# nodemailer (npm) vulnerabilities 27 known vulnerabilities (1 critical, 15 high, 11 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 10.4.0 (Nov 7, 2026): no advisory affects it - Newest unaffected release: 10.4.0 (Nov 7, 2026), the latest release - Weekly downloads: 35.5M - Dependents: 2,047 - Releases: 338 since 0.1.1 (Dec 8, 2011) - Registry: https://www.npmjs.com/package/nodemailer - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-121426: 3.0.0 to 10.1.3 (10.1.4 is outside it) - GHSA-8C8M-P3M8-CJG8: 3.0.0 to 10.1.3 (10.1.4 is outside it) - GHSA-M943-M63M-W62W: 3.0.0 to 10.1.3 (10.1.4 is outside it) - CVE-2026-110872: 3.0.0 to 10.0.9 (10.0.10 is outside it) - CVE-2026-110871: 3.0.0 to 10.0.9 (10.0.10 is outside it) - CVE-2026-110870: 3.0.0 to 10.0.12 (10.0.13 is outside it) - CVE-2026-110869: 3.0.0 to 10.0.12 (10.0.13 is outside it) - CVE-2026-100702: 0.1.1 to 10.0.1 (10.0.2 is outside it) - CVE-2026-100701: 5.0.0 to 10.0.1 (10.0.2 is outside it) - CVE-2026-100700: 0.1.1 to 10.0.5 (10.0.6 is outside it) - CVE-2026-100699: 9.1.0 to 10.0.8 (10.0.9 is outside it) - CVE-2026-92598: 0.1.1 to 9.0.6 (9.1.0 is outside it) - CVE-2026-92597: 6.9.16 to 9.0.6 (9.1.0 is outside it) - CVE-2026-92596: 0.1.1 to 9.0.6 (9.1.0 is outside it) - CVE-2026-92595: 0.1.1 to 9.1.0 (9.1.1 is outside it) - CVE-2026-90776: 9.1.0 to 10.0.4 (10.0.5 is outside it) - CVE-2026-82854: 0.1.1 to 8.0.3 (8.0.4 is outside it) - CVE-2026-82853: 0.1.1 to 8.0.4 (8.0.5 is outside it) - CVE-2026-82662: 0.1.1 to 8.0.7 (8.0.8 is outside it) - CVE-2026-82661: 0.1.1 to 8.0.8 (8.0.9 is outside it) - CVE-2026-82660: 0.1.1 to 8.0.8 (8.0.9 is outside it) - CVE-2026-82659: 0.1.1 to 9.0.0 (9.0.1 is outside it) - CVE-2024-58379: 0.1.1 to 6.9.8 (6.9.9 is outside it) - CVE-2025-14874: 3.0.0 to 7.0.10 (7.0.11 is outside it) - CVE-2025-13033: 0.1.1 to 7.0.6 (7.0.7 is outside it) - CVE-2021-23400: 0.1.1 to 6.6.0 (6.6.1 is outside it) - CVE-2020-7769: 0.1.1 to 6.4.15 (6.4.16 is outside it) ## Advisories (27) ### [CVE-2026-121426](https://cve.now/CVE-2026-121426): Nodemailer 3.0.0 before 10.1.4 Recipient Domain Confusion via addressparser - Severity: High 8.3 - Published: Nov 3, 2026 - Affected: from 3.0.0, fixed in 10.1.4. - Fixed in 10.1.4 (released Oct 18, 2026, 16 days before disclosure). - The latest release, 10.4.0, is not affected. - 66% of nodemailer downloads last week were affected versions (26M). ### [GHSA-8C8M-P3M8-CJG8](https://cve.now/GHSA-8C8M-P3M8-CJG8): Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient - Severity: Medium - Published: Oct 23, 2026 - Affected: from 3.0.0, fixed in 10.1.4. - Fixed in 10.1.4 (released Oct 18, 2026, 5 days before disclosure). - The latest release, 10.4.0, is not affected. - 66% of nodemailer downloads last week were affected versions (26M). ### [GHSA-M943-M63M-W62W](https://cve.now/GHSA-M943-M63M-W62W): Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient - Severity: Medium - Published: Oct 23, 2026 - Affected: from 3.0.0, fixed in 10.1.4. - Fixed in 10.1.4 (released Oct 18, 2026, 5 days before disclosure). - The latest release, 10.4.0, is not affected. - 66% of nodemailer downloads last week