739 matches found
GHSA-8C8M-P3M8-CJG8 Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient
Vulnerability summary RFC 5322 comments nest. addressparser ended a comment at the first , including the one that closes a nested comment, and parsed the rest of the outer comment as header text. Victim xy names [email protected] with xy as a comment, and Nodemailer read it as the address [email protected]...
Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient
Vulnerability summary RFC 5322 comments nest. addressparser ended a comment at the first , including the one that closes a nested comment, and parsed the rest of the outer comment as header text. Victim xy names [email protected] with xy as a comment, and Nodemailer read it as the address [email protected]...
GHSA-M943-M63M-W62W Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient
Vulnerability summary addressparser ends an RFC 5322 group at the first ;, including one inside a quoted display name or a comment. The text after it is parsed again as top level recipients with the quoting flipped, so text that every conformant parser reads as a display name or comment becomes a...
Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient
Vulnerability summary addressparser ends an RFC 5322 group at the first ;, including one inside a quoted display name or a comment. The text after it is parsed again as top level recipients with the quoting flipped, so text that every conformant parser reads as a display name or comment becomes a...
GHSA-85X2-Q946-CP5H Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name
Vulnerability summary addressparser ends an angle-addr at the first it sees, including one inside a quoted local part, a comment or a domain literal. The domain is then read off the text in front of that . "@good.com is the mailbox "[email protected]"@good.com under RFC 5322, and Nodemailer read it as a...
Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name
Vulnerability summary addressparser ends an angle-addr at the first it sees, including one inside a quoted local part, a comment or a domain literal. The domain is then read off the text in front of that . "@good.com is the mailbox "[email protected]"@good.com under RFC 5322, and Nodemailer read it as a...
EUVD-2026-101754
Nodemailer: Quadratic On^2 DKIM header unfolding lets a large folded header cause remote denial of service during signing...
Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signing
Summary When nodemailer DKIM-signs an outbound message, its DKIM message parser unfolds RFC 5322 header continuation lines with a loop that concatenates each continuation line onto the preceding line and then re-tests the anchored regex /^ \t/ against the growing merged line on every iteration...
npm: Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signing
npm: Nodemailer: Quadratic On^2 DKIM header unfolding lets a large folded header cause remote denial of service during signing vulnerability discovered by ? in WordPress npm nodemailer versions = 3.0.0, = 10.0.9...
CVE-2026-92595
Nodemailer npm package nodemailer versions 9.1.0 and earlier do no...
CVE-2026-92598
Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encod...
CVE-2026-92597
Nodemailer versions = 6.9.16 and 9.1.0 mis-parse RFC 5322 comments...
CVE-2026-92596
Nodemailer before 9.1.0 contains a quadratic time complexity vulnerabi...
CLSA-2026-1792575070 TuxCare security update for nodemailer (1 CVE)
TuxCare rebuilt nodemailer to address 1 CVE. Fixed in 6.10.1-tuxcare.14...
CLSA-2026-1792524218 TuxCare security update for nodemailer (1 CVE)
TuxCare rebuilt nodemailer to address 1 CVE. Fixed in 9.0.0-tuxcare.5...
CLSA-2026-1792518061 TuxCare security update for nodemailer (1 CVE)
TuxCare rebuilt nodemailer to address 1 CVE. Fixed in 9.0.1-tuxcare.4...
CLSA-2026-1792509085 TuxCare security update for nodemailer (1 CVE)
TuxCare rebuilt nodemailer to address 1 CVE. Fixed in 9.0.2-tuxcare.5...
CLSA-2026-1792505981 TuxCare security update for nodemailer (1 CVE)
TuxCare rebuilt nodemailer to address 1 CVE. Fixed in 9.0.3-tuxcare.5...