nodemailer vulnerabilities
Easy as cake e-mail sending from your Node.js applications
- Registry
- npm
- Latest
- 10.2.1
- License
- MIT-0
21 known advisories
The latest version, 10.2.1, is not affected by any of them. Projects on older versions may be.
npm install nodemailer@10.2.1Security advisories for nodemailer
Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signing
- Affected
- >=3.0.0 <10.0.10
- Fixed in
- 10.0.10
Nodemailer addressparser: O(n^2) on comment-joined addresses enables a remote DoS (reachable via mailparser)
- Affected
- >=9.1.0 <10.0.5
- Fixed in
- 10.0.5
Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing
- Affected
- >=9.1.0 <10.0.9
- Fixed in
- 10.0.9
Nodemailer: Quadratic backtracking in the addressparser free-text fallback allows remote denial of service
- Affected
- <10.0.6
- Fixed in
- 10.0.6
Nodemailer: Nested structured recipient arrays bypass the parser depth limit and cause stack exhaustion DoS
- Affected
- <10.0.2
- Fixed in
- 10.0.2
Nodemailer: Process-global DNS cache reuses TLS `servername` across transports, enabling cross-tenant SMTP credential disclosure
- Affected
- >=5.0.0 <10.0.2
- Fixed in
- 10.0.2
Nodemailer: IDN/Punycode domain allow-list bypass leads to email delivery to an attacker-controlled domain
- Affected
- <9.1.0
- Fixed in
- 9.1.0
Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address list
- Affected
- <9.1.0
- Fixed in
- 9.1.0
Nodemailer: Recipient-domain validation bypass via RFC 5322 comment mis-parsing leads to email delivery to an attacker-controlled domain
- Affected
- >=6.9.16 <9.1.0
- Fixed in
- 9.1.0
Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disableUrlAccess when called with the legacy signature
- Affected
- <9.1.1
- Fixed in
- 9.1.1
Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered message
- Affected
- <9.0.1
- Fixed in
- 9.0.1
Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message header injection
- Affected
- <8.0.9
- Fixed in
- 8.0.9
Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess during message normalization
- Affected
- <8.0.9
- Fixed in
- 8.0.9
Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interception
- Affected
- <8.0.8
- Fixed in
- 8.0.8
Nodemailer Vulnerable to SMTP Command Injection via CRLF in Transport name Option (EHLO/HELO)
- Affected
- <8.0.5
- Fixed in
- 8.0.5
Nodemailer has SMTP command injection due to unsanitized `envelope.size` parameter
- Affected
- <8.0.4
- Fixed in
- 8.0.4
Nodemailer’s addressparser is vulnerable to DoS caused by recursive calls
- Affected
- >=3.0.0 <7.0.11
- Fixed in
- 7.0.11
Nodemailer: Email to an unintended domain can occur due to Interpretation Conflict
- Affected
- <7.0.7
- Fixed in
- 7.0.7
nodemailer ReDoS when trying to send a specially crafted email
- Affected
- <6.9.9
- Fixed in
- 6.9.9
Header injection in nodemailer
- Affected
- <6.6.1
- Fixed in
- 6.6.1
Command injection in nodemailer
- Affected
- <6.4.16
- Fixed in
- 6.4.16
Which of your client projects still run an old nodemailer?
NPMscan reads the package-lock.json, yarn.lock and pnpm-lock.yaml in every GitHub repo you pick and checks each installed version against these advisories, including the packages your packages pull in. Each finding comes with the command that fixes it.
Other npm packages
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily. Package details from the npm registry.