Is nodemailer 6.10 vulnerable?
npm · 2 releases from 6.10.0 to 6.10.1 · latest nodemailer is 10.3.1 · checked 1 Nov 2026
Yes: 22 known advisories
Yes. nodemailer 6.10.1, the last 6.10 release, is affected by 22 known security advisories (5 high, 16 medium, 1 low), including CVE-2026-100700, CVE-2026-92596, CVE-2026-82659. Upgrade to 10.1.4 or later to fix all of them.
npm install nodemailer@10.1.4Advisories affecting nodemailer 6.10.1
Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service
- Affected
- >=3.0.0 <10.0.13
- Fixed in
- 10.0.13
Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped
- Affected
- >=3.0.0 <10.0.13
- Fixed in
- 10.0.13
Nodemailer: Quadratic (O(n^2)) SMTP client reply parsing lets a malicious server or MITM cause a pre-auth remote denial of service
- Affected
- >=3.0.0 <10.0.10
- Fixed in
- 10.0.10
Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient
- Affected
- >=3.0.0 <10.1.4
- Fixed in
- 10.1.4
Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient
- Affected
- >=3.0.0 <10.1.4
- Fixed in
- 10.1.4
Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name
- Affected
- >=3.0.0 <10.1.4
- Fixed in
- 10.1.4
Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signing
- Affected
- >=3.0.0 <10.0.10
- Fixed in
- 10.0.10
Nodemailer: Quadratic backtracking in the addressparser free-text fallback allows remote denial of service
- Affected
- <10.0.6
- Fixed in
- 10.0.6
Nodemailer: Nested structured recipient arrays bypass the parser depth limit and cause stack exhaustion DoS
- Affected
- <10.0.2
- Fixed in
- 10.0.2
Nodemailer: Process-global DNS cache reuses TLS `servername` across transports, enabling cross-tenant SMTP credential disclosure
- Affected
- >=5.0.0 <10.0.2
- Fixed in
- 10.0.2
Nodemailer: IDN/Punycode domain allow-list bypass leads to email delivery to an attacker-controlled domain
- Affected
- <9.1.0
- Fixed in
- 9.1.0
Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address list
- Affected
- <9.1.0
- Fixed in
- 9.1.0
Nodemailer: Recipient-domain validation bypass via RFC 5322 comment mis-parsing leads to email delivery to an attacker-controlled domain
- Affected
- >=6.9.16 <9.1.0
- Fixed in
- 9.1.0
Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disableUrlAccess when called with the legacy signature
- Affected
- <9.1.1
- Fixed in
- 9.1.1
Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered message
- Affected
- <9.0.1
- Fixed in
- 9.0.1
Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message header injection
- Affected
- <8.0.9
- Fixed in
- 8.0.9
Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess during message normalization
- Affected
- <8.0.9
- Fixed in
- 8.0.9
Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interception
- Affected
- <8.0.8
- Fixed in
- 8.0.8
Nodemailer Vulnerable to SMTP Command Injection via CRLF in Transport name Option (EHLO/HELO)
- Affected
- <8.0.5
- Fixed in
- 8.0.5
Nodemailer has SMTP command injection due to unsanitized `envelope.size` parameter
- Affected
- <8.0.4
- Fixed in
- 8.0.4
Nodemailer’s addressparser is vulnerable to DoS caused by recursive calls
- Affected
- >=3.0.0 <7.0.11
- Fixed in
- 7.0.11
Nodemailer: Email to an unintended domain can occur due to Interpretation Conflict
- Affected
- <7.0.7
- Fixed in
- 7.0.7
Which of your client projects are still on nodemailer 6.10?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact nodemailer version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other nodemailer versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.