p PatchFirst

PatchFirst · Свежие уязвимости

Уязвимости nodemailer

За последние 30 дней в nodemailer опубликовано уязвимостей: 8; в каталоге KEV: 0.

RSS ↗ JSON ↗
Фильтры уязвимостей
Сбросить фильтры

Уязвимостей: 24

  1. GHSA-8c8m-p3m8-cjg8

    Средний · CVSS 6.5Есть исправление

    Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient

    ### Vulnerability summary RFC 5322 comments nest. addressparser ended a comment at the first `)`, including the one that closes a nested comment, and parsed the rest of the outer comment as header text. `Victim (x(y) <evil@evil.com>) <v@victim.com>` names `v@victim.com` with `x(y) <evil@evil.com>` as a comment, and Nodemailer read it as the address `evil@evil.com`. This is the same shape as the escaped parenthesis fixed in 10.1.2, reached through nesting instead of a quoted-pair. Affected: 3.0.0 through 10.1.3. ### Attacker capabilities The attacker controls the text of an address that an application passes to Nodemailer, or the From or To

    nodemailerNode.js
    • Обновитесь до 10.1.4
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  2. GHSA-m943-m63m-w62w

    Средний · CVSS 6.5Есть исправление

    Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient

    ### Vulnerability summary addressparser ends an RFC 5322 group at the first `;`, including one inside a quoted display name or a comment. The text after it is parsed again as top level recipients with the quoting flipped, so text that every conformant parser reads as a display name or comment becomes a live address. `G: (a; <evil@evil.com>) <v@victim.com>;` names only `v@victim.com`, and Nodemailer read it as the single recipient `evil@evil.com`. Affected: 3.0.0 through 10.1.3. ### Attacker capabilities The attacker controls the text of an address field that an application passes to Nodemailer, or the header of an inbound message parsed wi

    nodemailerNode.js
    • Обновитесь до 10.1.4
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  3. GHSA-85x2-q946-cp5h

    Средний · CVSS 6.5Есть исправление

    Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name

    ### Vulnerability summary addressparser ends an angle-addr at the first `>` it sees, including one inside a quoted local part, a comment or a domain literal. The domain is then read off the text in front of that `>`. `<"a@evil.com>"@good.com>` is the mailbox `"a@evil.com>"@good.com` under RFC 5322, and Nodemailer read it as an address at `evil.com`. The unbracketed spelling of the same value was already read correctly. Affected: 3.0.0 through 10.1.3. ### Attacker capabilities The attacker controls the text of a recipient or sender address that an application passes to Nodemailer, for example a To value entered in a contact or invite form,

    nodemailerNode.js
    • Обновитесь до 10.1.4
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  4. CVE-2026-110871

    Высокий · CVSS 7.1EPSS 0,25%Публичный эксплойтЕсть исправление

    Nodemailer 3.0.0 before 10.0.10 Quadratic DKIM Header Unfolding Denial of Service

    Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that allows users to exhaust CPU through quadratic header unfolding. Attackers can supply large recipient lists or long headers that fold into tens of thousands of continuation lines, blocking the Node.js event loop during DKIM signing.

    nodemailerNode.js
    • Обновитесь до 10.0.10
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  5. CVE-2026-100702

    Высокий · CVSS 8.2EPSS 0,25%Есть исправление

    Nodemailer before 10.0.2 Stack Exhaustion via Nested Recipient Arrays

    Nodemailer before 10.0.2 fails to properly flatten deeply nested arrays in recipient fields such as to, cc, and bcc, allowing attackers to cause stack exhaustion. Attackers can supply a deeply nested JSON recipient array that triggers recursive Array.toString() conversion, exhausting the call stack and terminating the Node.js process.

    nodemailerNode.js
    • Обновитесь до 10.0.2
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  6. CVE-2026-100701

    Средний · CVSS 6EPSS 0,11%Есть исправление

    Nodemailer 5.0.0 through 10.0.1 TLS servername Cache Confusion

    Nodemailer versions 5.0.0 through 10.0.1 use a process-global DNS cache that is keyed only by the DNS host, while each cache entry also stores the caller-specific TLS servername. When two direct TLS/SMTPS transports (secure: true) resolve the same non-IP host with different tls.servername values, the first transport's servername is returned on the cache hit and overwrites the second transport's explicitly configured value, so Nodemailer sends the wrong SNI value and validates the peer certificate against the wrong identity. In multi-tenant services or SNI-routed SMTP gateways, an attacker who can prime the cache can cause a victim transport t

    nodemailerNode.js
    • Обновитесь до 10.0.2
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  7. CVE-2026-100700

    Высокий · CVSS 8.7EPSS 0,28%Есть исправление

    nodemailer before 10.0.6 Denial of Service via addressparser

    nodemailer before 10.0.6 contains a denial of service vulnerability in the addressparser free-text fallback regex pattern that exhibits quadratic backtracking behavior. Attackers can supply crafted email header values with long whitespace-free runs to block the Node.js event loop for tens of seconds, causing service unavailability.

    nodemailerNode.js
    • Обновитесь до 10.0.6
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  8. CVE-2026-100699

    Средний · CVSS 6.9EPSS 0,19%Есть исправление

    Nodemailer before 10.0.9 Malformed Envelope Recipient via RFC 5322 Comment

    Nodemailer is a Node.js email-sending library. In versions >= 9.1.0 and < 10.0.9, the address parser (src/addressparser) mishandles addresses whose local-part is a quoted string and that are followed by RFC 5322 comments, allowing trailing comment-separated domain atoms to be retained in the normalized address. For example, the input "user"@example.com(x)evil.com is parsed to the address value 'user@example.com evil.com', which contains additional attacker-controlled domain text separated by a literal space. This parsed value is used without further strict recipient validation when the message envelope is built (envelope.to in src/mime-node),

    nodemailerNode.js
    • Обновитесь до 10.0.9
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  9. CVE-2026-92598

    Высокий · CVSS 8.3EPSS 0,4%Есть исправление

    Nodemailer before 9.1.0 IDN/Punycode Domain Allow-list Bypass

    Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings that pass domain allow-list checks but are delivered to attacker-controlled domains via SMTP.

    nodemailerNode.js
    • Обновитесь до 9.1.0
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  10. CVE-2026-92597

    Высокий · CVSS 8.3EPSS 0,38%Есть исправление

    Nodemailer before 9.1.0 Email Domain Validation Bypass via RFC 5322 Comment

    Nodemailer versions >= 6.9.16 and < 9.1.0 mis-parse RFC 5322 comments in email addresses: in lib/addressparser, a comment closed immediately before a non-break character causes the tokenizer to concatenate the atoms surrounding the comment instead of treating the comment as folding whitespace that terminates the domain. A recipient address such as user@good-corp.com(x)evil.com is therefore read by Nodemailer as the single domain good-corp.comevil.com (registrable domain comevil.com, which an attacker can register) and used for both the SMTP envelope (RCPT TO) and the emitted To:/From: headers, while a conformant RFC 5322 parser terminates the

    nodemailerNode.js
    • Обновитесь до 9.1.0
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  11. CVE-2026-92596

    Высокий · CVSS 8.7EPSS 0,82%Есть исправление

    Nodemailer before 9.1.0 Denial of Service via addressparser

    Nodemailer before 9.1.0 contains a quadratic time complexity vulnerability in the addressparser component that allows remote attackers to cause denial of service by supplying a crafted comma-separated address list. Attackers can send a single email with a large number of addresses to block the Node.js event loop for extended periods, consuming 100% CPU and freezing the process.

    nodemailerNode.js
    • Обновитесь до 9.1.0
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  12. CVE-2026-92595

    Средний · CVSS 6EPSS 0,29%Есть исправление

    Nodemailer before 9.1.1 Security Sandbox Bypass via resolveContent

    Nodemailer (npm package `nodemailer`) versions 9.1.0 and earlier do not honor the `disableFileAccess` and `disableUrlAccess` sandbox options when message content is resolved through the public plugin API `MailMessage.resolveContent()` using the documented legacy three-argument signature `resolveContent(data, key, callback)`. Because `shared.resolveContent()` normalizes the missing `options` argument to an empty object, the message-level flags copied into `mail.data` by the MailMessage constructor are discarded, and `resolveContentValue()` skips both access-control checks, reaching `nmfetch(url)` or `fs.createReadStream(path)`. As a result, pl

    nodemailerNode.js
    • Обновитесь до 9.1.1
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  13. CVE-2026-90776

    Высокий · CVSS 8.7EPSS 0,68%Публичный эксплойтЕсть исправление

    Nodemailer 9.1.0 through 10.0.4 Denial of Service via Quadratic Address Parsing

    Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability in the addressparser component when parsing email addresses with RFC 5322 comments. Attackers can craft malicious email headers with comment-separated atoms to consume excessive CPU and block the Node.js event loop for several seconds, causing denial of service.

    nodemailerNode.js
    • Обновитесь до 10.0.5
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  14. CVE-2026-82854

    Критический · CVSS 9.3EPSS 1,98%Есть исправление

    Nodemailer before 8.0.3 SMTP Command Injection via envelope.size

    Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.size parameter. When an application passes a custom envelope object with a size property containing CRLF characters to sendMail(), the value is concatenated into the SMTP MAIL FROM command (as SIZE=...) without sanitization, allowing injection of arbitrary SMTP commands such as RCPT TO to silently add attacker-controlled recipients. Exploitation requires the application to expose the envelope size to attacker-controlled input, as Nodemailer does not include size in the default auto-constructed envelope.

    nodemailerNode.js
    • Обновитесь до 8.0.4
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  15. CVE-2026-82853

    Средний · CVSS 6.9EPSS 1,03%Есть исправление

    Nodemailer before 8.0.5 SMTP Command Injection via CRLF

    Nodemailer versions before 8.0.5 contain an SMTP command injection vulnerability in the transport name option used in EHLO/HELO commands. The name parameter is concatenated directly into SMTP commands without sanitizing carriage return and line feed characters, allowing attackers to inject arbitrary SMTP commands for email spoofing and phishing attacks.

    nodemailerNode.js
    • Обновитесь до 8.0.5
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  16. CVE-2026-82662

    Высокий · CVSS 8.3EPSS 0,19%Есть исправление

    Nodemailer before 8.0.8 TLS Certificate Validation Bypass

    Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false, allowing attackers to intercept OAuth2 token requests. Attackers in a machine-in-the-middle position can capture OAuth client secrets, refresh tokens, and access tokens transmitted over compromised HTTPS connections.

    nodemailerNode.js
    • Обновитесь до 8.0.8
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  17. CVE-2026-82661

    Средний · CVSS 5.3EPSS 0,26%Есть исправление

    Nodemailer CRLF Injection via List-* Header Comments

    Nodemailer before 8.0.9 fails to sanitize carriage return and line feed characters in list comment fields, allowing attackers to inject arbitrary message headers. An attacker with control over list.*.comment parameters can inject CRLF sequences to create additional headers in generated RFC822 messages, altering mail client behavior and message semantics.

    nodemailerNode.js
    • Обновитесь до 8.0.9
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  18. CVE-2026-82660

    Средний · CVSS 5.3EPSS 0,26%Есть исправление

    Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess

    Nodemailer before 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during message normalization in jsonTransport. Attackers can read local files or fetch URLs by supplying path or href values in message content fields, bypassing intended access controls.

    nodemailerNode.js
    • Обновитесь до 8.0.9
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  19. CVE-2026-82659

    Высокий · CVSS 7.1EPSS 0,35%Есть исправление

    nodemailer before 9.0.1 File Read and SSRF via raw option

    nodemailer before 9.0.1 fails to apply disableFileAccess and disableUrlAccess flags to message-level raw option, allowing authenticated attackers to read arbitrary files or perform server-side request forgery by supplying path or href properties. Attackers can exploit this by crafting raw messages with file paths or URLs that bypass the intended sandbox, with fetched content delivered in the outgoing message to attacker-controlled recipients.

    nodemailerNode.js
    • Обновитесь до 9.0.1
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  20. CVE-2024-58379

    Средний · CVSS 6.9EPSS 0,3%Есть исправление

    nodemailer before 6.9.9 ReDoS via attachDataUrls parameter

    nodemailer before 6.9.9 contains a regular expression denial of service vulnerability in email parsing when attachDataUrls parameter is set or processing embedded file attachments. Attackers can send specially crafted emails with malicious data URLs or embedded attachments to cause the event loop to hang and deny service.

    nodemailerNode.js
    • Обновитесь до 6.9.9
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

Проверьте свой сервер

Сопоставьте установленный стек и версии со свежими базами уязвимостей.

Проверьте свой сервер →