# cve.now: Nodemailer

The newest entries naming Nodemailer as an affected vendor (up to 200), of 26 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-125755](https://cve.now/CVE-2026-125755.md): Nodemailer 3.0.0 before 10.4.1 Recipient Allow-List Bypass via addressparser (CVSS 8.3)
- [CVE-2026-121426](https://cve.now/CVE-2026-121426.md): Nodemailer 3.0.0 before 10.1.4 Recipient Domain Confusion via addressparser (CVSS 8.3)
- [CVE-2026-121425](https://cve.now/CVE-2026-121425.md): Nodemailer 3.0.0 before 10.1.4 Recipient Injection via addressparser Group Parsing (CVSS 8.3)
- [CVE-2026-121424](https://cve.now/CVE-2026-121424.md): Nodemailer 3.0.0 before 10.1.4 Address Parsing Bypass via Nested Comments (CVSS 8.3)
- [CVE-2026-110872](https://cve.now/CVE-2026-110872.md): Nodemailer 3.0.0 before 10.0.10 Denial of Service via SMTP Reply Parsing (CVSS 8.2)
- [CVE-2026-110871](https://cve.now/CVE-2026-110871.md): Nodemailer 3.0.0 before 10.0.10 Quadratic DKIM Header Unfolding Denial of Service (CVSS 7.1)
- [CVE-2026-110870](https://cve.now/CVE-2026-110870.md): Nodemailer before 10.0.13 Improper Input Validation via Angle-Bracket Address Comments (CVSS 6.9)
- [CVE-2026-110869](https://cve.now/CVE-2026-110869.md): Nodemailer 3.0.0 before 10.0.13 ReDoS via SMTP AUTH Mechanism Detection Regexes (CVSS 8.7)
- [CVE-2026-100702](https://cve.now/CVE-2026-100702.md): Nodemailer before 10.0.2 Stack Exhaustion via Nested Recipient Arrays (CVSS 8.2)
- [CVE-2026-100701](https://cve.now/CVE-2026-100701.md): Nodemailer 5.0.0 through 10.0.1 TLS servername Cache Confusion (CVSS 6.0)
- [CVE-2026-100700](https://cve.now/CVE-2026-100700.md): nodemailer before 10.0.6 Denial of Service via addressparser (CVSS 8.7)
- [CVE-2026-100699](https://cve.now/CVE-2026-100699.md): Nodemailer before 10.0.9 Malformed Envelope Recipient via RFC 5322 Comment (CVSS 6.9)
- [CVE-2026-92598](https://cve.now/CVE-2026-92598.md): Nodemailer before 9.1.0 IDN/Punycode Domain Allow-list Bypass (CVSS 8.3)
- [CVE-2026-92597](https://cve.now/CVE-2026-92597.md): Nodemailer before 9.1.0 Email Domain Validation Bypass via RFC 5322 Comment (CVSS 8.3)
- [CVE-2026-92596](https://cve.now/CVE-2026-92596.md): Nodemailer before 9.1.0 Denial of Service via addressparser (CVSS 8.7)
- [CVE-2026-92595](https://cve.now/CVE-2026-92595.md): Nodemailer before 9.1.1 Security Sandbox Bypass via resolveContent (CVSS 6.0)
- [CVE-2026-90776](https://cve.now/CVE-2026-90776.md): Nodemailer 9.1.0 through 10.0.4 Denial of Service via Quadratic Address Parsing (CVSS 8.7)
- [CVE-2026-82854](https://cve.now/CVE-2026-82854.md): Nodemailer before 8.0.4 SMTP Command Injection via envelope.size (CVSS 9.3)
- [CVE-2026-82853](https://cve.now/CVE-2026-82853.md): Nodemailer before 8.0.5 SMTP Command Injection via CRLF (CVSS 6.9)
- [CVE-2026-82662](https://cve.now/CVE-2026-82662.md): Nodemailer before 8.0.8 TLS Certificate Validation Bypass (CVSS 8.3)
- [CVE-2026-82661](https://cve.now/CVE-2026-82661.md): Nodemailer CRLF Injection via List-\* Header Comments (CVSS 5.3)
- [CVE-2026-82660](https://cve.now/CVE-2026-82660.md): Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess (CVSS 5.3)
- [CVE-2026-82659](https://cve.now/CVE-2026-82659.md): nodemailer before 9.0.1 File Read and SSRF via raw option (CVSS 7.1)
- [CVE-2024-58379](https://cve.now/CVE-2024-58379.md): nodemailer before 6.9.9 ReDoS via attachDataUrls parameter (CVSS 6.9)
- [CVE-2025-14874](https://cve.now/CVE-2025-14874.md): Nodemailer: nodemailer: denial of service via crafted email address header (CVSS 7.5)
- [CVE-2025-13033](https://cve.now/CVE-2025-13033.md): Nodemailer: nodemailer: email to an unintended domain can occur due to interpretation conflict (CVSS 7.5)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/nodemailer
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.