Vendor
nodemailer
26 known vulnerabilities.
nodemailer at a glance
- Last 12 months
- 26
- Critical · all time
- 1
- Exploited · all time
- 0
- Public exploit · all time
- 0
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 4 | 0 |
| Oct 2026 | 4 | 0 |
| Sep 2026 | 9 | 0 |
| Aug 2026 | 7 | 1 |
| Jul 2026 | 0 | 0 |
| Jun 2026 | 0 | 0 |
| May 2026 | 0 | 0 |
| Apr 2026 | 0 | 0 |
| Mar 2026 | 0 | 0 |
| Feb 2026 | 0 | 0 |
| Jan 2026 | 0 | 0 |
| Dec 2025 | 1 | 0 |
| Nov 2025 | 1 | 0 |
| Oct 2025 | 0 | 0 |
| Sep 2025 | 0 | 0 |
| Aug 2025 | 0 | 0 |
| Jul 2025 | 0 | 0 |
| Jun 2025 | 0 | 0 |
| May 2025 | 0 | 0 |
| Apr 2025 | 0 | 0 |
| Mar 2025 | 0 | 0 |
| Feb 2025 | 0 | 0 |
| Jan 2025 | 0 | 0 |
| Dec 2024 | 0 | 0 |
Products
26 results · Feed
-
High 8.3
Nodemailer 3.0.0 before 10.4.1 contains an address parsing flaw in addressparser that truncates domains at folding whit…
-
Medium 6.5
Nodemailer 3.0.0 before 10.1.4 Recipient Domain Confusion via addressparser
Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that ends an angle-addr at a '>' inside a quoted local part, comment or domain literal. Attackers can submit addresses that validate as an allowed domain but are de…
-
Medium 6.5
Nodemailer 3.0.0 before 10.1.4 Address Parsing Bypass via Nested Comments
Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that allows remote attackers to redirect recipients by ending nested RFC 5322 comments at the first closing parenthesis. Attackers can submit addresses whose nested…
-
Medium 6.5
Nodemailer 3.0.0 before 10.1.4 Recipient Injection via addressparser Group Parsing
Nodemailer from 3.0.0 before 10.1.4 contains a parsing flaw in addressparser that ends an RFC 5322 group at a semicolon inside quoted display names or comments. Attackers can submit crafted group addresses that conformant validators approve, redirecting mail …
-
Medium 5.9
Nodemailer 3.0.0 before 10.0.10 Denial of Service via SMTP Reply Parsing
Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP client reply parser in SMTPConnection._onData and isPartialResponse. A malicious SMTP server or on-path attacker can stream continuation lines wit…
-
Medium 6.5
Nodemailer 3.0.0 before 10.0.10 Quadratic DKIM Header Unfolding Denial of Service
Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that allows users to exhaust CPU through quadratic header unfolding. Attackers can supply large recipient lists or long headers that fold into tens o…
-
Medium 5.3
Nodemailer before 10.0.13 Improper Input Validation via Angle-Bracket Address Comments
Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322 comments inside angle-bracket addresses. Attackers can supply recipients like a display name with a parenthesized comme…
-
High 7.5
Nodemailer 3.0.0 before 10.0.13 ReDoS via SMTP AUTH Mechanism Detection Regexes
Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection._actionEHLO, whose four AUTH mechanism detection regexes contain overlapping whitespace sub-patterns that backtrack quadratically. A malicious or man-in-the-middle SM…
-
Medium 5.9
Nodemailer 5.0.0 through 10.0.1 TLS servername Cache Confusion
Nodemailer versions 5.0.0 through 10.0.1 use a process-global DNS cache that is keyed only by the DNS host, while each cache entry also stores the caller-specific TLS servername. When two direct TLS/SMTPS transports (secure: true) resolve the same non-IP host…
-
Medium 5.9
Nodemailer before 10.0.2 Stack Exhaustion via Nested Recipient Arrays
Nodemailer before 10.0.2 fails to properly flatten deeply nested arrays in recipient fields such as to, cc, and bcc, allowing attackers to cause stack exhaustion. Attackers can supply a deeply nested JSON recipient array that triggers recursive Array.toString…
-
High 7.5
nodemailer before 10.0.6 Denial of Service via addressparser
nodemailer before 10.0.6 contains a denial of service vulnerability in the addressparser free-text fallback regex pattern that exhibits quadratic backtracking behavior. Attackers can supply crafted email header values with long whitespace-free runs to block t…
-
Medium 5.3
Nodemailer before 10.0.9 Malformed Envelope Recipient via RFC 5322 Comment
Nodemailer is a Node.js email-sending library. In versions >= 9.1.0 and < 10.0.9, the address parser (src/addressparser) mishandles addresses whose local-part is a quoted string and that are followed by RFC 5322 comments, allowing trailing comment-separated d…
