Nnodemailer

Products

Exploited and recent CVEs

• CVE-2026-121426 Medium 6.5 Nodemailer 3.0.0 before 10.1.4 Recipient Domain Confusion via addressparser 0.2%
• CVE-2026-121425 Medium 6.5 Nodemailer 3.0.0 before 10.1.4 Recipient Injection via addressparser Group Parsing 0.3%
• CVE-2026-121424 Medium 6.5 Nodemailer 3.0.0 before 10.1.4 Address Parsing Bypass via Nested Comments 0.3%
• CVE-2026-110872 Medium 5.9 Nodemailer 3.0.0 before 10.0.10 Denial of Service via SMTP Reply Parsing 0.4%
• CVE-2026-110871 Medium 6.5 Nodemailer 3.0.0 before 10.0.10 Quadratic DKIM Header Unfolding Denial of Service 0.4%
• CVE-2026-110870 Medium 5.3 Nodemailer before 10.0.13 Improper Input Validation via Angle-Bracket Address Comments 0.3%
• CVE-2026-110869 High 7.5 Nodemailer 3.0.0 before 10.0.13 ReDoS via SMTP AUTH Mechanism Detection Regexes 0.4%
• CVE-2026-100702 Medium 5.9 Nodemailer before 10.0.2 Stack Exhaustion via Nested Recipient Arrays 0.2%
• CVE-2026-100701 Medium 5.9 Nodemailer 5.0.0 through 10.0.1 TLS servername Cache Confusion 0.1%
• CVE-2026-100700 High 7.5 nodemailer before 10.0.6 Denial of Service via addressparser 0.3%
• CVE-2026-100699 Medium 5.3 Nodemailer before 10.0.9 Malformed Envelope Recipient via RFC 5322 Comment 0.2%
• CVE-2026-92598 Medium 6.5 Nodemailer before 9.1.0 IDN/Punycode Domain Allow-list Bypass 0.4%
• CVE-2026-92597 Medium 6.5 Nodemailer before 9.1.0 Email Domain Validation Bypass via RFC 5322 Comment 0.4%
• CVE-2026-92596 High 7.5 Nodemailer before 9.1.0 Denial of Service via addressparser 0.8%
• CVE-2026-92595 Medium 5.9 Nodemailer before 9.1.1 Security Sandbox Bypass via resolveContent 0.3%
• CVE-2026-90776 High 7.5 Nodemailer 9.1.0 through 10.0.4 Denial of Service via Quadratic Address Parsing 0.7%
• CVE-2026-82854 Critical 9.8 Nodemailer before 8.0.4 SMTP Command Injection via envelope.size 2.0%
• CVE-2026-82853 Medium 4.9 Nodemailer before 8.0.5 SMTP Command Injection via CRLF 1.0%
• CVE-2026-82662 Medium 6.5 Nodemailer before 8.0.8 TLS Certificate Validation Bypass 0.2%
• CVE-2026-82661 Medium 5.4 Nodemailer CRLF Injection via List-* Header Comments 0.3%
• CVE-2026-82660 Medium 5.4 Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess 0.3%
• CVE-2026-82659 High 7.1 nodemailer before 9.0.1 File Read and SSRF via raw option 0.3%
• CVE-2024-58379 Medium 5.3 nodemailer before 6.9.9 ReDoS via attachDataUrls parameter 0.4%
• CVE-2025-14874 High 7.5 Nodemailer: nodemailer: denial of service via crafted email address header 0.6%
• CVE-2025-13033 High 7.5 Nodemailer: nodemailer: email to an unintended domain can occur due to interpretation conflict 0.6%