Is nodemailer 10.1 vulnerable?

npm · 8 releases from 10.1.0 to 10.1.7 · latest nodemailer is 10.3.1 · checked 1 Nov 2026

No known advisories in the last release

nodemailer 10.1.7, the last 10.1 release, has no known advisories. 3 advisories affect earlier 10.1.x releases, so update to 10.1.7.

Update within 10.1:npm install nodemailer@10.1.7

Is your project affected?

Private repo? Upload its lockfile instead, or connect GitHub to check every repo.

Fixed within 10.1.x, affecting earlier releases

  • MediumGHSA-8c8m-p3m8-cjg823 Oct 2026

    Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient

    Affected
    >=3.0.0 <10.1.4
    Fixed in
    10.1.4
  • MediumGHSA-m943-m63m-w62w23 Oct 2026

    Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient

    Affected
    >=3.0.0 <10.1.4
    Fixed in
    10.1.4
  • MediumGHSA-85x2-q946-cp5h23 Oct 2026

    Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name

    Affected
    >=3.0.0 <10.1.4
    Fixed in
    10.1.4

Which of your client projects are still on nodemailer 10.1?

NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact nodemailer version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other nodemailer versions

Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.