Skip to content
OpenAdvisories

Vendor

nodemailer

26 known vulnerabilities.

Products

nodemailer 26
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.8
    CVE-2026-82854

    Nodemailer before 8.0.4 SMTP Command Injection via envelope.size

    Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.size parameter. When an application passes a custom envelope object with a size property containing CRLF characters to sendMail(), the value is concatenated into …

    nodemailer nodemailer node-nodemailer nodemailer Debian Ubuntu npm