Nodemailer

21 CVEs across 2 Nodemailer products. Browse Nodemailer vulnerabilities, severities, and proof-of-concept exploits.

Nodemailer products with known CVEs

ProductCVEs
Nodemailer20
Mailparser1
Nodemailer CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-100702Medium5.92026-09-26Nodemailer before 10.0.2 fails to properly flatten deeply nested arrays in recipient fields such as to, cc, and bcc, allowing attackers to cause stack exhausti…
CVE-2026-100701Medium5.92026-09-26Nodemailer versions 5.0.0 through 10.0.1 use a process-global DNS cache that is keyed only by the DNS host, while each cache entry also stores the caller-speci…
CVE-2026-100700High7.52026-09-26nodemailer before 10.0.6 contains a denial of service vulnerability in the addressparser free-text fallback regex pattern that exhibits quadratic backtracking…
CVE-2026-100699Medium5.32026-09-26Nodemailer is a Node.js email-sending library. In versions >= 9.1.0 and < 10.0.9, the address parser (src/addressparser) mishandles addresses whose local-part…
CVE-2026-92598Medium6.52026-09-16Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punyco…
CVE-2026-92597Medium6.52026-09-16Nodemailer versions >= 6.9.16 and < 9.1.0 mis-parse RFC 5322 comments in email addresses: in lib/addressparser, a comment closed immediately before a non-break…
CVE-2026-92596High7.52026-09-16Nodemailer before 9.1.0 contains a quadratic time complexity vulnerability in the addressparser component that allows remote attackers to cause denial of servi…
CVE-2026-92595Medium5.92026-09-16Nodemailer (npm package `nodemailer`) versions 9.1.0 and earlier do not honor the `disableFileAccess` and `disableUrlAccess` sandbox options when message conte…
CVE-2026-90776High7.52026-09-13Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability in the addressparser component when parsing email addresses with RFC…
CVE-2026-82854Critical9.82026-08-31Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.size parameter. When an application passes a custom envelope o…
CVE-2026-82853Medium4.92026-08-31Nodemailer versions before 8.0.5 contain an SMTP command injection vulnerability in the transport name option used in EHLO/HELO commands. The name parameter is…
CVE-2026-82662Medium6.52026-08-31Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false, allowing attackers to intercept OAuth2 t…
CVE-2026-82661Medium5.42026-08-31Nodemailer before 8.0.9 fails to sanitize carriage return and line feed characters in list comment fields, allowing attackers to inject arbitrary message heade…
CVE-2026-82660Medium5.42026-08-31Nodemailer before 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during message normalization in jsonTransport. Attackers can read local…
CVE-2026-82659High7.12026-08-31nodemailer before 9.0.1 fails to apply disableFileAccess and disableUrlAccess flags to message-level raw option, allowing authenticated attackers to read arbit…
CVE-2024-58379Medium5.32026-08-31nodemailer before 6.9.9 contains a regular expression denial of service vulnerability in email parsing when attachDataUrls parameter is set or processing embed…
CVE-2026-3455Medium6.12026-03-03Versions of the package mailparser before 3.9.3 are vulnerable to Cross-site Scripting (XSS) via the textToHtml() function due to the improper sanitisation of…
CVE-2025-14874High7.52025-12-18A flaw was found in Nodemailer. This vulnerability allows a denial of service (DoS) via a crafted email address header that triggers infinite recursion in the…
CVE-2025-13033High7.52025-11-14A vulnerability was identified in the email parsing library due to improper handling of specially formatted recipient email addresses. An attacker can exploit…
CVE-2021-23400Medium6.32021-06-29The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain newlines and carriage returns is passed…
CVE-2020-7769High8.62020-11-12This affects the package nodemailer before 6.4.16. Use of crafted recipient email addresses may result in arbitrary command flag injection in sendmail transpor…