nodemailer (npm)
Advisories
33
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 10.1.4 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install nodemailer@10.1.4yarn
yarn add nodemailer@10.1.4pnpm
pnpm add nodemailer@10.1.4Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-8c8m-p3m8-cjg8 Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient |
Medium | >= 3.0.0, < 10.1.4 | 10.1.4 |
| GHSA-m943-m63m-w62w Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient |
Medium | >= 3.0.0, < 10.1.4 | 10.1.4 |
| GHSA-85x2-q946-cp5h Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name |
Medium | >= 3.0.0, < 10.1.4 | 10.1.4 |
| GHSA-wxxx-r42m-9rp8 Duplicate Advisory: Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signing Withdrawn |
Medium | >= 3.0.0, <= 10.0.9 | No fix yet |
| GHSA-4g23-2xm8-66gc Nodemailer: Quadratic (O(n^2)) SMTP client reply parsing lets a malicious server or MITM cause a pre-auth remote denial of service |
High EPSS 0.36% |
>= 3.0.0, < 10.0.10 | 10.0.10 |
| GHSA-39m8-27wv-hr27 Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signing |
High EPSS 0.38% |
>= 3.0.0, < 10.0.10 | 10.0.10 |
| GHSA-g73g-hqqh-jr95 Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped |
Medium EPSS 0.27% |
>= 3.0.0, < 10.0.13 | 10.0.13 |
| GHSA-4ffr-jq9g-5ffx Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service |
High EPSS 0.37% |
>= 3.0.0, < 10.0.13 | 10.0.13 |
| GHSA-8vvx-rff5-p5rq Nodemailer: Nested structured recipient arrays bypass the parser depth limit and cause stack exhaustion DoS |
High EPSS 0.25% |
< 10.0.2 | 10.0.2 |
| GHSA-6vj9-mwq6-2f5v Nodemailer: Process-global DNS cache reuses TLS `servername` across transports, enabling cross-tenant SMTP credential disclosure |
Medium EPSS 0.11% |
>= 5.0.0, < 10.0.2 | 10.0.2 |
| GHSA-v53p-9fqp-m79j Nodemailer: Quadratic backtracking in the addressparser free-text fallback allows remote denial of service |
High EPSS 0.34% |
< 10.0.6 | 10.0.6 |
| GHSA-g57g-f23g-4646 Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing |
Medium EPSS 0.23% |
>= 9.1.0, < 10.0.9 | 10.0.9 |
| GHSA-vm5r-23w9-m8hx Duplicate Advisory: Nodemailer addressparser: O(n^2) on comment-joined addresses enables a remote DoS (reachable via mailparser) Withdrawn |
High | >= 9.1.0, <= 10.0.4 | No fix yet |
| GHSA-prgh-xp8r-p3m5 Nodemailer addressparser: O(n^2) on comment-joined addresses enables a remote DoS (reachable via mailparser) |
High EPSS 0.68% |
>= 9.1.0, < 10.0.5 | 10.0.5 |
| GHSA-wmmp-3585-3rmp Nodemailer: IDN/Punycode domain allow-list bypass leads to email delivery to an attacker-controlled domain |
High EPSS 0.40% |
< 9.1.0 | 9.1.0 |
| GHSA-2x7j-588g-ccc2 Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address list |
High EPSS 0.82% |
< 9.1.0 | 9.1.0 |
| GHSA-cc9r-2j5m-2m83 Nodemailer: Recipient-domain validation bypass via RFC 5322 comment mis-parsing leads to email delivery to an attacker-controlled domain |
High EPSS 0.38% |
>= 6.9.16, < 9.1.0 | 9.1.0 |
| GHSA-8m3c-c648-2xjj Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disableUrlAccess when called with the legacy signature |
Medium EPSS 0.29% |
< 9.1.1 | 9.1.1 |
| GHSA-frj6-5rhh-vwfw Duplicate Advisory: Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interception Withdrawn |
Medium | <= 8.0.7 | No fix yet |
| GHSA-h3hj-cmcx-xc66 Duplicate Advisory: Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered message Withdrawn |
High | <= 9.0.0 | No fix yet |
| GHSA-p6gq-j5cr-w38f Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered message |
High EPSS 0.35% |
< 9.0.1 | 9.0.1 |
| GHSA-268h-hp4c-crq3 Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message header injection |
Medium EPSS 0.26% |
< 8.0.9 | 8.0.9 |
| GHSA-wqvq-jvpq-h66f Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess during message normalization |
Medium EPSS 0.26% |
< 8.0.9 | 8.0.9 |
| GHSA-r7g4-qg5f-qqm2 Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interception |
Medium EPSS 0.19% |
< 8.0.8 | 8.0.8 |
| GHSA-vvjj-xcjg-gr5g Nodemailer Vulnerable to SMTP Command Injection via CRLF in Transport name Option (EHLO/HELO) |
Medium EPSS 1.03% |
< 8.0.5 | 8.0.5 |
| GHSA-c7w3-x93f-qmm8 Nodemailer has SMTP command injection due to unsanitized `envelope.size` parameter |
Critical EPSS 1.98% |
< 8.0.4 | 8.0.4 |
| GHSA-46j5-6fg5-4gv3 Duplicate Advisory: Nodemailer is vulnerable to DoS through Uncontrolled Recursion Withdrawn |
Medium | < 7.0.11 | 7.0.11 |
| GHSA-rcmh-qjqh-p98v Nodemailer’s addressparser is vulnerable to DoS caused by recursive calls |
High EPSS 0.60% |
>= 3.0.0, < 7.0.11 | 7.0.11 |
| GHSA-jj37-3377-m6vv Duplicate Advisory: Nodemailer: Email to an unintended domain can occur due to Interpretation Conflict Withdrawn |
High | < 7.0.7 | 7.0.7 |
| GHSA-mm7p-fcc7-pg87 Nodemailer: Email to an unintended domain can occur due to Interpretation Conflict |
High EPSS 0.57% |
< 7.0.7 | 7.0.7 |
| GHSA-9h6g-pr28-7cqp nodemailer ReDoS when trying to send a specially crafted email |
Medium EPSS 0.42% |
< 6.9.9 | 6.9.9 |
| GHSA-hwqf-gcqm-7353 Header injection in nodemailer |
Medium EPSS 1.39% |
< 6.6.1 | 6.6.1 |
| GHSA-48ww-j4fc-435p Command injection in nodemailer |
Critical EPSS 2.30% |
< 6.4.16 | 6.4.16 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor