Skip to main content
cve.nowby Sazabi
← npm
npmPackage

nodemailer

27 known vulnerabilities (1 critical, 15 high, 11 medium), with the versions each affects and the releases that fix them.

Latest release
10.4.0 (Nov 7, 2026): no advisory affects it
Newest unaffected release
10.4.0 (Nov 7, 2026), the latest release
Advisories
27 · 1 critical, 15 high, 11 medium
Weekly downloads
35.5M
Dependents
2,047
Releases
338 since 0.1.1 (Dec 8, 2011)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

Show all 27 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 27

  • Nodemailer 3.0.0 before 10.1.4 Recipient Domain Confusion via addressparser

    Affected: from 3.0.0, fixed in 10.1.4.

    Fixed in 10.1.4 (released Oct 18, 2026, 16 days before disclosure).

    The latest release, 10.4.0, is not affected.

    66% of nodemailer downloads last week were affected versions (26M).

  • Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient

    Affected: from 3.0.0, fixed in 10.1.4.

    Fixed in 10.1.4 (released Oct 18, 2026, 5 days before disclosure).

    The latest release, 10.4.0, is not affected.

    66% of nodemailer downloads last week were affected versions (26M).

  • Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient

    Affected: from 3.0.0, fixed in 10.1.4.

    Fixed in 10.1.4 (released Oct 18, 2026, 5 days before disclosure).

    The latest release, 10.4.0, is not affected.

    66% of nodemailer downloads last week were affected versions (26M).

  • Nodemailer 3.0.0 before 10.0.10 Denial of Service via SMTP Reply Parsing

    Affected: from 3.0.0, fixed in 10.0.10.

    Fixed in 10.0.10 (released Sep 14, 2026, 30 days before disclosure).

    The latest release, 10.4.0, is not affected.

    50% of nodemailer downloads last week were affected versions (19.6M).

  • Nodemailer 3.0.0 before 10.0.10 Quadratic DKIM Header Unfolding Denial of Service

    Affected: from 3.0.0, fixed in 10.0.10.

    Fixed in 10.0.10 (released Sep 14, 2026, 30 days before disclosure).

    The latest release, 10.4.0, is not affected.

    50% of nodemailer downloads last week were affected versions (19.6M).

  • CVE-2026-110870Medium 6.9

    Nodemailer before 10.0.13 Improper Input Validation via Angle-Bracket Address Comments

    Affected: from 3.0.0, fixed in 10.0.13.

    Fixed in 10.0.13 (released Sep 30, 2026, 14 days before disclosure).

    The latest release, 10.4.0, is not affected.

    55% of nodemailer downloads last week were affected versions (21.7M).

  • Nodemailer 3.0.0 before 10.0.13 ReDoS via SMTP AUTH Mechanism Detection Regexes

    Affected: from 3.0.0, fixed in 10.0.13.

    Fixed in 10.0.13 (released Sep 30, 2026, 14 days before disclosure).

    The latest release, 10.4.0, is not affected.

    55% of nodemailer downloads last week were affected versions (21.7M).

  • Nodemailer before 10.0.2 Stack Exhaustion via Nested Recipient Arrays

    Affected: fixed in 10.0.2.

    Fixed in 10.0.2 (released Sep 9, 2026, 17 days before disclosure).

    The latest release, 10.4.0, is not affected.

    49% of nodemailer downloads last week were affected versions (19.2M).

  • CVE-2026-100701Medium 6.0

    Nodemailer 5.0.0 through 10.0.1 TLS servername Cache Confusion

    Affected: from 5.0.0, fixed in 10.0.2.

    Fixed in 10.0.2 (released Sep 9, 2026, 17 days before disclosure).

    The latest release, 10.4.0, is not affected.

    48% of nodemailer downloads last week were affected versions (18.9M).

  • nodemailer before 10.0.6 Denial of Service via addressparser

    Affected: fixed in 10.0.6.

    Fixed in 10.0.6 (released Sep 11, 2026, 15 days before disclosure).

    The latest release, 10.4.0, is not affected.

    49% of nodemailer downloads last week were affected versions (19.2M).

  • CVE-2026-100699Medium 6.9

    Nodemailer before 10.0.9 Malformed Envelope Recipient via RFC 5322 Comment

    Affected: from 9.1.0, fixed in 10.0.9.

    Fixed in 10.0.9 (released Sep 12, 2026, 14 days before disclosure).

    The latest release, 10.4.0, is not affected.

    4.7% of nodemailer downloads last week were affected versions (1.8M).

  • Nodemailer before 9.1.0 IDN/Punycode Domain Allow-list Bypass

    Affected: fixed in 9.1.0.

    Fixed in 9.1.0 (released Aug 31, 2026, 16 days before disclosure).

    The latest release, 10.4.0, is not affected.

    45% of nodemailer downloads last week were affected versions (17.6M).

  • Nodemailer before 9.1.0 Email Domain Validation Bypass via RFC 5322 Comment

    Affected: from 6.9.16, fixed in 9.1.0.

