Nodemailer vulnerabilities
26 CVEs and advisories name Nodemailer as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-125755Nodemailer 3.0.0 before 10.4.1 Recipient Allow-List Bypass via addressparser
- CVE-2026-121426Nodemailer 3.0.0 before 10.1.4 Recipient Domain Confusion via addressparser
- CVE-2026-121425Nodemailer 3.0.0 before 10.1.4 Recipient Injection via addressparser Group Parsing
- CVE-2026-121424Nodemailer 3.0.0 before 10.1.4 Address Parsing Bypass via Nested Comments
- CVE-2026-110872Nodemailer 3.0.0 before 10.0.10 Denial of Service via SMTP Reply Parsing
- CVE-2026-110871Nodemailer 3.0.0 before 10.0.10 Quadratic DKIM Header Unfolding Denial of Service
- CVE-2026-110870Nodemailer before 10.0.13 Improper Input Validation via Angle-Bracket Address Comments
- CVE-2026-110869Nodemailer 3.0.0 before 10.0.13 ReDoS via SMTP AUTH Mechanism Detection Regexes
- CVE-2026-100702Nodemailer before 10.0.2 Stack Exhaustion via Nested Recipient Arrays
- CVE-2026-100701Nodemailer 5.0.0 through 10.0.1 TLS servername Cache Confusion
- CVE-2026-100700nodemailer before 10.0.6 Denial of Service via addressparser
- CVE-2026-100699Nodemailer before 10.0.9 Malformed Envelope Recipient via RFC 5322 Comment
- CVE-2026-92598Nodemailer before 9.1.0 IDN/Punycode Domain Allow-list Bypass
- CVE-2026-92597Nodemailer before 9.1.0 Email Domain Validation Bypass via RFC 5322 Comment
- CVE-2026-92596Nodemailer before 9.1.0 Denial of Service via addressparser
- CVE-2026-92595Nodemailer before 9.1.1 Security Sandbox Bypass via resolveContent
- CVE-2026-90776Nodemailer 9.1.0 through 10.0.4 Denial of Service via Quadratic Address Parsing
- CVE-2026-82854Nodemailer before 8.0.4 SMTP Command Injection via envelope.size
- CVE-2026-82853Nodemailer before 8.0.5 SMTP Command Injection via CRLF
- CVE-2026-82662Nodemailer before 8.0.8 TLS Certificate Validation Bypass
- CVE-2026-82661Nodemailer CRLF Injection via List-* Header Comments
- CVE-2026-82660Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess
- CVE-2026-82659nodemailer before 9.0.1 File Read and SSRF via raw option
- CVE-2024-58379nodemailer before 6.9.9 ReDoS via attachDataUrls parameter
- CVE-2025-14874Nodemailer: nodemailer: denial of service via crafted email address header
- CVE-2025-13033Nodemailer: nodemailer: email to an unintended domain can occur due to interpretation conflict