Nodemailer
49 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Nodemailer, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.
Nodemailer CVEs per month
| Month | CVEs |
|---|---|
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 1 |
| 2025-12 | 1 |
| 2026-01 | 0 |
| 2026-02 | 0 |
| 2026-03 | 1 |
| 2026-04 | 1 |
| 2026-05 | 0 |
| 2026-06 | 4 |
| 2026-07 | 0 |
| 2026-08 | 7 |
| 2026-09 | 18 |
| 2026-10 | 10 |
| 2026-11 | 3 |
Severity
How the 49 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical1
- High8
- Medium18
Latest CVEs
The 15 most recently published vulnerabilities affecting Nodemailer.
- CVE-2026-121426Nodemailer 3.0.0 before 10.1.4 Recipient Domain Confusion via addressparser6.5
- CVE-2026-121425Nodemailer 3.0.0 before 10.1.4 Recipient Injection via addressparser Group Parsing6.5
- CVE-2026-121424Nodemailer 3.0.0 before 10.1.4 Address Parsing Bypass via Nested Comments6.5
- GHSA-4ffr-jq9g-5ffxNodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service—
- GHSA-g73g-hqqh-jr95Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped—
- GHSA-4g23-2xm8-66gcNodemailer: Quadratic (O(n^2)) SMTP client reply parsing lets a malicious server or MITM cause a pre-auth remote denial of service—
- GHSA-8c8m-p3m8-cjg8Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient—
- GHSA-m943-m63m-w62wNodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient—
- GHSA-85x2-q946-cp5hNodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name—
- CVE-2026-110872Nodemailer 3.0.0 before 10.0.10 Denial of Service via SMTP Reply Parsing5.9
- CVE-2026-110871Nodemailer 3.0.0 before 10.0.10 Quadratic DKIM Header Unfolding Denial of Service6.5
- CVE-2026-110870Nodemailer before 10.0.13 Improper Input Validation via Angle-Bracket Address Comments5.3
- CVE-2026-110869Nodemailer 3.0.0 before 10.0.13 ReDoS via SMTP AUTH Mechanism Detection Regexes7.5
- GHSA-prgh-xp8r-p3m5Nodemailer addressparser: O(n^2) on comment-joined addresses enables a remote DoS (reachable via mailparser)—
- GHSA-g57g-f23g-4646Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing—
Product grouping is registry-driven, with AI assist and human review. How it works