{
  "@id": "urn:uuid:98f54bdb-436d-4c2a-b610-d6b5a026a7bc",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 21,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T15:31:34.996699+00:00",
  "statements": [
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@0.7.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@0.7.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2020-7769 is fixed in version 0.7.1-tuxcare.2 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2020-7769"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@0.7.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@0.7.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-23400 does not affect version 0.7.1-tuxcare.2 of nodemailer. not_affected \u2014 Version 0.7.1 is not affected by CVE-2021-23400. The vulnerability exists in nodemailer's internal address formatting code (lib/mime-node/index.js _normalizeAddress method) introduced in later versions (4.x+) when mailcomposer was internalized. Version 0.7.1 uses external mailcomposer package (~0.2.10) for all address formatting and does not contain the vulnerable code pattern in its own codebase.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-23400"
      },
      "impact_statement": "not_affected \u2014 Version 0.7.1 is not affected by CVE-2021-23400. The vulnerability exists in nodemailer's internal address formatting code (lib/mime-node/index.js _normalizeAddress method) introduced in later versions (4.x+) when mailcomposer was internalized. Version 0.7.1 uses external mailcomposer package (~0.2.10) for all address formatting and does not contain the vulnerable code pattern in its own codebase."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@0.7.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@0.7.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-58379 is fixed in version 0.7.1-tuxcare.2 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2024-58379"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@0.7.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@0.7.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-13033 does not affect version 0.7.1-tuxcare.2 of nodemailer. not_affected \u2014 Version 0.7.1 does not contain the vulnerable addressparser module. The addressparser was introduced in nodemailer v3.0.0 (January 2017), years after version 0.7.1. The vulnerability pattern (email address extraction from text tokens using regex) does not exist in 0.7.1's architecture.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-13033"
      },
      "impact_statement": "not_affected \u2014 Version 0.7.1 does not contain the vulnerable addressparser module. The addressparser was introduced in nodemailer v3.0.0 (January 2017), years after version 0.7.1. The vulnerability pattern (email address extraction from text tokens using regex) does not exist in 0.7.1's architecture."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@0.7.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@0.7.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-14874 does not affect version 0.7.1-tuxcare.2 of nodemailer. not_affected \u2014 Version 0.7.1 is not affected by CVE-2025-14874. The vulnerable lib/addressparser/index.js module with recursive group-flattening logic was introduced in v3.0.0 (2017-01-31), 2.5 years after v0.7.1 (2014-07-09). Version 0.7.1 uses a different architecture where address handling is delegated to the mailcomposer external dependency, and contains no recursive address parsing code.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-14874"
      },
      "impact_statement": "not_affected \u2014 Version 0.7.1 is not affected by CVE-2025-14874. The vulnerable lib/addressparser/index.js module with recursive group-flattening logic was introduced in v3.0.0 (2017-01-31), 2.5 years after v0.7.1 (2014-07-09). Version 0.7.1 uses a different architecture where address handling is delegated to the mailcomposer external dependency, and contains no recursive address parsing code."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@0.7.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@0.7.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2026-110871 affects version 0.7.1-tuxcare.2 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-110871"
      },
      "action_statement": "Vulnerability CVE-2026-110871 affects version 0.7.1-tuxcare.2 of nodemailer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@0.7.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@0.7.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-06T08:00:04.916776+00:00",
      "status_notes": "Vulnerability CVE-2026-121424 does not affect version 0.7.1-tuxcare.2 of nodemailer. not_affected \u2014 Target is nodemailer 0.7.1-tuxcare.5. The CVE concerns the addressparser module (introduced in 3.0.0), which does not exist in this version. The repo has no address-header parsing code. Address handling is delegated to the external mailcomposer/mimelib dependencies, which are not vendored and are outside the CVE scope. Same product lineage, so not a false_positive. No prior TuxCare fix commit e...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-121424"
      },