-
Medium 6.5
Nodemailer before 9.1.0 IDN/Punycode Domain Allow-list Bypass
Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible …
-
Medium 6.5
Nodemailer before 9.1.0 Email Domain Validation Bypass via RFC 5322 Comment
Nodemailer versions >= 6.9.16 and < 9.1.0 mis-parse RFC 5322 comments in email addresses: in lib/addressparser, a comment closed immediately before a non-break character causes the tokenizer to concatenate the atoms surrounding the comment instead of treating…
-
Medium 5.9
Nodemailer before 9.1.1 Security Sandbox Bypass via resolveContent
Nodemailer (npm package `nodemailer`) versions 9.1.0 and earlier do not honor the `disableFileAccess` and `disableUrlAccess` sandbox options when message content is resolved through the public plugin API `MailMessage.resolveContent()` using the documented leg…
-
High 7.5
Nodemailer before 9.1.0 Denial of Service via addressparser
Nodemailer before 9.1.0 contains a quadratic time complexity vulnerability in the addressparser component that allows remote attackers to cause denial of service by supplying a crafted comma-separated address list. Attackers can send a single email with a lar…
-
High 7.5
Nodemailer 9.1.0 through 10.0.4 Denial of Service via Quadratic Address Parsing
Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability in the addressparser component when parsing email addresses with RFC 5322 comments. Attackers can craft malicious email headers with comment-separated atoms to consume …
-
Critical 9.8
Nodemailer before 8.0.4 SMTP Command Injection via envelope.size
Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.size parameter. When an application passes a custom envelope object with a size property containing CRLF characters to sendMail(), the value is concatenated into …
-
Medium 4.9
Nodemailer before 8.0.5 SMTP Command Injection via CRLF
Nodemailer versions before 8.0.5 contain an SMTP command injection vulnerability in the transport name option used in EHLO/HELO commands. The name parameter is concatenated directly into SMTP commands without sanitizing carriage return and line feed character…
-
Medium 6.5
Nodemailer before 8.0.8 TLS Certificate Validation Bypass
Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false, allowing attackers to intercept OAuth2 token requests. Attackers in a machine-in-the-middle position can capture OAuth client secrets, refre…
-
Medium 5.4
Nodemailer CRLF Injection via List-* Header Comments
Nodemailer before 8.0.9 fails to sanitize carriage return and line feed characters in list comment fields, allowing attackers to inject arbitrary message headers. An attacker with control over list.*.comment parameters can inject CRLF sequences to create addi…
-
Medium 5.4
Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess
Nodemailer before 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during message normalization in jsonTransport. Attackers can read local files or fetch URLs by supplying path or href values in message content fields, bypassing intended …
-
Medium 5.3
nodemailer before 6.9.9 ReDoS via attachDataUrls parameter
nodemailer before 6.9.9 contains a regular expression denial of service vulnerability in email parsing when attachDataUrls parameter is set or processing embedded file attachments. Attackers can send specially crafted emails with malicious data URLs or embedd…
-
High 7.1
nodemailer before 9.0.1 File Read and SSRF via raw option
nodemailer before 9.0.1 fails to apply disableFileAccess and disableUrlAccess flags to message-level raw option, allowing authenticated attackers to read arbitrary files or perform server-side request forgery by supplying path or href properties. Attackers ca…
-
High 7.5
Nodemailer: nodemailer: denial of service via crafted email address header
A flaw was found in Nodemailer. This vulnerability allows a denial of service (DoS) via a crafted email address header that triggers infinite recursion in the address parser.
-
High 7.5
Nodemailer: nodemailer: email to an unintended domain can occur due to interpretation conflict
A vulnerability was identified in the email parsing library due to improper handling of specially formatted recipient email addresses. An attacker can exploit this flaw by crafting a recipient address that embeds an external address within quotes. This causes…