# What changed in nodemailer > 151 changes in nodemailer 7 to 10 from its official release notes, upgrade guides and advisories: 9 breaking, 33 security, 4 new APIs and options. Each one cited. Sources checked 2026-10-17. HTML: https://unstale.sh/npm/nodemailer/ To see which of these apply to a repository, run `npx @unstale/cli init` in it. ## nodemailer 10 ### Breaking changes - A stream that was already read or destroyed fails the message with ESTREAM instead of producing an empty attachment, and streams are destroyed when a message fails. (10.1.0) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.1.0) - After a failed STARTTLS, authentication is skipped on the unencrypted connection unless forceAuth is set. (10.1.0) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.1.0) - Any 421 reply ends the SMTP session; when the server closes an idle connection, SMTPConnection emits only end, not an ECONNECTION error. (10.1.0) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.1.0) - Internal members are no longer included in the published declarations. (10.0.1) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.0.1) - Node.js 20 or newer is required to run Nodemailer 10. (10.0.0) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.0.0) - Hosts that the legacy URL parser would truncate are now refused. (10.0.0) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.0.0) ### Security - Bounds the work a message can make the mailer do. (10.1.2) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.1.2) - Credentials are stripped on any cross-origin redirect. (10.1.1) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.1.1) - The requireTLS setting is now honored. (10.0.12) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.0.12) - Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing (10.0.9) — [security advisory](https://github.com/advisories/GHSA-G57G-F23G-4646) - Nodemailer: Quadratic backtracking in the addressparser free-text fallback allows remote denial of service (10.0.6) — [security advisory](https://github.com/advisories/GHSA-V53P-9FQP-M79J) - Nodemailer addressparser: O(n^2) on comment-joined addresses enables a remote DoS (reachable via mailparser) (10.0.5) — [security advisory](https://github.com/advisories/GHSA-PRGH-XP8R-P3M5), [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.0.5) - The fetch behavior now honors the cookie Domain attribute without accepting public suffixes. (10.0.3) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.0.3) - Nodemailer: Nested structured recipient arrays bypass the parser depth limit and cause stack exhaustion DoS (10.0.2) — [security advisory](https://github.com/advisories/GHSA-8VVX-RFF5-P5RQ) - Nodemailer: Process-global DNS cache reuses TLS `servername` across transports, enabling cross-tenant SMTP credential disclosure (10.0.2) — [security advisory](https://github.com/advisories/GHSA-6VJ9-MWQ6-2F5V), [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.0.2) ### New APIs and options - Adds a pool option that closes pooled connections after 4 minutes without a message; set it to 0 to keep them open. (10.1.0) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.1.0) - Nodemailer now provides ES module and CommonJS builds, affecting how applications can import it. (10.0.0) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.0.0) ### Performance - Base64 and quoted-printable are encoded without per-chunk delays. (10.1.0) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.1.0) - Unfolding folded DKIM header lines now takes linear time. (10.0.10) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.0.10) - Reassembling multiline SMTP replies now takes linear time. (10.0.10) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.0.10) - Scans free text for an address in linear time. (10.0.6) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.0.6) ### Behavior and default changes - The timeout covers session setup, including DNS, proxy handshake, TCP, TLS, greeting, and STARTTLS; greetingTimeout still bounds the greeting and STARTTLS handshake within it. (10.1.0) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.1.0) - Errors now carry the system error code Nodemailer replaced, such as ECONNREFUSED. (10.1.0) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.1.0) - When the server announces PIPELINING, MAIL FROM, RCPT TO, and DATA are sent in one batch. (10.1.0) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.1.0) - A message with rejected recipients resets the pooled connection with RSET and reuses it; a message is requeued if the server dropped a reused connection before any of it was sent. (10.1.0) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.1.0) - ETIMEDOUT errors now carry timeoutType. (10.1.0) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.1.0) ### Tooling - The @types/nodemailer type layout continues to work with this release. (10.0.0) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.0.0) ### Fixes and other changes - Keeps per-message auth off the transport's token endpoint. (10.1.2) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.1.2) - A second connect() call is refused. (10.1.0) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.1.0) - An encoded part is finished only after its output has been read. (10.1.0) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.1.0) - Preserves ERR_ACCESS_DENIED from the Node.js permission model. (10.1.0) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.1.0) - Importing Nodemailer no longer reads the environment or the interface table. (10.1.0) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.1.0) - Encodes