npm - OSV

GHSA-prgh-xp8r-p3m5

npm/nodemailer

Nodemailer addressparser: O(n^2) on comment-joined addresses enables a remote DoS (reachable via mailparser) 30 Sep

Fix available
Severity - 7.5 (High)

GHSA-g57g-f23g-4646

npm/nodemailer

Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing 29 Sep

Fix available
Severity - 5.3 (Medium)

GHSA-v53p-9fqp-m79j

npm/nodemailer

Nodemailer: Quadratic backtracking in the addressparser free-text fallback allows remote denial of service 29 Sep

Fix available
Severity - 7.5 (High)

GHSA-8vvx-rff5-p5rq

npm/nodemailer

Nodemailer: Nested structured recipient arrays bypass the parser depth limit and cause stack exhaustion DoS 29 Sep

Fix available
Severity - 5.9 (Medium)

GHSA-6vj9-mwq6-2f5v

npm/nodemailer

Nodemailer: Process-global DNS cache reuses TLS `servername` across transports, enabling cross-tenant SMTP credential disclosure 28 Sep

Fix available
Severity - 5.9 (Medium)

GHSA-wmmp-3585-3rmp

npm/nodemailer

Nodemailer: IDN/Punycode domain allow-list bypass leads to email delivery to an attacker-controlled domain 08 Sep

Fix available
Severity - 6.5 (Medium)

GHSA-2x7j-588g-ccc2

npm/nodemailer

Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address list 08 Sep

Fix available
Severity - 7.5 (High)

GHSA-cc9r-2j5m-2m83

npm/nodemailer

Nodemailer: Recipient-domain validation bypass via RFC 5322 comment mis-parsing leads to email delivery to an attacker-controlled domain 08 Sep

Fix available
Severity - 6.5 (Medium)

GHSA-8m3c-c648-2xjj

npm/nodemailer

Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disableUrlAccess when called with the legacy signature 08 Sep

Fix available
Severity - 5.9 (Medium)

GHSA-p6gq-j5cr-w38f

npm/nodemailer

Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered message 18 Jun

Fix available
Severity - 7.1 (High)

GHSA-268h-hp4c-crq3

npm/nodemailer

Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message header injection 15 Jun

Fix available
Severity - 5.4 (Medium)

GHSA-wqvq-jvpq-h66f

npm/nodemailer

Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess during message normalization 15 Jun

Fix available
Severity - 5.4 (Medium)

GHSA-r7g4-qg5f-qqm2

npm/nodemailer

Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interception 15 Jun

Fix available
Severity - 8.3 (High)

GHSA-vvjj-xcjg-gr5g

npm/nodemailer

Nodemailer Vulnerable to SMTP Command Injection via CRLF in Transport name Option (EHLO/HELO) 08 Apr

Fix available
Severity - 4.9 (Medium)

GHSA-c7w3-x93f-qmm8

npm/nodemailer

Nodemailer has SMTP command injection due to unsanitized `envelope.size` parameter 26 Mar

Fix available
Severity - 2.3 (Low)

GHSA-rcmh-qjqh-p98v

Maven/org.webjars.npm:nodemailer
npm/nodemailer

Nodemailer’s addressparser is vulnerable to DoS caused by recursive calls 01 Dec 2025

Fix available
Severity - 7.5 (High)

Vulnerabilities