NO
Product
nodemailer
24
CVEs
0
On KEV
9.8
Max CVSS
4
New 30D
Severity mix
Critical 2High 8Medium 14Low 0
Watch
Add nodemailer to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-110871 | 6.5 | Oct 14 | Nodemailer 3.0.0 before 10.0.10 Quadratic DKIM Header Unfolding Denial of Service Affected: 3.0.0 before 10.0.10 |
| CVE-2026-92598 | 6.5 | Sep 16 | Nodemailer before 9.1.0 IDN/Punycode Domain Allow-list Bypass Affected: before 9.1.0 |
| CVE-2026-92597 | 6.5 | Sep 16 | Nodemailer before 9.1.0 Email Domain Validation Bypass via RFC 5322 Comment Affected: 6.9.16 before 9.1.0 |
| CVE-2026-82662 | 6.5 | Aug 31 | Nodemailer before 8.0.8 TLS Certificate Validation Bypass Affected: before 8.0.8 |
| CVE-2026-110872 | 5.9 | Oct 14 | Nodemailer 3.0.0 before 10.0.10 Denial of Service via SMTP Reply Parsing Affected: 3.0.0 before 10.0.10 |
| CVE-2026-100702 | 5.9 | Sep 26 | Nodemailer before 10.0.2 Stack Exhaustion via Nested Recipient Arrays Affected: before 10.0.2 |
| CVE-2026-100701 | 5.9 | Sep 26 | Nodemailer 5.0.0 through 10.0.1 TLS servername Cache Confusion Affected: 5.0.0 before 10.0.2 |
| CVE-2026-92595 | 5.9 | Sep 16 | Nodemailer before 9.1.1 Security Sandbox Bypass via resolveContent Affected: before 9.1.1 |
| CVE-2026-82661 | 5.4 | Aug 31 | Nodemailer CRLF Injection via List-* Header Comments Affected: before 8.0.9 |
| CVE-2026-82660 | 5.4 | Aug 31 | Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess Affected: before 8.0.9 |
| CVE-2026-110870 | 5.3 | Oct 14 | Nodemailer before 10.0.13 Improper Input Validation via Angle-Bracket Address Comments Affected: 3.0.0 before 10.0.13 |
| CVE-2026-100699 | 5.3 | Sep 26 | Nodemailer before 10.0.9 Malformed Envelope Recipient via RFC 5322 Comment Affected: 9.1.0 before 10.0.9 |
| CVE-2024-58379 | 5.3 | Aug 31 | nodemailer before 6.9.9 ReDoS via attachDataUrls parameter Affected: before 6.9.9 |
| CVE-2026-82853 | 4.9 | Aug 31 | Nodemailer before 8.0.5 SMTP Command Injection via CRLF Affected: before 8.0.5 |
Showing 14