Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

nodemailer — Vulnerabilities & Security Advisories 24

All 24 CVE vulnerabilities found in nodemailer, with AI-generated Chinese analysis, references, and POCs.

This page aggregates security vulnerabilities associated with the nodemailer product. It collects a comprehensive set of historical vulnerabilities affecting the Nodemailer email client library, spanning its entire maintenance timeline from initial release to current versions. Readers can use this page to track the advisory history of the vendor, understand specific weakness classes impacting the library, and review the complete vulnerability record for the product.

Vendor: n/a

CVE ID Title CVSS Severity Published
CVE-2026-110872 Nodemailer 3.0.0 before 10.0.10 Denial of Service via SMTP Reply Parsing CWE-400 5.9 Medium 2026-10-14
CVE-2026-110871 Nodemailer 3.0.0 before 10.0.10 Quadratic DKIM Header Unfolding Denial of Service CWE-400 6.5 Medium 2026-10-14
CVE-2026-110870 Nodemailer before 10.0.13 Improper Input Validation via Angle-Bracket Address Comments CWE-20 5.3 Medium 2026-10-14
CVE-2026-110869 Nodemailer 3.0.0 before 10.0.13 ReDoS via SMTP AUTH Mechanism Detection Regexes CWE-1333 7.5 High 2026-10-14
CVE-2026-100702 Nodemailer before 10.0.2 Stack Exhaustion via Nested Recipient Arrays CWE-674 5.9 Medium 2026-09-26
CVE-2026-100701 Nodemailer 5.0.0 through 10.0.1 TLS servername Cache Confusion CWE-295 5.9 Medium 2026-09-26
CVE-2026-100700 nodemailer before 10.0.6 Denial of Service via addressparser CWE-407 7.5 High 2026-09-26
CVE-2026-100699 Nodemailer before 10.0.9 Malformed Envelope Recipient via RFC 5322 Comment CWE-20 5.3 Medium 2026-09-26
CVE-2026-92597 Nodemailer before 9.1.0 Email Domain Validation Bypass via RFC 5322 Comment CWE-436 6.5 Medium 2026-09-16
CVE-2026-92598 Nodemailer before 9.1.0 IDN/Punycode Domain Allow-list Bypass CWE-436 6.5 Medium 2026-09-16
CVE-2026-92596 Nodemailer before 9.1.0 Denial of Service via addressparser CWE-400 7.5 High 2026-09-16
CVE-2026-92595 Nodemailer before 9.1.1 Security Sandbox Bypass via resolveContent CWE-73 5.9 Medium 2026-09-16
CVE-2026-90776 Nodemailer 9.1.0 through 10.0.4 Denial of Service via Quadratic Address Parsing CWE-407 7.5 High 2026-09-13
CVE-2026-82854 Nodemailer before 8.0.3 SMTP Command Injection via envelope.size CWE-93 9.8 Critical 2026-08-31
CVE-2026-82853 Nodemailer before 8.0.5 SMTP Command Injection via CRLF CWE-93 4.9 Medium 2026-08-31
CVE-2026-82662 Nodemailer before 8.0.8 TLS Certificate Validation Bypass CWE-295 6.5 Medium 2026-08-31
CVE-2026-82661 Nodemailer CRLF Injection via List-* Header Comments CWE-93 5.4 Medium 2026-08-31
CVE-2026-82660 Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess CWE-862 5.4 Medium 2026-08-31
CVE-2026-82659 nodemailer before 9.0.1 File Read and SSRF via raw option CWE-73 7.1 High 2026-08-31
CVE-2024-58379 nodemailer before 6.9.9 ReDoS via attachDataUrls parameter CWE-1333 5.3 Medium 2026-08-31
CVE-2025-14874 Nodemailer: nodemailer: denial of service via crafted email address header CWE-703 7.5 High 2025-12-18
CVE-2025-13033 Nodemailer: nodemailer: email to an unintended domain can occur due to interpretation conflict CWE-1286 7.5 High 2025-11-14
CVE-2021-23400 HTTP Header Injection 6.3 Medium 2021-06-29
CVE-2020-7769 Command Injection 8.6 High 2020-11-12

All 24 known CVE vulnerabilities affecting nodemailer with full Chinese analysis, references, and POCs where available.