a lone CR or LF in binary quoted-printable parts. (10.1.0) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.1.0) - An early sendmail exit is reported as such. (10.1.0) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.1.0) - Nagle is turned off for SMTP sockets. (10.1.0) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.1.0) - Decodes an SMTPUTF8 domain from its A-label form. (10.1.0) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.1.0) - Escaped parentheses inside comments are now kept during address parsing. (10.0.16) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.0.16) - Cookie names retain their case when fetched. (10.0.16) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.0.16) - Cookie name-value pairs are read by position. (10.0.16) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.0.16) - NodemailerError is compatible with @types/node 26 ErrnoException. (10.0.15) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.0.15) - NodemailerError now inherits its code from ErrnoException. (10.0.15) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.0.15) - Quoted display names without an @ are kept out of the parsed address. (10.0.14) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.0.14) - Header parameters are read and written according to RFC 2045 and RFC 2231. (10.0.14) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.0.14) - Reads advertised SASL methods without backtracking regexes. (10.0.13) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.0.13) - Strips comments inside an angle-addr before it becomes the address. (10.0.13) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.0.13) - A bare CR is turned into CRLF. (10.0.12) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.0.12) - Every send is settled on a connection error. (10.0.12) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.0.12) - Fetch is bounded. (10.0.12) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.0.12) - Pool requeues back off. (10.0.12) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.0.12) - The CommonJS entry point and services subpath are compatible with the pre-TypeScript build. (10.0.11) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.0.11) - Form-body encoding failures are reported through the returned stream. (10.0.11) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.0.11) - A password login fails cleanly when the server offers only XOAUTH2. (10.0.11) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.0.11) - The layout of the bundled declarations is restored. (10.0.11) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.0.11) - wrap() terminates for short line lengths and a trailing incomplete escape. (10.0.11) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.0.11) - Attachment filenames are now derived from the basename of a Windows path. (10.0.10) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.0.10) - Bounds the '@' probe to the run being scanned, fixing address parsing. (10.0.9) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.0.9) - Keeps text after a comment out of a quoted local part address during parsing. (10.0.9) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.0.9) - The boundary is cleaned where it is written, not only where it is built. (10.0.8) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.0.8) - Every control character is dropped from multipart boundary material. (10.0.8) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.0.8) - Buffer input is no longer double encoded when chunking base64 MIME words. (10.0.7) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.0.7) - Line breaks are stripped from multipart boundary material. (10.0.7) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.0.7) - A boundary consisting only of line breaks is preserved instead of being stripped to empty. (10.0.7) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.0.7) - Rate-limited connections are released when they close. (10.0.7) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.0.7) - Cookies without a Path are scoped to the RFC 6265 default path. (10.0.4) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.0.4) - Cookies set with Path are sent back only to the exact path. (10.0.4) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.0.4) - httpHeaders and tls are preserved for href alternatives and icalEvent. (10.0.4) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.0.4) - A configuration error is thrown when the SES client is missing. (10.0.4) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.0.4) - Well-known services are resolved by their primary domains. (10.0.4) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.0.4) - Nested recipient arrays are flattened without recursion. (10.0.2) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.0.2) - Type declarations now accept an explicit undefined for optional properties. (10.0.1) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.0.1) - Configuration object keys alongside its url are now applied. (10.0.0) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.0.0) - A colon in the user name is preserved when parsing a connection or proxy URL. (10.0.0) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.0.0) - Raw messages are canonicalized the way verifiers do, improving DKIM verification compatibility. (10.0.0) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.0.0) - Hostnames are resolved when the runtime has no interface table. (10.0.0) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.0.0) - An incomplete server reply is no longer stored in lastServerResponse. (10.0.0) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.0.0) - The