nodemailer 10.4.1

v10.4.1

on Node.js NPM

10.4.1 (2026-11-10)

Summary

A security patch release. Two cases where the recipient domain Nodemailer delivered to could differ from the domain an application had validated are fixed. SpacePost is added to the well-known services.

Who should upgrade

• Everyone who passes user-supplied recipient addresses to Nodemailer, especially applications that restrict recipients by domain. Both fixes close a gap between the domain a validator reads and the domain in the SMTP envelope.

Highlights

• Recipient domains with internationalized characters are mapped the same way url.domainToASCII and other UTS-46 validators map them. Previously a few characters could encode to a different domain than the validator approved. Affected since 9.1.0.
• Address parsing: whitespace or a comment around a dot in a domain is read the way RFC 5322 parsers read it, as part of one domain. Previously the domain ended there and the rest moved into the display name.
• Well-known services: service: 'SpacePost' (smtp.spacepost.dev, port 25976, STARTTLS required).

Bug Fixes

• addressparser: read whitespace and comments around a dot of the domain as CFWS (c2b9c41)
• mime-node: hand a domain to the UTS-46 mapper without lowercasing it first (093e4dd)