ROOT-APP-NPM-GHSA-V53P-9FQP-M79J GHSA-v53p-9fqp-m79j in nodemailer - Patched by Root

Root has patched GHSA-v53p-9fqp-m79j in the nodemailer package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-H3HJ-CMCX-XC66 GHSA-h3hj-cmcx-xc66 in nodemailer - Patched by Root

Root has patched GHSA-h3hj-cmcx-xc66 in the nodemailer package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-82659 CVE-2026-82659 in nodemailer - Patched by Root

Root has patched CVE-2026-82659 in the nodemailer package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-2X7J-588G-CCC2 GHSA-2x7j-588g-ccc2 in nodemailer - Patched by Root

Root has patched GHSA-2x7j-588g-ccc2 in the nodemailer package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-AIKIDO-2026-289675 AIKIDO-2026-289675 in nodemailer - Patched by Root

Root has patched AIKIDO-2026-289675 in the nodemailer package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-R7G4-QG5F-QQM2 GHSA-r7g4-qg5f-qqm2 in nodemailer - Patched by Root

Root has patched GHSA-r7g4-qg5f-qqm2 in the nodemailer package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-P6GQ-J5CR-W38F GHSA-p6gq-j5cr-w38f in nodemailer - Patched by Root

Root has patched GHSA-p6gq-j5cr-w38f in the nodemailer package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-268H-HP4C-CRQ3 GHSA-268h-hp4c-crq3 in nodemailer - Patched by Root

Root has patched GHSA-268h-hp4c-crq3 in the nodemailer package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-WQVQ-JVPQ-H66F GHSA-wqvq-jvpq-h66f in nodemailer - Patched by Root

Root has patched GHSA-wqvq-jvpq-h66f in the nodemailer package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2025-14874 CVE-2025-14874 in nodemailer - Patched by Root

Root has patched CVE-2025-14874 in the nodemailer package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-VVJJ-XCJG-GR5G GHSA-vvjj-xcjg-gr5g in nodemailer - Patched by Root

Root has patched GHSA-vvjj-xcjg-gr5g in the nodemailer package for Root:npm. Multiple fixed versions available...

CLSA-2026-1791028046 TuxCare security update for nodemailer (1 CVE)

TuxCare rebuilt nodemailer to address 1 CVE. Fixed in 2.7.2-tuxcare.9...

CLSA-2026-1790876521 TuxCare security update for nodemailer (2 CVEs)

TuxCare rebuilt nodemailer to address 2 CVEs. Fixed in 2.7.2-tuxcare.8...

CLSA-2026-1790863073 TuxCare security update for nodemailer (2 CVEs)

TuxCare rebuilt nodemailer to address 2 CVEs. Fixed in 9.1.0-tuxcare.5...

CLSA-2026-1790854662 TuxCare security update for nodemailer (4 CVEs)

TuxCare rebuilt nodemailer to address 4 CVEs. Fixed in 9.1.0-tuxcare.4...

@1amsheldon/mail-mcp (>=1.5.0, <=2.0.1), @27works/posto (>=1.0.0, <=2.0.2) +893 more potentially affected by CVE-2026-90776 via nodemailer (>=9.1.0, <=10.0.3)

nodemailer NPM version =9.1.0, =1.5.0, =1.0.0, =1.6.3, =0.3.64, =0.1.0, =1.0.2, =0.1.0, =0.2.2, =2.0.2, =2.0.0, =0.2.2-rc.0, =1.0.5, =1.0.6 and more Source cves: CVE-2026-90776 Source advisory: OSV:GHSA-PRGH-XP8R-P3M5...

NPM: Nodemailer addressparser: O(n^2) on comment-joined addresses enables a remote DoS (reachable via mailparser)

NPM: Nodemailer addressparser: On^2 on comment-joined addresses enables a remote DoS reachable via mailparser vulnerability discovered by ? in WordPress Npm nodemailer versions = 9.1.0, = 10.0.4...

GHSA-PRGH-XP8R-P3M5 Nodemailer addressparser: O(n^2) on comment-joined addresses enables a remote DoS (reachable via mailparser)

Summary nodemailer/lib/addressparser parses one shape of address in On^2 time. A single 640 KB address value blocks the Node.js event loop for roughly 7 seconds. And it is reachable without auth: mailparser feeds inbound email headers straight into this parser, so one crafted email is enough to...

Nodemailer addressparser: O(n^2) on comment-joined addresses enables a remote DoS (reachable via mailparser)

Summary nodemailer/lib/addressparser parses one shape of address in On^2 time. A single 640 KB address value blocks the Node.js event loop for roughly 7 seconds. And it is reachable without auth: mailparser feeds inbound email headers straight into this parser, so one crafted email is enough to...

Internationalized Domain Name Validation

Nodemailer is vulnerable to an internationalized domain name validation/bypass. The vulnerability is due to inconsistent Punycode A-label generation, which allows an attacker to craft recipient addresses containing invisible characters or compatibility mappings to bypass domain allow-list checks...