were affected versions (26M). ### [CVE-2026-110872](https://cve.now/CVE-2026-110872): Nodemailer 3.0.0 before 10.0.10 Denial of Service via SMTP Reply Parsing - Severity: High 8.2 - Published: Oct 14, 2026 - Affected: from 3.0.0, fixed in 10.0.10. - Fixed in 10.0.10 (released Sep 14, 2026, 30 days before disclosure). - The latest release, 10.4.0, is not affected. - 50% of nodemailer downloads last week were affected versions (19.6M). ### [CVE-2026-110871](https://cve.now/CVE-2026-110871): Nodemailer 3.0.0 before 10.0.10 Quadratic DKIM Header Unfolding Denial of Service - Severity: High 7.1 - Published: Oct 14, 2026 - Affected: from 3.0.0, fixed in 10.0.10. - Fixed in 10.0.10 (released Sep 14, 2026, 30 days before disclosure). - The latest release, 10.4.0, is not affected. - 50% of nodemailer downloads last week were affected versions (19.6M). ### [CVE-2026-110870](https://cve.now/CVE-2026-110870): Nodemailer before 10.0.13 Improper Input Validation via Angle-Bracket Address Comments - Severity: Medium 6.9 - Published: Oct 14, 2026 - Affected: from 3.0.0, fixed in 10.0.13. - Fixed in 10.0.13 (released Sep 30, 2026, 14 days before disclosure). - The latest release, 10.4.0, is not affected. - 55% of nodemailer downloads last week were affected versions (21.7M). ### [CVE-2026-110869](https://cve.now/CVE-2026-110869): Nodemailer 3.0.0 before 10.0.13 ReDoS via SMTP AUTH Mechanism Detection Regexes - Severity: High 8.7 - Published: Oct 14, 2026 - Affected: from 3.0.0, fixed in 10.0.13. - Fixed in 10.0.13 (released Sep 30, 2026, 14 days before disclosure). - The latest release, 10.4.0, is not affected. - 55% of nodemailer downloads last week were affected versions (21.7M). ### [CVE-2026-100702](https://cve.now/CVE-2026-100702): Nodemailer before 10.0.2 Stack Exhaustion via Nested Recipient Arrays - Severity: High 8.2 - Published: Sep 26, 2026 - Affected: fixed in 10.0.2. - Fixed in 10.0.2 (released Sep 9, 2026, 17 days before disclosure). - The latest release, 10.4.0, is not affected. - 49% of nodemailer downloads last week were affected versions (19.2M). ### [CVE-2026-100701](https://cve.now/CVE-2026-100701): Nodemailer 5.0.0 through 10.0.1 TLS servername Cache Confusion - Severity: Medium 6.0 - Published: Sep 26, 2026 - Affected: from 5.0.0, fixed in 10.0.2. - Fixed in 10.0.2 (released Sep 9, 2026, 17 days before disclosure). - The latest release, 10.4.0, is not affected. - 48% of nodemailer downloads last week were affected versions (18.9M). ### [CVE-2026-100700](https://cve.now/CVE-2026-100700): nodemailer before 10.0.6 Denial of Service via addressparser - Severity: High 8.7 - Published: Sep 26, 2026 - Affected: fixed in 10.0.6. - Fixed in 10.0.6 (released Sep 11, 2026, 15 days before disclosure). - The latest release, 10.4.0, is not affected. - 49% of nodemailer downloads last week were affected versions (19.2M). ### [CVE-2026-100699](https://cve.now/CVE-2026-100699): Nodemailer before 10.0.9 Malformed Envelope Recipient via RFC 5322 Comment - Severity: Medium 6.9 - Published: Sep 26, 2026 - Affected: from 9.1.0, fixed in 10.0.9. - Fixed in 10.0.9 (released Sep 12, 2026, 14 days before disclosure). - The