598 matches found
EUVD-2026-101753
Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322 comments inside angle-bracket addresses. Attackers can supply recipients like a display name with a parenthesized comment in the domain, so illegal character...
EUVD-2026-101754
Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that allows users to exhaust CPU through quadratic header unfolding. Attackers can supply large recipient lists or long headers that fold into tens of thousands of continuation lines,...
EUVD-2026-101752
Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection.actionEHLO, whose four AUTH mechanism detection regexes contain overlapping whitespace sub-patterns that backtrack quadratically. A malicious or man-in-the-middle SMTP server can reply to EHLO with...
EUVD-2026-101755
Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP client reply parser in SMTPConnection.onData and isPartialResponse. A malicious SMTP server or on-path attacker can stream continuation lines without a completion line before...
CVE-2026-110872
A flaw was found in nodemailer. A malicious Simple Mail Transfer Protocol SMTP server or an on-path network attacker can trigger a Denial of Service DoS by streaming response continuation lines without sending a completion line. Due to inefficient reply parsing, this behavior causes excessive...
CVE-2026-110869
A flaw was found in nodemailer. A malicious or man-in-the-middle Simple Mail Transfer Protocol SMTP server can cause a Denial of Service DoS by sending a crafted handshake response with repeated whitespace sequences during authentication mechanism detection. Inefficient regular expression...
CVE-2026-110870
Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322 comments inside angle-bracket addresses. Attackers can supply recipients like a display name with a parenthesized comment in the domain, so illegal character...
CVE-2026-110870
A flaw was found in Nodemailer. A remote attacker can bypass domain allow-lists or cause email delivery failures by submitting specially crafted recipient addresses. Because the address parser fails to properly strip parenthesized comments within formatted email addresses, unvalidated characters...
CVE-2026-110871
A flaw was found in nodemailer. A remote attacker can trigger a Denial of Service DoS by submitting emails containing excessively long headers or large recipient lists that fold into numerous continuation lines. Inefficient header parsing in the message parser component leads to excessive CPU...
CVE-2026-110872
The Nodemailer library (versions 3.0.0 before 10.0.10) contains a quadratic complexity denial of service vulnerability within the SMTP client reply parser, specifically affecting SMTPConnection._onData and isPartialResponse. A malicious SMTP server or an on-path attacker can trigger this by strea...
CVE-2026-110871
The Nodemailer library (versions 3.0.0 to before 10.0.10 ) is vulnerable to a Denial of Service attack via the MessageParser.parseHeaders function. The root cause is quadratic header unfolding , where attackers provide long headers or large recipient lists that expand into tens of thousands of co...
CVE-2026-110870 Nodemailer before 10.0.13 Improper Input Validation via Angle-Bracket Address Comments
Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322 comments inside angle-bracket addresses. Attackers can supply recipients like a display name with a parenthesized comment in the domain, so illegal character...
CVE-2026-110870
The Nodemailer library (versions 3.0.0 to before 10.0.13 ) is vulnerable to an improper input validation flaw in its address parser. The vulnerability stems from a failure to strip RFC 5322 comments found inside angle-bracket addresses. An attacker can provide a recipient containing a display nam...
CVE-2026-110869
The Nodemailer library (versions 3.0.0 before 10.0.13 ) is vulnerable to a Regular Expression Denial of Service (ReDoS) in the SMTPConnection._actionEHLO function. The issue stems from four AUTH mechanism detection regexes containing overlapping whitespace sub-patterns that lead to quadratic back...
ROOT-APP-NPM-AIKIDO-2026-645479 AIKIDO-2026-645479 in nodemailer - Patched by Root
Root has patched AIKIDO-2026-645479 in the nodemailer package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-GHSA-46J5-6FG5-4GV3 GHSA-46j5-6fg5-4gv3 in nodemailer - Patched by Root
Root has patched GHSA-46j5-6fg5-4gv3 in the nodemailer package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-82659 CVE-2026-82659 in nodemailer - Patched by Root
Root has patched CVE-2026-82659 in the nodemailer package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-GHSA-R7G4-QG5F-QQM2 GHSA-r7g4-qg5f-qqm2 in nodemailer - Patched by Root
Root has patched GHSA-r7g4-qg5f-qqm2 in the nodemailer package for Root:npm. Multiple fixed versions available...