      "impact_statement": "not_affected \u2014 Target is nodemailer 0.7.1-tuxcare.5. The CVE concerns the addressparser module (introduced in 3.0.0), which does not exist in this version. The repo has no address-header parsing code. Address handling is delegated to the external mailcomposer/mimelib dependencies, which are not vendored and are outside the CVE scope. Same product lineage, so not a false_positive. No prior TuxCare fix commit e..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@0.7.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@0.7.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-06T08:01:03.240753+00:00",
      "status_notes": "Vulnerability CVE-2026-121425 does not affect version 0.7.1-tuxcare.2 of nodemailer. not_affected \u2014 The target is nodemailer 0.7.1-tuxcare.5. It has no addressparser module, which the CVE says exists in nodemailer 3.0.0 through 10.1.3. Its lib/ directory holds only the transports, helpers and wellknown files, and it hands address handling to the mailcomposer dependency (which uses mimelib). The vulnerable group-parsing code is not in this repository. The patch itself was not available, only i...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-121425"
      },
      "impact_statement": "not_affected \u2014 The target is nodemailer 0.7.1-tuxcare.5. It has no addressparser module, which the CVE says exists in nodemailer 3.0.0 through 10.1.3. Its lib/ directory holds only the transports, helpers and wellknown files, and it hands address handling to the mailcomposer dependency (which uses mimelib). The vulnerable group-parsing code is not in this repository. The patch itself was not available, only i..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@0.7.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@0.7.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-06T08:01:03.240753+00:00",
      "status_notes": "Vulnerability CVE-2026-121426 does not affect version 0.7.1-tuxcare.2 of nodemailer. not_affected \u2014 Target is nodemailer 0.7.1-tuxcare.5. The vulnerable component, nodemailer's own lib/addressparser, was introduced in 3.0.0 (CVE range 3.0.0 to before 10.1.4) and does not exist in this tree. The repo has no address parsing of its own. It passes the recipient strings straight to the mailcomposer dependency (not vendored here) and then reads the envelope back. The vulnerable code is therefore ab...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-121426"
      },
      "impact_statement": "not_affected \u2014 Target is nodemailer 0.7.1-tuxcare.5. The vulnerable component, nodemailer's own lib/addressparser, was introduced in 3.0.0 (CVE range 3.0.0 to before 10.1.4) and does not exist in this tree. The repo has no address parsing of its own. It passes the recipient strings straight to the mailcomposer dependency (not vendored here) and then reads the envelope back. The vulnerable code is therefore ab..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@0.7.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@0.7.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-10T15:31:34.996699+00:00",
      "status_notes": "Vulnerability CVE-2026-125755 does not affect version 0.7.1-tuxcare.2 of nodemailer. not_affected \u2014 Target is nodemailer 0.7.1-tuxcare.5. It has no addressparser module and no address-parsing code of its own. The CVE affects nodemailer 3.0.0 through 10.4.1 and the flaw sits in lib/addressparser. All address parsing in this version is delegated to the mailcomposer dependency (0.2.12-tuxcare.1), whose code is not in this repo.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-125755"
      },
      "impact_statement": "not_affected \u2014 Target is nodemailer 0.7.1-tuxcare.5. It has no addressparser module and no address-parsing code of its own. The CVE affects nodemailer 3.0.0 through 10.4.1 and the flaw sits in lib/addressparser. All address parsing in this version is delegated to the mailcomposer dependency (0.2.12-tuxcare.1), whose code is not in this repo."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@0.7.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@0.7.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-82659 does not affect version 0.7.1-tuxcare.2 of nodemailer. not_affected \u2014 The target repository (nodemailer v0.7.1-tuxcare.1) is NOT AFFECTED by CVE-2026-82659. This CVE describes a vulnerability in nodemailer v9.0.0's internal mail-composer component where the message-level `raw` option bypasses `disableFileAccess`/`disableUrlAccess` security flags. Version 0.7.1 has a fundamentally different architecture: it uses mailcomposer as an external npm dependency (~0.2.10)...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-82659"
      },
      "impact_statement": "not_affected \u2014 The target repository (nodemailer v0.7.1-tuxcare.1) is NOT AFFECTED by CVE-2026-82659. This CVE describes a vulnerability in nodemailer v9.0.0's internal mail-composer component where the message-level `raw` option bypasses `disableFileAccess`/`disableUrlAccess` security flags. Version 0.7.1 has a fundamentally different architecture: it uses mailcomposer as an external npm dependency (~0.2.10)..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@0.7.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@0.7.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-82660 is fixed in version 0.7.1-tuxcare.2 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-82660"