latest release, 10.4.0, is not affected. - 4.7% of nodemailer downloads last week were affected versions (1.8M). ### [CVE-2026-92598](https://cve.now/CVE-2026-92598): Nodemailer before 9.1.0 IDN/Punycode Domain Allow-list Bypass - Severity: High 8.3 - Published: Sep 16, 2026 - Affected: fixed in 9.1.0. - Fixed in 9.1.0 (released Aug 31, 2026, 16 days before disclosure). - The latest release, 10.4.0, is not affected. - 45% of nodemailer downloads last week were affected versions (17.6M). ### [CVE-2026-92597](https://cve.now/CVE-2026-92597): Nodemailer before 9.1.0 Email Domain Validation Bypass via RFC 5322 Comment - Severity: High 8.3 - Published: Sep 16, 2026 - Affected: from 6.9.16, fixed in 9.1.0. - Fixed in 9.1.0 (released Aug 31, 2026, 16 days before disclosure). - The latest release, 10.4.0, is not affected. - 38% of nodemailer downloads last week were affected versions (14.8M). ### [CVE-2026-92596](https://cve.now/CVE-2026-92596): Nodemailer before 9.1.0 Denial of Service via addressparser - Severity: High 8.7 - Published: Sep 16, 2026 - Affected: fixed in 9.1.0. - Fixed in 9.1.0 (released Aug 31, 2026, 16 days before disclosure). - The latest release, 10.4.0, is not affected. - 45% of nodemailer downloads last week were affected versions (17.6M). ### [CVE-2026-92595](https://cve.now/CVE-2026-92595): Nodemailer before 9.1.1 Security Sandbox Bypass via resolveContent - Severity: Medium 6.0 - Published: Sep 16, 2026 - Affected: fixed in 9.1.1. - Fixed in 9.1.1 (released Sep 1, 2026, 15 days before disclosure). - The latest release, 10.4.0, is not affected. - 45% of nodemailer downloads last week were affected versions (17.7M). ### [CVE-2026-90776](https://cve.now/CVE-2026-90776): Nodemailer 9.1.0 through 10.0.4 Denial of Service via Quadratic Address Parsing - Severity: High 8.7 - Published: Sep 13, 2026 - Affected: from 9.1.0, fixed in 10.0.5. - Fixed in 10.0.5 (released Sep 11, 2026, 2 days before disclosure). - The latest release, 10.4.0, is not affected. - 4.1% of nodemailer downloads last week were affected versions (1.6M). ### [CVE-2026-82854](https://cve.now/CVE-2026-82854): Nodemailer before 8.0.4 SMTP Command Injection via envelope.size - Severity: Critical 9.3 - Published: Aug 31, 2026 - Affected: fixed in 8.0.4. - Fixed in 8.0.4 (released Mar 25, 2026, 159 days before disclosure). - The latest release, 10.4.0, is not affected. - 30% of nodemailer downloads last week were affected versions (11.9M). ### [CVE-2026-82853](https://cve.now/CVE-2026-82853): Nodemailer before 8.0.5 SMTP Command Injection via CRLF - Severity: Medium 6.9 - Published: Aug 31, 2026 - Affected: fixed in 8.0.5. - Fixed in 8.0.5 (released Apr 7, 2026, 146 days before disclosure). - The latest release, 10.4.0, is not affected. - 31% of nodemailer downloads last week were affected versions (12.2M). ### [CVE-2026-82662](https://cve.now/CVE-2026-82662): Nodemailer before 8.0.8 TLS Certificate Validation Bypass - Severity: High 8.3 - Published: Aug 31, 2026 - Affected: fixed in 8.0.8. - Fixed in 8.0.8 (released May 23, 2026, 100 days before disclosure). - The latest release, 10.4.0, is not affected. - 34% of nodemailer