nodemailer
Built from the advisories that name this package: its registry metadata (versions, licence, dependencies) has not been fetched by this service yet.
At a glance
- Ecosystem
- npm
- Vulnerability status
- 27 advisory(ies) without a verdict
Advisories (27)
| Advisory | Affected versions | Latest version |
|---|---|---|
| GHSA-268h-hp4c-crq3 Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message header injection | < 8.0.9 | Undetermined |
| GHSA-2x7j-588g-ccc2 Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address list | < 9.1.0 | Undetermined |
| GHSA-39m8-27wv-hr27 Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signing | 3.0.0 – < 10.0.10 | Undetermined |
| GHSA-48ww-j4fc-435p Command injection in nodemailer | < 6.4.16 | Undetermined |
| GHSA-4ffr-jq9g-5ffx Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service | 3.0.0 – < 10.0.13 | Undetermined |
| GHSA-4g23-2xm8-66gc Nodemailer: Quadratic (O(n^2)) SMTP client reply parsing lets a malicious server or MITM cause a pre-auth remote denial of service | 3.0.0 – < 10.0.10 | Undetermined |
| GHSA-6vj9-mwq6-2f5v Nodemailer: Process-global DNS cache reuses TLS `servername` across transports, enabling cross-tenant SMTP credential disclosure | 5.0.0 – < 10.0.2 | Undetermined |
| GHSA-85x2-q946-cp5h Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name | 3.0.0 – < 10.1.4 | Undetermined |
| GHSA-8c8m-p3m8-cjg8 Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient | 3.0.0 – < 10.1.4 | Undetermined |
| GHSA-8m3c-c648-2xjj Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disableUrlAccess when called with the legacy signature | < 9.1.1 | Undetermined |
| GHSA-8vvx-rff5-p5rq Nodemailer: Nested structured recipient arrays bypass the parser depth limit and cause stack exhaustion DoS | < 10.0.2 | Undetermined |
| GHSA-9h6g-pr28-7cqp nodemailer ReDoS when trying to send a specially crafted email | < 6.9.9 | Undetermined |
| GHSA-c7w3-x93f-qmm8 Nodemailer has SMTP command injection due to unsanitized `envelope.size` parameter | < 8.0.4 | Undetermined |
| GHSA-cc9r-2j5m-2m83 Nodemailer: Recipient-domain validation bypass via RFC 5322 comment mis-parsing leads to email delivery to an attacker-controlled domain | 6.9.16 – < 9.1.0 | Undetermined |
| GHSA-g57g-f23g-4646 Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing | 9.1.0 – < 10.0.9 | Undetermined |
| GHSA-g73g-hqqh-jr95 Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped | 3.0.0 – < 10.0.13 | Undetermined |
| GHSA-hwqf-gcqm-7353 Header injection in nodemailer | < 6.6.1 | Undetermined |
| GHSA-m943-m63m-w62w Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient | 3.0.0 – < 10.1.4 | Undetermined |
| GHSA-mm7p-fcc7-pg87 Nodemailer: Email to an unintended domain can occur due to Interpretation Conflict | < 7.0.7 | Undetermined |
| GHSA-p6gq-j5cr-w38f Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered message | < 9.0.1 | Undetermined |
| GHSA-prgh-xp8r-p3m5 Nodemailer addressparser: O(n^2) on comment-joined addresses enables a remote DoS (reachable via mailparser) | 9.1.0 – < 10.0.5 | Undetermined |
| GHSA-r7g4-qg5f-qqm2 Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interception | < 8.0.8 | Undetermined |
| GHSA-rcmh-qjqh-p98v Nodemailer’s addressparser is vulnerable to DoS caused by recursive calls | 3.0.0 – < 7.0.11 | Undetermined |
| GHSA-v53p-9fqp-m79j Nodemailer: Quadratic backtracking in the addressparser free-text fallback allows remote denial of service | < 10.0.6 | Undetermined |
| GHSA-vvjj-xcjg-gr5g Nodemailer Vulnerable to SMTP Command Injection via CRLF in Transport name Option (EHLO/HELO) | < 8.0.5 | Undetermined |
| GHSA-wmmp-3585-3rmp Nodemailer: IDN/Punycode domain allow-list bypass leads to email delivery to an attacker-controlled domain | < 9.1.0 | Undetermined |
| GHSA-wqvq-jvpq-h66f Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess during message normalization | < 8.0.9 | Undetermined |
Withdrawn advisories (6)
Withdrawn by their publisher: they affect no version and are not counted above.
- GHSA-46j5-6fg5-4gv3 Duplicate Advisory: Nodemailer is vulnerable to DoS through Uncontrolled Recursion · withdrawn
- GHSA-frj6-5rhh-vwfw Duplicate Advisory: Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interception · withdrawn
- GHSA-h3hj-cmcx-xc66 Duplicate Advisory: Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered message · withdrawn
- GHSA-jj37-3377-m6vv Duplicate Advisory: Nodemailer: Email to an unintended domain can occur due to Interpretation Conflict · withdrawn
- GHSA-vm5r-23w9-m8hx Duplicate Advisory: Nodemailer addressparser: O(n^2) on comment-joined addresses enables a remote DoS (reachable via mailparser) · withdrawn
- GHSA-wxxx-r42m-9rp8 Duplicate Advisory: Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signing · withdrawn
Sources
| Source | Licence |
|---|