well-known services JSON file remains available at its package path. (10.0.0) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.0.0) - Timers are cleared when a connection is dropped before the greeting. (10.0.0) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.0.0) - The pool slot is freed if the proxy socket cannot be opened. (10.0.0) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.0.0) - A transporter remains assignable to the plain Transporter type. (10.0.0) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v10.0.0) ## nodemailer 9 ### Breaking changes - HTTPS requests made while fetching remote content now validate the server's TLS certificate by default; set rejectUnauthorized to false per request to opt out. (9.0.0) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v9.0.0) ### Security - Message data can no longer reopen the access sandbox. (9.1.1) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v9.1.1) - The message access policy is now applied in resolveContent, so content resolution respects the policy. (9.1.1) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v9.1.1) - Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disableUrlAccess when called with the legacy signature (9.1.1) — [security advisory](https://github.com/advisories/GHSA-8M3C-C648-2XJJ) - Nodemailer: IDN/Punycode domain allow-list bypass leads to email delivery to an attacker-controlled domain (9.1.0) — [security advisory](https://github.com/advisories/GHSA-WMMP-3585-3RMP) - Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address list (9.1.0) — [security advisory](https://github.com/advisories/GHSA-2X7J-588G-CCC2) - Nodemailer: Recipient-domain validation bypass via RFC 5322 comment mis-parsing leads to email delivery to an attacker-controlled domain (9.1.0) — [security advisory](https://github.com/advisories/GHSA-CC9R-2J5M-2M83) - Hardens copies of user-supplied keys and URL fetching. (9.0.6) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v9.0.6) - Header key callbacks and DKIM tags can no longer inject content. (9.0.5) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v9.0.5) - Control characters are kept out of header values and msg-id headers. (9.0.5) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v9.0.5) - Hardened STARTTLS upgrades and secure socket handling. (9.0.3) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v9.0.3) - CRLF is rejected in the destination to prevent request injection. (9.0.2) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v9.0.2) - Low-severity issues in smtp-connection were hardened. (9.0.2) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v9.0.2) - SMTP response parsing and socket lifecycle handling were hardened. (9.0.2) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v9.0.2) - Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered message (9.0.1) — [security advisory](https://github.com/advisories/GHSA-P6GQ-J5CR-W38F) - The raw message option now enforces disableFileAccess and disableUrlAccess. (9.0.1) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v9.0.1) ### New APIs and options - Caps the number of recipients per message. (9.1.0) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v9.1.0) ### Performance - Address lists are handled in linear time. (9.1.0) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v9.1.0) ### Fixes and other changes - A MIME node now inherits the access policy from the tree it belongs to. (9.1.1) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v9.1.1) - Domain encoding now applies UTS-46 mapping. (9.1.0) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v9.1.0) - URL delimiters are kept away from the domain mapper. (9.1.0) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v9.1.0) - Envelope recipient deduplication is linear time, including across address headers. (9.1.0) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v9.1.0) - Address parsing now terminates the domain at an RFC 5322 comment. (9.1.0) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v9.1.0) - Recovers the addr-spec when an angle-addr contains whitespace. (9.0.6) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v9.0.6) - Addresses are normalized so the header and envelope agree. (9.0.5) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v9.0.5) - DEL is encoded in header parameters and List-* comments. (9.0.5) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v9.0.5) - Control characters are kept out of the remaining header positions. (9.0.5) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v9.0.5) - Special characters in List-* header comments are now escaped. (9.0.5) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v9.0.5) - The continuation key is now starred when a parameter line is restarted. (9.0.5) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v9.0.5) - Addresses parsed from strings are now normalized. (9.0.5) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v9.0.5) - Backslashes and quotes in the Content-Type name parameter are escaped. (9.0.4) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v9.0.4) - Unpaired surrogates in header parameter values are percent encoded. (9.0.4) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v9.0.4) - HT, CR, and LF in header parameter values are encoded instead of quoted. (9.0.4) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v9.0.4) - Surrogate pairs remain intact when chunking base64 MIME words. (9.0.4) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v9.0.4) - An unpaired surrogate no longer consumes the next character during MIME