Nodemailer vulnerabilities

Products

• Nodemailer 27

Newest

• nodemailer Nodemailer 3.0.0 before 10.1.4 Recipient Domain Confusion via addressparser CVE-2026-121426 8.3 HighOctober 27, 2026
• nodemailer Nodemailer 3.0.0 before 10.1.4 Recipient Injection via addressparser Group Parsing CVE-2026-121425 8.3 HighOctober 27, 2026
• nodemailer Nodemailer 3.0.0 before 10.1.4 Address Parsing Bypass via Nested Comments CVE-2026-121424 Fix available 8.3 HighOctober 23, 2026
• nodemailer Nodemailer 3.0.0 before 10.0.10 Denial of Service via SMTP Reply Parsing CVE-2026-110872 Fix available 8.2 HighOctober 14, 2026
• nodemailer Nodemailer 3.0.0 before 10.0.10 Quadratic DKIM Header Unfolding Denial of Service CVE-2026-110871 Fix available 7.1 HighOctober 14, 2026
• nodemailer Nodemailer before 10.0.13 Improper Input Validation via Angle-Bracket Address Comments CVE-2026-110870 Fix available 6.9 MediumOctober 14, 2026
• nodemailer Nodemailer 3.0.0 before 10.0.13 ReDoS via SMTP AUTH Mechanism Detection Regexes CVE-2026-110869 Fix available 8.7 HighOctober 14, 2026
• nodemailer Nodemailer before 10.0.2 Stack Exhaustion via Nested Recipient Arrays CVE-2026-100702 Fix available 8.2 HighSeptember 26, 2026
• nodemailer Nodemailer 5.0.0 through 10.0.1 TLS servername Cache Confusion CVE-2026-100701 Fix available 6.0 MediumSeptember 26, 2026
• nodemailer nodemailer before 10.0.6 Denial of Service via addressparser CVE-2026-100700 Fix available 8.7 HighSeptember 26, 2026
• nodemailer Nodemailer before 10.0.9 Malformed Envelope Recipient via RFC 5322 Comment CVE-2026-100699 Fix available 6.9 MediumSeptember 26, 2026
• nodemailer Nodemailer before 9.1.0 IDN/Punycode Domain Allow-list Bypass CVE-2026-92598 Fix available 8.3 HighSeptember 16, 2026
• nodemailer Nodemailer before 9.1.0 Email Domain Validation Bypass via RFC 5322 Comment CVE-2026-92597 Fix available 8.3 HighSeptember 16, 2026
• nodemailer Nodemailer 9.1.0 through 10.0.4 Denial of Service via Quadratic Address Parsing CVE-2026-90776 Fix available 8.7 HighSeptember 13, 2026
• nodemailer Nodemailer before 9.1.1 Security Sandbox Bypass via resolveContent CVE-2026-92595 Fix available 6.0 MediumSeptember 8, 2026
• nodemailer Nodemailer CRLF Injection via List-* Header Comments CVE-2026-82661 Fix available 5.3 MediumAugust 31, 2026
• nodemailer nodemailer before 9.0.1 File Read and SSRF via raw option CVE-2026-82659 Fix available 7.1 HighJune 18, 2026
• nodemailer Nodemailer before 9.1.0 Denial of Service via addressparser CVE-2026-92596 Fix available 8.7 HighJune 15, 2026
• nodemailer Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess CVE-2026-82660 Fix available 5.3 MediumJune 15, 2026
• nodemailer Nodemailer before 8.0.8 TLS Certificate Validation Bypass CVE-2026-82662 Fix available 8.3 HighJune 15, 2026
• nodemailer Nodemailer before 8.0.5 SMTP Command Injection via CRLF CVE-2026-82853 Fix available 6.9 MediumApril 8, 2026
• nodemailer Nodemailer before 8.0.4 SMTP Command Injection via envelope.size CVE-2026-82854 Fix available 9.3 CriticalMarch 26, 2026
• nodemailer mailparser mailparser vulnerable to Cross-site Scripting CVE-2026-3455 Fix available 5.1 MediumMarch 3, 2026
• nodemailer, red hat advanced cluster management for kubernetes 2, ceph storage 8 +4 more +6 more Nodemailer: nodemailer: denial of service via crafted email address header CVE-2025-14874 Fix available 7.5 HighDecember 1, 2025
• nodemailer, red hat advanced cluster management for kubernetes 2, ceph storage 8.1 +1 more +3 more Nodemailer: nodemailer: email to an unintended domain can occur due to interpretation conflict CVE-2025-13033 Fix available 7.5 HighOctober 7, 2025
• nodemailer nodemailer before 6.9.9 ReDoS via attachDataUrls parameter CVE-2024-58379 Fix available 6.9 MediumJanuary 31, 2024
• nodemailer HTTP Header Injection CVE-2021-23400 Fix available 6.3 MediumJune 29, 2021
• nodemailer Command Injection CVE-2020-7769 Fix available 8.6 HighNovember 12, 2020