Is nodemailer 9.0 vulnerable?
npm · 7 releases from 9.0.0 to 9.0.6 · latest nodemailer is 10.3.1 · checked 1 Nov 2026
Yes: 14 known advisories
Yes. nodemailer 9.0.6, the last 9.0 release, is affected by 14 known security advisories (2 high, 12 medium), including CVE-2026-100700, CVE-2026-92596, CVE-2026-110869. 1 more affects earlier 9.0.x releases. Upgrade to 10.1.4 or later to fix all of them.
npm install nodemailer@10.1.4Advisories affecting nodemailer 9.0.6
Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service
- Affected
- >=3.0.0 <10.0.13
- Fixed in
- 10.0.13
Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped
- Affected
- >=3.0.0 <10.0.13
- Fixed in
- 10.0.13
Nodemailer: Quadratic (O(n^2)) SMTP client reply parsing lets a malicious server or MITM cause a pre-auth remote denial of service
- Affected
- >=3.0.0 <10.0.10
- Fixed in
- 10.0.10
Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient
- Affected
- >=3.0.0 <10.1.4
- Fixed in
- 10.1.4
Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient
- Affected
- >=3.0.0 <10.1.4
- Fixed in
- 10.1.4
Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name
- Affected
- >=3.0.0 <10.1.4
- Fixed in
- 10.1.4
Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signing
- Affected
- >=3.0.0 <10.0.10
- Fixed in
- 10.0.10
Nodemailer: Quadratic backtracking in the addressparser free-text fallback allows remote denial of service
- Affected
- <10.0.6
- Fixed in
- 10.0.6
Nodemailer: Nested structured recipient arrays bypass the parser depth limit and cause stack exhaustion DoS
- Affected
- <10.0.2
- Fixed in
- 10.0.2
Nodemailer: Process-global DNS cache reuses TLS `servername` across transports, enabling cross-tenant SMTP credential disclosure
- Affected
- >=5.0.0 <10.0.2
- Fixed in
- 10.0.2
Nodemailer: IDN/Punycode domain allow-list bypass leads to email delivery to an attacker-controlled domain
- Affected
- <9.1.0
- Fixed in
- 9.1.0
Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address list
- Affected
- <9.1.0
- Fixed in
- 9.1.0
Nodemailer: Recipient-domain validation bypass via RFC 5322 comment mis-parsing leads to email delivery to an attacker-controlled domain
- Affected
- >=6.9.16 <9.1.0
- Fixed in
- 9.1.0
Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disableUrlAccess when called with the legacy signature
- Affected
- <9.1.1
- Fixed in
- 9.1.1
Fixed within 9.0.x, affecting earlier releases
Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered message
- Affected
- <9.0.1
- Fixed in
- 9.0.1
Which of your client projects are still on nodemailer 9.0?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact nodemailer version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other nodemailer versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.