NO
Product
nodemailer
24
CVEs
0
On KEV
9.8
Max CVSS
4
New 30D
Severity mix
Critical 2High 8Medium 14Low 0
Watch
Add nodemailer to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-23400 | 8.8 | Jun 29 | The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain newlines and carriage returns is passed into an address… Affected: before 6.6.1 |
| CVE-2026-110869 | 7.5 | Oct 14 | Nodemailer 3.0.0 before 10.0.13 ReDoS via SMTP AUTH Mechanism Detection Regexes Affected: 3.0.0 before 10.0.13 |
| CVE-2026-100700 | 7.5 | Sep 26 | nodemailer before 10.0.6 Denial of Service via addressparser Affected: before 10.0.6 |
| CVE-2026-92596 | 7.5 | Sep 16 | Nodemailer before 9.1.0 Denial of Service via addressparser Affected: before 9.1.0 |
| CVE-2026-90776 | 7.5 | Sep 13 | Nodemailer 9.1.0 through 10.0.4 Denial of Service via Quadratic Address Parsing Affected: 9.1.0 before 10.0.5 |
| CVE-2025-14874 | 7.5 | Dec 18 | Nodemailer: nodemailer: denial of service via crafted email address header Affected: before 7.0.11 |
| CVE-2025-13033 | 7.5 | Nov 14 | Nodemailer: nodemailer: email to an unintended domain can occur due to interpretation conflict Affected: before 7.0.7 |
| CVE-2026-82659 | 7.1 | Aug 31 | nodemailer before 9.0.1 File Read and SSRF via raw option Affected: before 9.0.1 |
Showing 8