CVE-2026-100702 | Medium | 5.9 | 2026-09-26 | Nodemailer before 10.0.2 fails to properly flatten deeply nested arrays in recipient fields such as to, cc, and bcc, allowing attackers to cause stack exhausti… |
CVE-2026-100701 | Medium | 5.9 | 2026-09-26 | Nodemailer versions 5.0.0 through 10.0.1 use a process-global DNS cache that is keyed only by the DNS host, while each cache entry also stores the caller-speci… |
CVE-2026-100700 | High | 7.5 | 2026-09-26 | nodemailer before 10.0.6 contains a denial of service vulnerability in the addressparser free-text fallback regex pattern that exhibits quadratic backtracking… |
CVE-2026-100699 | Medium | 5.3 | 2026-09-26 | Nodemailer is a Node.js email-sending library. In versions >= 9.1.0 and < 10.0.9, the address parser (src/addressparser) mishandles addresses whose local-part… |
CVE-2026-92598 | Medium | 6.5 | 2026-09-16 | Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punyco… |
CVE-2026-92597 | Medium | 6.5 | 2026-09-16 | Nodemailer versions >= 6.9.16 and < 9.1.0 mis-parse RFC 5322 comments in email addresses: in lib/addressparser, a comment closed immediately before a non-break… |
CVE-2026-92596 | High | 7.5 | 2026-09-16 | Nodemailer before 9.1.0 contains a quadratic time complexity vulnerability in the addressparser component that allows remote attackers to cause denial of servi… |
CVE-2026-92595 | Medium | 5.9 | 2026-09-16 | Nodemailer (npm package `nodemailer`) versions 9.1.0 and earlier do not honor the `disableFileAccess` and `disableUrlAccess` sandbox options when message conte… |
CVE-2026-90776 | High | 7.5 | 2026-09-13 | Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability in the addressparser component when parsing email addresses with RFC… |
CVE-2026-82854 | Critical | 9.8 | 2026-08-31 | Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.size parameter. When an application passes a custom envelope o… |
CVE-2026-82853 | Medium | 4.9 | 2026-08-31 | Nodemailer versions before 8.0.5 contain an SMTP command injection vulnerability in the transport name option used in EHLO/HELO commands. The name parameter is… |
CVE-2026-82662 | Medium | 6.5 | 2026-08-31 | Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false, allowing attackers to intercept OAuth2 t… |
CVE-2026-82661 | Medium | 5.4 | 2026-08-31 | Nodemailer before 8.0.9 fails to sanitize carriage return and line feed characters in list comment fields, allowing attackers to inject arbitrary message heade… |
CVE-2026-82660 | Medium | 5.4 | 2026-08-31 | Nodemailer before 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during message normalization in jsonTransport. Attackers can read local… |
CVE-2026-82659 | High | 7.1 | 2026-08-31 | nodemailer before 9.0.1 fails to apply disableFileAccess and disableUrlAccess flags to message-level raw option, allowing authenticated attackers to read arbit… |
CVE-2024-58379 | Medium | 5.3 | 2026-08-31 | nodemailer before 6.9.9 contains a regular expression denial of service vulnerability in email parsing when attachDataUrls parameter is set or processing embed… |
CVE-2026-3455 | Medium | 6.1 | 2026-03-03 | Versions of the package mailparser before 3.9.3 are vulnerable to Cross-site Scripting (XSS) via the textToHtml() function due to the improper sanitisation of… |
CVE-2025-14874 | High | 7.5 | 2025-12-18 | A flaw was found in Nodemailer. This vulnerability allows a denial of service (DoS) via a crafted email address header that triggers infinite recursion in the… |
CVE-2025-13033 | High | 7.5 | 2025-11-14 | A vulnerability was identified in the email parsing library due to improper handling of specially formatted recipient email addresses. An attacker can exploit… |
CVE-2021-23400 | Medium | 6.3 | 2021-06-29 | The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain newlines and carriage returns is passed… |
CVE-2020-7769 | High | 8.6 | 2020-11-12 | This affects the package nodemailer before 6.4.16. Use of crafted recipient email addresses may result in arbitrary command flag injection in sendmail transpor… |