downloads last week were affected versions (13.4M). ### [CVE-2026-82661](https://cve.now/CVE-2026-82661): Nodemailer CRLF Injection via List- Header Comments - Severity: Medium 5.3 - Published: Aug 31, 2026 - Affected: fixed in 8.0.9. - Fixed in 8.0.9 (released May 26, 2026, 97 days before disclosure). - The latest release, 10.4.0, is not affected. - 34% of nodemailer downloads last week were affected versions (13.5M). ### [CVE-2026-82660](https://cve.now/CVE-2026-82660): Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess - Severity: Medium 5.3 - Published: Aug 31, 2026 - Affected: fixed in 8.0.9. - Fixed in 8.0.9 (released May 26, 2026, 97 days before disclosure). - The latest release, 10.4.0, is not affected. - 34% of nodemailer downloads last week were affected versions (13.5M). ### [CVE-2026-82659](https://cve.now/CVE-2026-82659): nodemailer before 9.0.1 File Read and SSRF via raw option - Severity: High 7.1 - Published: Aug 31, 2026 - Affected: fixed in 9.0.1. - Fixed in 9.0.1 (released Jun 17, 2026, 75 days before disclosure). - The latest release, 10.4.0, is not affected. - 38% of nodemailer downloads last week were affected versions (14.7M). ### [CVE-2024-58379](https://cve.now/CVE-2024-58379): nodemailer before 6.9.9 ReDoS via attachDataUrls parameter - Severity: Medium 6.9 - Published: Aug 31, 2026 - Affected: fixed in 6.9.9. - Fixed in 6.9.9 (released Feb 1, 2024, 942 days before disclosure). - The latest release, 10.4.0, is not affected. - 3.8% of nodemailer downloads last week were affected versions (1.5M). ### [CVE-2025-14874](https://cve.now/CVE-2025-14874): Nodemailer: nodemailer: denial of service via crafted email address header - Severity: High 7.5 - Published: Dec 18, 2025 - Affected: from 3.0.0, fixed in 7.0.11. - Fixed in 7.0.11 (released Nov 26, 2025, 22 days before disclosure). - The latest release, 10.4.0, is not affected. - 22% of nodemailer downloads last week were affected versions (8.8M). ### [CVE-2025-13033](https://cve.now/CVE-2025-13033): Nodemailer: nodemailer: email to an unintended domain can occur due to interpretation conflict - Severity: High 7.5 - Published: Nov 14, 2025 - Affected: fixed in 7.0.7. - Fixed in 7.0.7 (released Oct 5, 2025, 40 days before disclosure). - The latest release, 10.4.0, is not affected. - 21% of nodemailer downloads last week were affected versions (8.1M). ### [CVE-2021-23400](https://cve.now/CVE-2021-23400): HTTP Header Injection - Severity: Medium 6.3 - Published: Jun 29, 2021 - Affected: fixed in 6.6.1. - Fixed in 6.6.1 (released May 23, 2021, 37 days before disclosure). - The latest release, 10.4.0, is not affected. - 1.1% of nodemailer downloads last week were affected versions (425.5K). ### [CVE-2020-7769](https://cve.now/CVE-2020-7769): Command Injection - Severity: High 8.6 - Published: Nov 12, 2020 - Affected: fixed in 6.4.16. - Fixed in 6.4.16 (released Nov 12, 2020, the day of disclosure). - The latest release, 10.4.0, is not affected. - 1% of nodemailer downloads last week were affected versions (392.8K). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/nodemailer Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.