NO
Product
nodemailer
24
CVEs
0
On KEV
9.8
Max CVSS
4
New 30D
Severity mix
Critical 2High 8Medium 14Low 0
Watch
Add nodemailer to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-82854 | 9.8 | Aug 31 | Nodemailer before 8.0.3 SMTP Command Injection via envelope.size Affected: before 8.0.3 |
| CVE-2020-7769 | 9.8 | Nov 12 | This affects the package nodemailer before 6.4.16 Affected: before 6.4.16 |
| CVE-2021-23400 | 8.8 | Jun 29 | The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain newlines and carriage returns is passed into an address… Affected: before 6.6.1 |
| CVE-2026-110869 | 7.5 | Oct 14 | Nodemailer 3.0.0 before 10.0.13 ReDoS via SMTP AUTH Mechanism Detection Regexes Affected: 3.0.0 before 10.0.13 |
| CVE-2026-100700 | 7.5 | Sep 26 | nodemailer before 10.0.6 Denial of Service via addressparser Affected: before 10.0.6 |
| CVE-2026-92596 | 7.5 | Sep 16 | Nodemailer before 9.1.0 Denial of Service via addressparser Affected: before 9.1.0 |
| CVE-2026-90776 | 7.5 | Sep 13 | Nodemailer 9.1.0 through 10.0.4 Denial of Service via Quadratic Address Parsing Affected: 9.1.0 before 10.0.5 |
| CVE-2025-14874 | 7.5 | Dec 18 | Nodemailer: nodemailer: denial of service via crafted email address header Affected: before 7.0.11 |
| CVE-2025-13033 | 7.5 | Nov 14 | Nodemailer: nodemailer: email to an unintended domain can occur due to interpretation conflict Affected: before 7.0.7 |
| CVE-2026-82659 | 7.1 | Aug 31 | nodemailer before 9.0.1 File Read and SSRF via raw option Affected: before 9.0.1 |
| CVE-2026-110871 | 6.5 | Oct 14 | Nodemailer 3.0.0 before 10.0.10 Quadratic DKIM Header Unfolding Denial of Service Affected: 3.0.0 before 10.0.10 |
| CVE-2026-92598 | 6.5 | Sep 16 | Nodemailer before 9.1.0 IDN/Punycode Domain Allow-list Bypass Affected: before 9.1.0 |
| CVE-2026-92597 | 6.5 | Sep 16 | Nodemailer before 9.1.0 Email Domain Validation Bypass via RFC 5322 Comment Affected: 6.9.16 before 9.1.0 |
| CVE-2026-82662 | 6.5 | Aug 31 | Nodemailer before 8.0.8 TLS Certificate Validation Bypass Affected: before 8.0.8 |
| CVE-2026-110872 | 5.9 | Oct 14 | Nodemailer 3.0.0 before 10.0.10 Denial of Service via SMTP Reply Parsing Affected: 3.0.0 before 10.0.10 |
| CVE-2026-100702 | 5.9 | Sep 26 | Nodemailer before 10.0.2 Stack Exhaustion via Nested Recipient Arrays Affected: before 10.0.2 |
| CVE-2026-100701 | 5.9 | Sep 26 | Nodemailer 5.0.0 through 10.0.1 TLS servername Cache Confusion Affected: 5.0.0 before 10.0.2 |
| CVE-2026-92595 | 5.9 | Sep 16 | Nodemailer before 9.1.1 Security Sandbox Bypass via resolveContent Affected: before 9.1.1 |
| CVE-2026-82661 | 5.4 | Aug 31 | Nodemailer CRLF Injection via List-* Header Comments Affected: before 8.0.9 |
| CVE-2026-82660 | 5.4 | Aug 31 | Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess Affected: before 8.0.9 |
| CVE-2026-110870 | 5.3 | Oct 14 | Nodemailer before 10.0.13 Improper Input Validation via Angle-Bracket Address Comments Affected: 3.0.0 before 10.0.13 |
| CVE-2026-100699 | 5.3 | Sep 26 | Nodemailer before 10.0.9 Malformed Envelope Recipient via RFC 5322 Comment Affected: 9.1.0 before 10.0.9 |
| CVE-2024-58379 | 5.3 | Aug 31 | nodemailer before 6.9.9 ReDoS via attachDataUrls parameter Affected: before 6.9.9 |
| CVE-2026-82853 | 4.9 | Aug 31 | Nodemailer before 8.0.5 SMTP Command Injection via CRLF Affected: before 8.0.5 |
Showing 24