +1098,7 @@ class MimeNode {
         }
 
         if (content && typeof content.href === 'string') {
-            if (this.disableUrlAccess) {
+            if (this._accessDisabled('disableUrlAccess')) {
                 contentStream = new PassThrough();
                 setImmediate(() => {
                     const err = new Error('Url access rejected for ' + content.href);

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "nodemailer",
-    "version": "9.1.0",
+    "version": "9.1.1",
     "description": "Easy as cake e-mail sending from your Node.js applications",
     "main": "lib/nodemailer.js",
     "scripts": {