processing. (9.0.4) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v9.0.4) - Operator characters inside an address-literal are now kept as text. (9.0.2) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v9.0.2) - Prevents callback double-invocation and hangs on synchronous errors. (9.0.2) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v9.0.2) ## nodemailer 8 ### Breaking changes - Strict TLS is enforced for OAuth2 and Ethereal credential requests. (8.0.8) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v8.0.8) - The error code NoAuth was renamed to ENOAUTH, so code checking the old error code must be updated. (8.0.0) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v8.0.0) ### Security - Ethereal response props are parsed without polynomial regex backtracking. (8.0.11) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v8.0.11) - Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message header injection (8.0.9) — [security advisory](https://github.com/advisories/GHSA-268H-HP4C-CRQ3), [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v8.0.9) - Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess during message normalization (8.0.9) — [security advisory](https://github.com/advisories/GHSA-WQVQ-JVPQ-H66F), [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v8.0.9) - Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interception (8.0.8) — [security advisory](https://github.com/advisories/GHSA-R7G4-QG5F-QQM2) - Nodemailer Vulnerable to SMTP Command Injection via CRLF in Transport name Option (EHLO/HELO) (8.0.5) — [security advisory](https://github.com/advisories/GHSA-VVJJ-XCJG-GR5G), [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v8.0.5) - Nodemailer has SMTP command injection due to unsanitized `envelope.size` parameter (8.0.4) — [security advisory](https://github.com/advisories/GHSA-C7W3-X93F-QMM8), [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v8.0.4) - DNS fallback is hardened against race conditions and cleanup issues. (8.0.0) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v8.0.0) ### Performance - Improves efficiency on hot paths. (8.0.3) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v8.0.3) ### Fixes and other changes - AWS SES transport errors are now tagged with the ESES code. (8.0.11) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v8.0.11) - The application/ics attachment now includes content supplied through icalEvent path or href. (8.0.11) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v8.0.11) - URL schemes are now stripped from List-ID header values. (8.0.11) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v8.0.11) - The transport-level newline option is now applied in stream and sendmail transports. (8.0.11) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v8.0.11) - For non-pooled SMTP transports, the callback is now resolved at send time. (8.0.11) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v8.0.11) - Falls back to a lower-severity handler when a custom logger lacks a level method. (8.0.10) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v8.0.10) - Four listener and stream leaks in the SMTP transport, connection, and pool are fixed. (8.0.8) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v8.0.8) - Keeps the domain in UTF-8 when the local part is non-ASCII. (8.0.7) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v8.0.7) - Restores base64 wrap() trim behavior to prevent trailing CRLF. (8.0.6) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v8.0.6) - SMTP server responses are decoded as UTF-8 at line boundaries. (8.0.5) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v8.0.5) - Fixes group name fallback producing undefined when parsing addresses. (8.0.3) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v8.0.3) - Fixes cookie bugs. (8.0.3) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v8.0.3) - Merges fragmented display names with unquoted commas when parsing addresses. (8.0.2) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v8.0.2) - Adds Gmail Workspace service configuration. (8.0.1) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v8.0.1) - TLS errors during socket teardown are now absorbed. (8.0.1) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v8.0.1) - Connections now fall back to alternative DNS addresses. (8.0.0) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v8.0.0) - Error codes are centralized and standardized. (8.0.0) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v8.0.0) - Socket cleanup is improved to prevent potential memory leaks. (8.0.0) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v8.0.0) ## nodemailer 7 ### Security - Prevents stack overflow denial of service when parsing deeply nested groups. (7.0.11) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v7.0.11) - Nodemailer’s addressparser is vulnerable to DoS caused by recursive calls (7.0.11) — [security advisory](https://github.com/advisories/GHSA-RCMH-QJQH-P98V) ### New APIs and options - Adds support for REQUIRETLS. (7.0.12) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v7.0.12) ### Fixes and other changes - Transient connection error logs are downgraded to warn level. (7.0.13) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v7.0.13) - Attachments with the message/rfc822 media type now use 8bit encoding. (7.0.12) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v7.0.12) - Data URI content type is preserved. (7.0.10) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v7.0.10) - The data URI size limit increases from 100KB to 50MB, allowing larger data URIs. (7.0.10) — [release notes](https://github.com/nodemailer/nodemailer/releases/tag/v7.0.10)