NO
Vendor
nodemailer
25
CVEs
0
On KEV
4
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-110872 | NO nodemailer nodemailer | 5.9 | Oct 14 | Nodemailer 3.0.0 before 10.0.10 Denial of Service via SMTP Reply Parsing |
| CVE-2026-110871 | NO nodemailer nodemailer | 6.5 | Oct 14 | Nodemailer 3.0.0 before 10.0.10 Quadratic DKIM Header Unfolding Denial of Service |
| CVE-2026-110870 | NO nodemailer nodemailer | 5.3 | Oct 14 | Nodemailer before 10.0.13 Improper Input Validation via Angle-Bracket Address Comments |
| CVE-2026-110869 | NO nodemailer nodemailer | 7.5 | Oct 14 | Nodemailer 3.0.0 before 10.0.13 ReDoS via SMTP AUTH Mechanism Detection Regexes |
| CVE-2026-100702 | NO nodemailer nodemailer | 5.9 | Sep 26 | Nodemailer before 10.0.2 Stack Exhaustion via Nested Recipient Arrays |
| CVE-2026-100701 | NO nodemailer nodemailer | 5.9 | Sep 26 | Nodemailer 5.0.0 through 10.0.1 TLS servername Cache Confusion |
| CVE-2026-100700 | NO nodemailer nodemailer | 7.5 | Sep 26 | nodemailer before 10.0.6 Denial of Service via addressparser |
| CVE-2026-100699 | NO nodemailer nodemailer | 5.3 | Sep 26 | Nodemailer before 10.0.9 Malformed Envelope Recipient via RFC 5322 Comment |
| CVE-2026-92598 | NO nodemailer nodemailer | 6.5 | Sep 16 | Nodemailer before 9.1.0 IDN/Punycode Domain Allow-list Bypass |
| CVE-2026-92597 | NO nodemailer nodemailer | 6.5 | Sep 16 | Nodemailer before 9.1.0 Email Domain Validation Bypass via RFC 5322 Comment |
| CVE-2026-92596 | NO nodemailer nodemailer | 7.5 | Sep 16 | Nodemailer before 9.1.0 Denial of Service via addressparser |
| CVE-2026-92595 | NO nodemailer nodemailer | 5.9 | Sep 16 | Nodemailer before 9.1.1 Security Sandbox Bypass via resolveContent |
| CVE-2026-90776 | NO nodemailer nodemailer | 7.5 | Sep 13 | Nodemailer 9.1.0 through 10.0.4 Denial of Service via Quadratic Address Parsing |
| CVE-2026-82854 | NO nodemailer nodemailer | 9.8 | Aug 31 | Nodemailer before 8.0.3 SMTP Command Injection via envelope.size |
| CVE-2026-82853 | NO nodemailer nodemailer | 4.9 | Aug 31 | Nodemailer before 8.0.5 SMTP Command Injection via CRLF |
| CVE-2026-82662 | NO nodemailer nodemailer | 6.5 | Aug 31 | Nodemailer before 8.0.8 TLS Certificate Validation Bypass |
| CVE-2026-82661 | NO nodemailer nodemailer | 5.4 | Aug 31 | Nodemailer CRLF Injection via List-* Header Comments |
| CVE-2026-82660 | NO nodemailer nodemailer | 5.4 | Aug 31 | Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess |
| CVE-2026-82659 | NO nodemailer nodemailer | 7.1 | Aug 31 | nodemailer before 9.0.1 File Read and SSRF via raw option |
| CVE-2024-58379 | NO nodemailer nodemailer | 5.3 | Aug 31 | nodemailer before 6.9.9 ReDoS via attachDataUrls parameter |
| CVE-2026-3455 | MA Mailparser Nodemailer | 6.1 | Mar 3 | Versions of the package mailparser before 3.9.3 are vulnerable to Cross-site Scripting (XSS) via the textToHtml() function due to the improper sanitisation of URLs in the email… |
| CVE-2025-14874 | NO nodemailer nodemailer | 7.5 | Dec 18 | Nodemailer: nodemailer: denial of service via crafted email address header |
| CVE-2025-13033 | NO nodemailer nodemailer | 7.5 | Nov 14 | Nodemailer: nodemailer: email to an unintended domain can occur due to interpretation conflict |
| CVE-2021-23400 | NO Nodemailer Nodemailer | 8.8 | Jun 29 | The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain newlines and carriage returns is passed into an address… |
| CVE-2020-7769 | NO Nodemailer Nodemailer | 9.8 | Nov 12 | This affects the package nodemailer before 6.4.16 |