Nodemailer
3 CVEs across 2 Nodemailer products. Browse Nodemailer vulnerabilities, severities, and proof-of-concept exploits.
Nodemailer products with known CVEs
Nodemailer CVEs — newest first| CVE | Severity | Score | Published | Summary |
|---|
CVE-2026-3455 | Medium | 6.1 | 2026-03-03 | Versions of the package mailparser before 3.9.3 are vulnerable to Cross-site Scripting (XSS) via the textToHtml() function due to the improper sanitisation of… |
CVE-2025-14874 | High | 7.5 | 2025-12-18 | A flaw was found in Nodemailer. This vulnerability allows a denial of service (DoS) via a crafted email address header that triggers infinite recursion in the… |
CVE-2025-13033 | High | 7.5 | 2025-11-14 | A vulnerability was identified in the email parsing library due to improper handling of specially formatted recipient email addresses. An attacker can exploit… |
CVE-2021-23400 | Medium | 6.3 | 2021-06-29 | The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain newlines and carriage returns is passed… |
CVE-2020-7769 | High | 8.6 | 2020-11-12 | This affects the package nodemailer before 6.4.16. Use of crafted recipient email addresses may result in arbitrary command flag injection in sendmail transpor… |