    Fixed in 9.1.0 (released Aug 31, 2026, 16 days before disclosure).

    The latest release, 10.4.0, is not affected.

    38% of nodemailer downloads last week were affected versions (14.8M).

  • Nodemailer before 9.1.0 Denial of Service via addressparser

    Affected: fixed in 9.1.0.

    Fixed in 9.1.0 (released Aug 31, 2026, 16 days before disclosure).

    The latest release, 10.4.0, is not affected.

    45% of nodemailer downloads last week were affected versions (17.6M).

  • CVE-2026-92595Medium 6.0

    Nodemailer before 9.1.1 Security Sandbox Bypass via resolveContent

    Affected: fixed in 9.1.1.

    Fixed in 9.1.1 (released Sep 1, 2026, 15 days before disclosure).

    The latest release, 10.4.0, is not affected.

    45% of nodemailer downloads last week were affected versions (17.7M).

Show all 27 advisoriesShow fewer advisories

  • Nodemailer 9.1.0 through 10.0.4 Denial of Service via Quadratic Address Parsing

    Affected: from 9.1.0, fixed in 10.0.5.

    Fixed in 10.0.5 (released Sep 11, 2026, 2 days before disclosure).

    The latest release, 10.4.0, is not affected.

    4.1% of nodemailer downloads last week were affected versions (1.6M).

  • CVE-2026-82854Critical 9.3

    Nodemailer before 8.0.4 SMTP Command Injection via envelope.size

    Affected: fixed in 8.0.4.

    Fixed in 8.0.4 (released Mar 25, 2026, 159 days before disclosure).

    The latest release, 10.4.0, is not affected.

    30% of nodemailer downloads last week were affected versions (11.9M).

  • CVE-2026-82853Medium 6.9

    Nodemailer before 8.0.5 SMTP Command Injection via CRLF

    Affected: fixed in 8.0.5.

    Fixed in 8.0.5 (released Apr 7, 2026, 146 days before disclosure).

    The latest release, 10.4.0, is not affected.

    31% of nodemailer downloads last week were affected versions (12.2M).

  • Nodemailer before 8.0.8 TLS Certificate Validation Bypass

    Affected: fixed in 8.0.8.

    Fixed in 8.0.8 (released May 23, 2026, 100 days before disclosure).

    The latest release, 10.4.0, is not affected.

    34% of nodemailer downloads last week were affected versions (13.4M).

  • CVE-2026-82661Medium 5.3

    Nodemailer CRLF Injection via List- Header Comments

    Affected: fixed in 8.0.9.

    Fixed in 8.0.9 (released May 26, 2026, 97 days before disclosure).

    The latest release, 10.4.0, is not affected.

    34% of nodemailer downloads last week were affected versions (13.5M).

  • CVE-2026-82660Medium 5.3

    Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess

    Affected: fixed in 8.0.9.

    Fixed in 8.0.9 (released May 26, 2026, 97 days before disclosure).

    The latest release, 10.4.0, is not affected.

    34% of nodemailer downloads last week were affected versions (13.5M).

  • nodemailer before 9.0.1 File Read and SSRF via raw option

    Affected: fixed in 9.0.1.

    Fixed in 9.0.1 (released Jun 17, 2026, 75 days before disclosure).

    The latest release, 10.4.0, is not affected.

    38% of nodemailer downloads last week were affected versions (14.7M).

  • CVE-2024-58379Medium 6.9

    nodemailer before 6.9.9 ReDoS via attachDataUrls parameter

    Affected: fixed in 6.9.9.

    Fixed in 6.9.9 (released Feb 1, 2024, 942 days before disclosure).

    The latest release, 10.4.0, is not affected.

    3.8% of nodemailer downloads last week were affected versions (1.5M).

  • Nodemailer: nodemailer: denial of service via crafted email address header

    Affected: from 3.0.0, fixed in 7.0.11.

    Fixed in 7.0.11 (released Nov 26, 2025, 22 days before disclosure).

    The latest release, 10.4.0, is not affected.

    22% of nodemailer downloads last week were affected versions (8.8M).

  • Nodemailer: nodemailer: email to an unintended domain can occur due to interpretation conflict

    Affected: fixed in 7.0.7.

    Fixed in 7.0.7 (released Oct 5, 2025, 40 days before disclosure).

    The latest release, 10.4.0, is not affected.

    21% of nodemailer downloads last week were affected versions (8.1M).

  • CVE-2021-23400Medium 6.3

    HTTP Header Injection

    Affected: fixed in 6.6.1.

    Fixed in 6.6.1 (released May 23, 2021, 37 days before disclosure).

    The latest release, 10.4.0, is not affected.

    1.1% of nodemailer downloads last week were affected versions (425.5K).

  • Command Injection

    Affected: fixed in 6.4.16.

    Fixed in 6.4.16 (released Nov 12, 2020, the day of disclosure).

    The latest release, 10.4.0, is not affected.

    1% of nodemailer downloads last week were affected versions (392.8K).