10.4.1 (2026-11-10)
Summary
A security patch release. Two cases where the recipient domain Nodemailer delivered to could differ from the domain an application had validated are fixed. SpacePost is added to the well-known services.
Who should upgrade
- Everyone who passes user-supplied recipient addresses to Nodemailer, especially applications that restrict recipients by domain. Both fixes close a gap between the domain a validator reads and the domain in the SMTP envelope.
Highlights
- Recipient domains with internationalized characters are mapped the same way
url.domainToASCIIand other UTS-46 validators map them. Previously a few characters could encode to a different domain than the validator approved. Affected since 9.1.0. - Address parsing: whitespace or a comment around a dot in a domain is read the way RFC 5322 parsers read it, as part of one domain. Previously the domain ended there and the rest moved into the display name.
- Well-known services:
service: 'SpacePost'(smtp.spacepost.dev, port 25976, STARTTLS required).