nodemailer vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-110871Mediumnodemailer: Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signing CVE-2026-90776Highnodemailer: Nodemailer addressparser: O(n^2) on comment-joined addresses enables a remote DoS (reachable via mailparser)GHSA-G57G-F23G-4646Mediumnodemailer: Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing GHSA-V53P-9FQP-M79JHighnodemailer: Nodemailer: Quadratic backtracking in the addressparser free-text fallback allows remote denial of service GHSA-8VVX-RFF5-P5RQMediumnodemailer: Nodemailer: Nested structured recipient arrays bypass the parser depth limit and cause stack exhaustion DoS GHSA-6VJ9-MWQ6-2F5VMediumnodemailer: Nodemailer: Process-global DNS cache reuses TLS `servername` across transports, enabling cross-tenant SMTP credential disclosure GHSA-WMMP-3585-3RMPMediumnodemailer: Nodemailer: IDN/Punycode domain allow-list bypass leads to email delivery to an attacker-controlled domain GHSA-2X7J-588G-CCC2Highnodemailer: Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address list GHSA-CC9R-2J5M-2M83Mediumnodemailer: Nodemailer: Recipient-domain validation bypass via RFC 5322 comment mis-parsing leads to email delivery to an attacker-controlled domain GHSA-8M3C-C648-2XJJMediumnodemailer: Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disableUrlAccess when called with the legacy signature CVE-2026-82659Highnodemailer: Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in…GHSA-268H-HP4C-CRQ3Mediumnodemailer: Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message header injection GHSA-WQVQ-JVPQ-H66FMediumnodemailer: Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess during message normalization CVE-2026-82662Highnodemailer: Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interception GHSA-VVJJ-XCJG-GR5GMediumnodemailer: Nodemailer Vulnerable to SMTP Command Injection via CRLF in Transport name Option (EHLO/HELO) GHSA-C7W3-X93F-QMM8Lownodemailer: Nodemailer has SMTP command injection due to unsanitized `envelope.size` parameter CVE-2025-14874Highnodemailer: Nodemailer’s addressparser is vulnerable to DoS caused by recursive calls CVE-2025-13033Mediumnodemailer: Nodemailer: Email to an unintended domain can occur due to Interpretation Conflict GHSA-9H6G-PR28-7CQPMediumnodemailer: nodemailer ReDoS when trying to send a specially crafted email CVE-2021-23400Mediumnodemailer: Header injection in nodemailer CVE-2020-7769Criticalnodemailer: Command injection in nodemailer

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo