{"kind": "product", "path": "vulns/npm/nodemailer", "name": "nodemailer", "product": "nodemailer", "ecosystem": "npm", "items": [{"id": "GHSA-8c8m-p3m8-cjg8", "noindex": false, "published": "2026-10-23T21:53:04Z", "modified": "2026-10-23T22:00:03.731164953Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/ghsa-8c8m-p3m8-cjg8", "title": "Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient", "description": "### Vulnerability summary\n\nRFC 5322 comments nest. addressparser ended a comment at the first `)`, including the one that closes a nested comment, and parsed the rest of the outer comment as header text. `Victim (x(y) <evil@evil.com>) <v@victim.com>` names `v@victim.com` with `x(y) <evil@evil.com>` as a comment, and Nodemailer read it as the address `evil@evil.com`. This is the same shape as the escaped parenthesis fixed in 10.1.2, reached through nesting instead of a quoted-pair. Affected: 3.0.0 through 10.1.3.\n\n### Attacker capabilities\n\nThe attacker controls the text of an address that an application passes to Nodemailer, or the From or To", "references": ["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-8c8m-p3m8-cjg8", "https://github.com/nodemailer/nodemailer/commit/0a8761762ac78f2db2ba37f712f2a52a404ce011", "https://github.com/nodemailer/nodemailer"], "fixes": ["10.1.4"], "products": [{"name": "nodemailer", "path": "vulns/npm/nodemailer", "ecosystem": "npm"}]}, {"id": "GHSA-m943-m63m-w62w", "noindex": false, "published": "2026-10-23T21:51:52Z", "modified": "2026-10-23T22:00:03.716933282Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/ghsa-m943-m63m-w62w", "title": "Nodemailer: A \";\" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient", "description": "### Vulnerability summary\n\naddressparser ends an RFC 5322 group at the first `;`, including one inside a quoted display name or a comment. The text after it is parsed again as top level recipients with the quoting flipped, so text that every conformant parser reads as a display name or comment becomes a live address. `G: (a; <evil@evil.com>) <v@victim.com>;` names only `v@victim.com`, and Nodemailer read it as the single recipient `evil@evil.com`. Affected: 3.0.0 through 10.1.3.\n\n### Attacker capabilities\n\nThe attacker controls the text of an address field that an application passes to Nodemailer, or the header of an inbound message parsed wi", "references": ["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-m943-m63m-w62w", "https://github.com/nodemailer/nodemailer/commit/1cd57d2b8c49dff048c21cdbafdb54439a7f07e2", "https://github.com/nodemailer/nodemailer"], "fixes": ["10.1.4"], "products": [{"name": "nodemailer", "path": "vulns/npm/nodemailer", "ecosystem": "npm"}]}, {"id": "GHSA-85x2-q946-cp5h", "noindex": false, "published": "2026-10-23T21:51:18Z", "modified": "2026-10-23T22:00:03.735116753Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/ghsa-85x2-q946-cp5h", "title": "Nodemailer: A \">\" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name", "description": "### Vulnerability summary\n\naddressparser ends an angle-addr at the first `>` it sees, including one inside a quoted local part, a comment or a domain literal. The domain is then read off the text in front of that `>`. `<\"a@evil.com>\"@good.com>` is the mailbox `\"a@evil.com>\"@good.com` under RFC 5322, and Nodemailer read it as an address at `evil.com`. The unbracketed spelling of the same value was already read correctly. Affected: 3.0.0 through 10.1.3.\n\n### Attacker capabilities\n\nThe attacker controls the text of a recipient or sender address that an application passes to Nodemailer, for example a To value entered in a contact or invite form, ", "references": ["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-85x2-q946-cp5h", "https://github.com/nodemailer/nodemailer/commit/1cd57d2b8c49dff048c21cdbafdb54439a7f07e2", "https://github.com/nodemailer/nodemailer"], "fixes": ["10.1.4"], "products": [{"name": "nodemailer", "path": "vulns/npm/nodemailer", "ecosystem": "npm"}]}, {"id": "CVE-2026-110871", "noindex": false, "published": "2026-10-14T22:52:59.681Z", "modified": "2026-10-20T02:28:10.449Z", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00254, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-110871", "title": "Nodemailer 3.0.0 before 10.0.10 Quadratic DKIM Header Unfolding Denial of Service", "description": "Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that allows users to exhaust CPU through quadratic header unfolding. Attackers can supply large recipient lists or long headers that fold into tens of thousands of continuation lines, blocking the Node.js event loop during DKIM signing.", "references": ["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-39m8-27wv-hr27", "https://www.vulncheck.com/advisories/nodemailer-3.0.0-before-10.0.10-quadratic-dkim-header-unfolding-denial-of-service", "https://nvd.nist.gov/vuln/detail/CVE-2026-110871"], "fixes": ["10.0.10"], "products": [{"name": "nodemailer", "path": "vulns/npm/nodemailer", "ecosystem": "npm"}]}, {"id": "CVE-2026-100702", "noindex": false, "published": "2026-09-26T13:23:57.945Z", "modified": "2026-09-26T23:11:16.551Z", "cvss": 8.2, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.0025, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-100702", "title": "Nodemailer before 10.0.2 Stack Exhaustion via Nested Recipient Arrays", "description": "Nodemailer before 10.0.2 fails to properly flatten deeply nested arrays in recipient fields such as to, cc, and bcc, allowing attackers to cause stack exhaustion. Attackers can supply a deeply nested JSON recipient array that triggers recursive Array.toString() conversion, exhausting the call stack and terminating the Node.js process.", "references": ["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-8vvx-rff5-p5rq", "https://www.vulncheck.com/advisories/nodemailer-before-10.0.2-stack-exhaustion-via-nested-recipient-arrays", "https://nvd.nist.gov/vuln/detail/CVE-2026-100702"], "fixes": ["10.0.2"], "products": [{"name": "nodemailer", "path": "vulns/npm/nodemailer", "ecosystem": "npm"}]}, {"id": "CVE-2026-100701", "noindex": false, "published": "2026-09-26T13:23:57.215Z", "modified": "2026-09-26T23:11:37.880Z", "cvss": 6, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00114, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-100701", "title": "Nodemailer 5.0.0 through 10.0.1 TLS servername Cache Confusion", "description": "Nodemailer versions 5.0.0 through 10.0.1 use a process-global DNS cache that is keyed only by the DNS host, while each cache entry also stores the caller-specific TLS servername. When two direct TLS/SMTPS transports (secure: true) resolve the same non-IP host with different tls.servername values, the first transport's servername is returned on the cache hit and overwrites the second transport's explicitly configured value, so Nodemailer sends the wrong SNI value and validates the peer certificate against the wrong identity. In multi-tenant services or SNI-routed SMTP gateways, an attacker who can prime the cache can cause a victim transport t", "references": ["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-6vj9-mwq6-2f5v", "https://www.vulncheck.com/advisories/nodemailer-5.0.0-through-10.0.1-tls-servername-cache-confusion", "https://nvd.nist.gov/vuln/detail/CVE-2026-100701"], "fixes": ["10.0.2"], "products": [{"name": "nodemailer", "path": "vulns/npm/nodemailer", "ecosystem": "npm"}]}, {"id": "CVE-2026-100700", "noindex": false, "published": "2026-09-26T13:23:56.526Z", "modified": "2026-09-28T15:01:54.036Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00279, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-100700", "title": "nodemailer before 10.0.6 Denial of Service via addressparser", "description": "nodemailer before 10.0.6 contains a denial of service vulnerability in the addressparser free-text fallback regex pattern that exhibits quadratic backtracking behavior. Attackers can supply crafted email header values with long whitespace-free runs to block the Node.js event loop for tens of seconds, causing service unavailability.", "references": ["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-v53p-9fqp-m79j", "https://www.vulncheck.com/advisories/nodemailer-before-10.0.6-denial-of-service-via-addressparser", "https://nvd.nist.gov/vuln/detail/CVE-2026-100700"], "fixes": ["10.0.6"], "products": [{"name": "nodemailer", "path": "vulns/npm/nodemailer", "ecosystem": "npm"}]}, {"id": "CVE-2026-100699", "noindex": false, "published": "2026-09-26T13:23:55.786Z", "modified": "2026-09-28T17:43:19.483Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00193, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-100699", "title": "Nodemailer before 10.0.9 Malformed Envelope Recipient via RFC 5322 Comment", "description": "Nodemailer is a Node.js email-sending library. In versions >= 9.1.0 and < 10.0.9, the address parser (src/addressparser) mishandles addresses whose local-part is a quoted string and that are followed by RFC 5322 comments, allowing trailing comment-separated domain atoms to be retained in the normalized address. For example, the input \"user\"@example.com(x)evil.com is parsed to the address value 'user@example.com evil.com', which contains additional attacker-controlled domain text separated by a literal space. This parsed value is used without further strict recipient validation when the message envelope is built (envelope.to in src/mime-node),", "references": ["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-g57g-f23g-4646", "https://www.vulncheck.com/advisories/nodemailer-before-10.0.9-malformed-envelope-recipient-via-rfc-5322-comment", "https://nvd.nist.gov/vuln/detail/CVE-2026-100699"], "fixes": ["10.0.9"], "products": [{"name": "nodemailer", "path": "vulns/npm/nodemailer", "ecosystem": "npm"}]}, {"id": "CVE-2026-92598", "noindex": false, "published": "2026-09-16T21:47:02.365Z", "modified": "2026-09-17T14:43:20.281Z", "cvss": 8.3, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00395, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-92598", "title": "Nodemailer before 9.1.0 IDN/Punycode Domain Allow-list Bypass", "description": "Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings that pass domain allow-list checks but are delivered to attacker-controlled domains via SMTP.", "references": ["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-wmmp-3585-3rmp", "https://github.com/nodemailer/nodemailer/commit/259c32d", "https://github.com/nodemailer/nodemailer/commit/b212ac4"], "fixes": ["9.1.0"], "products": [{"name": "nodemailer", "path": "vulns/npm/nodemailer", "ecosystem": "npm"}]}, {"id": "CVE-2026-92597", "noindex": false, "published": "2026-09-16T21:47:01.599Z", "modified": "2026-09-17T19:23:22.319Z", "cvss": 8.3, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00382, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-92597", "title": "Nodemailer before 9.1.0 Email Domain Validation Bypass via RFC 5322 Comment", "description": "Nodemailer versions >= 6.9.16 and < 9.1.0 mis-parse RFC 5322 comments in email addresses: in lib/addressparser, a comment closed immediately before a non-break character causes the tokenizer to concatenate the atoms surrounding the comment instead of treating the comment as folding whitespace that terminates the domain. A recipient address such as user@good-corp.com(x)evil.com is therefore read by Nodemailer as the single domain good-corp.comevil.com (registrable domain comevil.com, which an attacker can register) and used for both the SMTP envelope (RCPT TO) and the emitted To:/From: headers, while a conformant RFC 5322 parser terminates the", "references": ["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-cc9r-2j5m-2m83", "https://github.com/nodemailer/nodemailer/commit/902b63e", "https://www.vulncheck.com/advisories/nodemailer-before-9.1.0-email-domain-validation-bypass-via-rfc-5322-comment"], "fixes": ["9.1.0"], "products": [{"name": "nodemailer", "path": "vulns/npm/nodemailer", "ecosystem": "npm"}]}, {"id": "CVE-2026-92596", "noindex": false, "published": "2026-09-16T21:47:00.900Z", "modified": "2026-09-17T13:23:33.704Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00824, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-92596", "title": "Nodemailer before 9.1.0 Denial of Service via addressparser", "description": "Nodemailer before 9.1.0 contains a quadratic time complexity vulnerability in the addressparser component that allows remote attackers to cause denial of service by supplying a crafted comma-separated address list. Attackers can send a single email with a large number of addresses to block the Node.js event loop for extended periods, consuming 100% CPU and freezing the process.", "references": ["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-2x7j-588g-ccc2", "https://github.com/nodemailer/nodemailer/commit/9116da9", "https://github.com/nodemailer/nodemailer/commit/7cc38af"], "fixes": ["9.1.0"], "products": [{"name": "nodemailer", "path": "vulns/npm/nodemailer", "ecosystem": "npm"}]}, {"id": "CVE-2026-92595", "noindex": false, "published": "2026-09-16T21:47:00.171Z", "modified": "2026-09-19T02:05:35.346Z", "cvss": 6, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00295, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-92595", "title": "Nodemailer before 9.1.1 Security Sandbox Bypass via resolveContent", "description": "Nodemailer (npm package `nodemailer`) versions 9.1.0 and earlier do not honor the `disableFileAccess` and `disableUrlAccess` sandbox options when message content is resolved through the public plugin API `MailMessage.resolveContent()` using the documented legacy three-argument signature `resolveContent(data, key, callback)`. Because `shared.resolveContent()` normalizes the missing `options` argument to an empty object, the message-level flags copied into `mail.data` by the MailMessage constructor are discarded, and `resolveContentValue()` skips both access-control checks, reaching `nmfetch(url)` or `fs.createReadStream(path)`. As a result, pl", "references": ["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-8m3c-c648-2xjj", "https://www.vulncheck.com/advisories/nodemailer-before-9.1.1-security-sandbox-bypass-via-resolvecontent", "https://nvd.nist.gov/vuln/detail/CVE-2026-92595"], "fixes": ["9.1.1"], "products": [{"name": "nodemailer", "path": "vulns/npm/nodemailer", "ecosystem": "npm"}]}, {"id": "CVE-2026-90776", "noindex": false, "published": "2026-09-13T11:42:26.391Z", "modified": "2026-09-24T14:21:56.169Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00684, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-90776", "title": "Nodemailer 9.1.0 through 10.0.4 Denial of Service via Quadratic Address Parsing", "description": "Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability in the addressparser component when parsing email addresses with RFC 5322 comments. Attackers can craft malicious email headers with comment-separated atoms to consume excessive CPU and block the Node.js event loop for several seconds, causing denial of service.", "references": ["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-prgh-xp8r-p3m5", "https://github.com/nodemailer/nodemailer/commit/c07f17518d25aca8ab2ad66968dcbca538c24b89", "https://github.com/nodemailer/nodemailer/blob/v10.0.4/src/addressparser/index.ts#L251"], "fixes": ["10.0.5"], "products": [{"name": "nodemailer", "path": "vulns/npm/nodemailer", "ecosystem": "npm"}]}, {"id": "CVE-2026-82854", "noindex": false, "published": "2026-08-31T08:46:28.405Z", "modified": "2026-10-08T15:25:32.582Z", "cvss": 9.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "critical", "epss": 0.01975, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-82854", "title": "Nodemailer before 8.0.3 SMTP Command Injection via envelope.size", "description": "Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.size parameter. When an application passes a custom envelope object with a size property containing CRLF characters to sendMail(), the value is concatenated into the SMTP MAIL FROM command (as SIZE=...) without sanitization, allowing injection of arbitrary SMTP commands such as RCPT TO to silently add attacker-controlled recipients. Exploitation requires the application to expose the envelope size to attacker-controlled input, as Nodemailer does not include size in the default auto-constructed envelope.", "references": ["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-c7w3-x93f-qmm8", "https://www.vulncheck.com/advisories/nodemailer-before-8.0.3-smtp-command-injection-via-envelope-size", "https://nvd.nist.gov/vuln/detail/CVE-2026-82854"], "fixes": ["8.0.4"], "products": [{"name": "nodemailer", "path": "vulns/npm/nodemailer", "ecosystem": "npm"}]}, {"id": "CVE-2026-82853", "noindex": false, "published": "2026-08-31T08:46:27.706Z", "modified": "2026-08-31T11:00:28.826Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.01031, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-82853", "title": "Nodemailer before 8.0.5 SMTP Command Injection via CRLF", "description": "Nodemailer versions before 8.0.5 contain an SMTP command injection vulnerability in the transport name option used in EHLO/HELO commands. The name parameter is concatenated directly into SMTP commands without sanitizing carriage return and line feed characters, allowing attackers to inject arbitrary SMTP commands for email spoofing and phishing attacks.", "references": ["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-vvjj-xcjg-gr5g", "https://www.vulncheck.com/advisories/nodemailer-before-8.0.5-smtp-command-injection-via-crlf", "https://nvd.nist.gov/vuln/detail/CVE-2026-82853"], "fixes": ["8.0.5"], "products": [{"name": "nodemailer", "path": "vulns/npm/nodemailer", "ecosystem": "npm"}]}, {"id": "CVE-2026-82662", "noindex": false, "published": "2026-08-31T08:46:26.978Z", "modified": "2026-09-01T15:00:58.358Z", "cvss": 8.3, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00192, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-82662", "title": "Nodemailer before 8.0.8 TLS Certificate Validation Bypass", "description": "Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false, allowing attackers to intercept OAuth2 token requests. Attackers in a machine-in-the-middle position can capture OAuth client secrets, refresh tokens, and access tokens transmitted over compromised HTTPS connections.", "references": ["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-r7g4-qg5f-qqm2", "https://www.vulncheck.com/advisories/nodemailer-before-8.0.8-tls-certificate-validation-bypass", "https://nvd.nist.gov/vuln/detail/CVE-2026-82662"], "fixes": ["8.0.8"], "products": [{"name": "nodemailer", "path": "vulns/npm/nodemailer", "ecosystem": "npm"}]}, {"id": "CVE-2026-82661", "noindex": false, "published": "2026-08-31T08:46:26.291Z", "modified": "2026-09-02T17:58:31.404Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00261, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-82661", "title": "Nodemailer CRLF Injection via List-* Header Comments", "description": "Nodemailer before 8.0.9 fails to sanitize carriage return and line feed characters in list comment fields, allowing attackers to inject arbitrary message headers. An attacker with control over list.*.comment parameters can inject CRLF sequences to create additional headers in generated RFC822 messages, altering mail client behavior and message semantics.", "references": ["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-268h-hp4c-crq3", "https://www.vulncheck.com/advisories/nodemailer-crlf-injection-via-list-header-comments", "https://nvd.nist.gov/vuln/detail/CVE-2026-82661"], "fixes": ["8.0.9"], "products": [{"name": "nodemailer", "path": "vulns/npm/nodemailer", "ecosystem": "npm"}]}, {"id": "CVE-2026-82660", "noindex": false, "published": "2026-08-31T08:46:25.605Z", "modified": "2026-08-31T14:39:52.418Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.0026, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-82660", "title": "Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess", "description": "Nodemailer before 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during message normalization in jsonTransport. Attackers can read local files or fetch URLs by supplying path or href values in message content fields, bypassing intended access controls.", "references": ["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-wqvq-jvpq-h66f", "https://www.vulncheck.com/advisories/nodemailer-jsontransport-bypasses-disablefileaccess-and-disableurlaccess", "https://nvd.nist.gov/vuln/detail/CVE-2026-82660"], "fixes": ["8.0.9"], "products": [{"name": "nodemailer", "path": "vulns/npm/nodemailer", "ecosystem": "npm"}]}, {"id": "CVE-2026-82659", "noindex": false, "published": "2026-08-31T08:46:24.919Z", "modified": "2026-08-31T18:52:08.928Z", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00349, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-82659", "title": "nodemailer before 9.0.1 File Read and SSRF via raw option", "description": "nodemailer before 9.0.1 fails to apply disableFileAccess and disableUrlAccess flags to message-level raw option, allowing authenticated attackers to read arbitrary files or perform server-side request forgery by supplying path or href properties. Attackers can exploit this by crafting raw messages with file paths or URLs that bypass the intended sandbox, with fetched content delivered in the outgoing message to attacker-controlled recipients.", "references": ["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-p6gq-j5cr-w38f", "https://www.vulncheck.com/advisories/nodemailer-before-9.0.1-file-read-and-ssrf-via-raw-option", "https://nvd.nist.gov/vuln/detail/CVE-2026-82659"], "fixes": ["9.0.1"], "products": [{"name": "nodemailer", "path": "vulns/npm/nodemailer", "ecosystem": "npm"}]}, {"id": "CVE-2024-58379", "noindex": false, "published": "2026-08-31T08:46:24.228Z", "modified": "2026-08-31T11:02:23.257Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00304, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2024-58379", "title": "nodemailer before 6.9.9 ReDoS via attachDataUrls parameter", "description": "nodemailer before 6.9.9 contains a regular expression denial of service vulnerability in email parsing when attachDataUrls parameter is set or processing embedded file attachments. Attackers can send specially crafted emails with malicious data URLs or embedded attachments to cause the event loop to hang and deny service.", "references": ["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-9h6g-pr28-7cqp", "https://www.vulncheck.com/advisories/nodemailer-before-6.9.9-redos-via-attachdataurls-parameter", "https://nvd.nist.gov/vuln/detail/CVE-2024-58379"], "fixes": ["6.9.9"], "products": [{"name": "nodemailer", "path": "vulns/npm/nodemailer", "ecosystem": "npm"}]}], "total": 24, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 2, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "nodemailer", "path": "vulns/npm/nodemailer", "ecosystem": "npm"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 8, "kev": 0}, "lastmod": "2026-10-23T22:00:03.735116753Z", "early_advisories": [], "license": "Подборку PatchFirst и наши дополнения (приоритеты, ранние предупреждения, тексты, сводки и агрегаты) можно свободно использовать для собственных целей, включая внутренние задачи бизнеса. Перепродажа, коммерческое распространение и массовое зеркалирование этой подборки или дополнений допускаются только по письменному соглашению с оператором. При любом использовании или публикации подборки или наших дополнений указывайте PatchFirst (https://ru.patchfirst.dev/vulns/) с этой ссылкой на страницу ленты своего региона. Исходные записи открытых источников остаются под их лицензиями и условиями. Эти условия не ограничивают ваши права на исходные данные, которые можно получить у источников напрямую.", "terms_url": "https://ru.patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://ru.patchfirst.dev/vulns/"}, "source_changes": "PatchFirst отбирает, нормализует и объединяет записи; могут добавляться сводки и переводы. Новости указываются ссылкой на первоисточник в самой записи.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Лицензии исходных баз различаются; см. каталог источников."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Оценки доступны свободно; запрашивается указание источника (FIRST EPSS, оценки подготовлены Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}