[ Vendor · 9 CVEs ]
nodemailer
CVEs affecting nodemailer published in the last 30 days, plus any nodemailer CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-110872 | 14 Oct 2026 | CVSS 5.9 | nodemailerNodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP client reply parser in… | |
| CVE-2026-110869 | 14 Oct 2026 | CVSS 7.5 | nodemailerNodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection._actionEHLO, whose four AUTH mechanism detection regexes… | |
| CVE-2026-110870 | 14 Oct 2026 | CVSS 5.3 | nodemailerNodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322 comments… | |
| CVE-2026-110871 | 14 Oct 2026 | CVSS 6.5 | Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signingNodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that allows users to exhaust CPU… | Fix |
| CVE-2026-100700 | 26 Sep 2026 | CVSS 7.5 | nodemailernodemailer before 10.0.6 contains a denial of service vulnerability in the addressparser free-text fallback regex pattern that exhibits quadratic… | |
| CVE-2026-100701 | 26 Sep 2026 | CVSS 5.9 | nodemailerNodemailer versions 5.0.0 through 10.0.1 use a process-global DNS cache that is keyed only by the DNS host, while each cache entry also stores the… | |
| CVE-2026-100702 | 26 Sep 2026 | CVSS 5.9 | nodemailerNodemailer before 10.0.2 fails to properly flatten deeply nested arrays in recipient fields such as to, cc, and bcc, allowing attackers to cause… | |
| CVE-2026-100699 | 26 Sep 2026 | CVSS 5.3 | nodemailerNodemailer is a Node.js email-sending library. In versions >= 9.1.0 and < 10.0.9, the address parser (src/addressparser) mishandles addresses whose… | |
| CVE-2026-90776 | 13 Sep 2026 | CVSS 7.5 | Nodemailer addressparser: O(n^2) on comment-joined addresses enables a remote DoS (reachable via mailparser)Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability in the addressparser component when parsing email… | Fix |