      }
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@0.7.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@0.7.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-82661 is fixed in version 0.7.1-tuxcare.2 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-82661"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@0.7.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@0.7.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-82662 affects version 0.7.1-tuxcare.2 of nodemailer, and is fixed in 0.7.1-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-82662"
      },
      "action_statement": "Vulnerability CVE-2026-82662 affects version 0.7.1-tuxcare.2 of nodemailer, and is fixed in 0.7.1-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@0.7.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@0.7.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-82853 affects version 0.7.1-tuxcare.2 of nodemailer, and is fixed in 0.7.1-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-82853"
      },
      "action_statement": "Vulnerability CVE-2026-82853 affects version 0.7.1-tuxcare.2 of nodemailer, and is fixed in 0.7.1-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@0.7.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@0.7.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-82854 affects version 0.7.1-tuxcare.2 of nodemailer, and is fixed in 0.7.1-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-82854"
      },
      "action_statement": "Vulnerability CVE-2026-82854 affects version 0.7.1-tuxcare.2 of nodemailer, and is fixed in 0.7.1-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@0.7.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@0.7.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2026-90776 affects version 0.7.1-tuxcare.2 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-90776"
      },
      "action_statement": "Vulnerability CVE-2026-90776 affects version 0.7.1-tuxcare.2 of nodemailer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@0.7.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@0.7.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-268h-hp4c-crq3 does not affect version 0.7.1-tuxcare.2 of nodemailer. not_affected \u2014 Version 0.7.1 does not contain the List-* header functionality that is vulnerable to CRLF injection. The entire `list` message option and associated header generation code does not exist in this architecture.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-268h-hp4c-crq3"
      },
      "impact_statement": "not_affected \u2014 Version 0.7.1 does not contain the List-* header functionality that is vulnerable to CRLF injection. The entire `list` message option and associated header generation code does not exist in this architecture."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@0.7.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@0.7.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-2x7j-588g-ccc2 does not affect version 0.7.1-tuxcare.2 of nodemailer. not_affected \u2014 Nodemailer 0.7.1 is not affected by GHSA-2x7j-588g-ccc2. The vulnerable code (lib/addressparser/ module with quadratic-time concat/splice/deduplication operations) was introduced in nodemailer 3.0.0 and does not exist in version 0.7.1. Version 0.7.1 uses a fundamentally different architecture that delegates all email address parsing and message composition to the external mailcomposer dependenc...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "GHSA-2x7j-588g-ccc2"
      },
      "impact_statement": "not_affected \u2014 Nodemailer 0.7.1 is not affected by GHSA-2x7j-588g-ccc2. The vulnerable code (lib/addressparser/ module with quadratic-time concat/splice/deduplication operations) was introduced in nodemailer 3.0.0 and does not exist in version 0.7.1. Version 0.7.1 uses a fundamentally different architecture that delegates all email address parsing and message composition to the external mailcomposer dependenc..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@0.7.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@0.7.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-20T12:46:51.138394+00:00",
      "status_notes": "Vulnerability GHSA-46j5-6fg5-4gv3 is a false positive for nodemailer 0.7.1-tuxcare.2.",
      "vulnerability": {
        "name": "GHSA-46j5-6fg5-4gv3"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@0.7.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@0.7.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:27:52.523797+00:00",
      "status_notes": "Vulnerability GHSA-4ffr-jq9g-5ffx does not affect version 0.7.1-tuxcare.2 of nodemailer. not_affected \u2014 Version 0.7.1 is not affected by GHSA-4ffr-jq9g-5ffx. The vulnerable code (SMTPConnection._actionEHLO with four backtracking AUTH regexes) was introduced when the SMTP client was bundled into nodemailer at version 3.0.0. Version 0.7.1 predates this by multiple major versions and delegates all SMTP handling to the external simplesmtp dependency. The vulnerable symbols (_actionEHLO, _supportedAut...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-4ffr-jq9g-5ffx"
      },
      "impact_statement": "not_affected \u2014 Version 0.7.1 is not affected by GHSA-4ffr-jq9g-5ffx. The vulnerable code (SMTPConnection._actionEHLO with four backtracking AUTH regexes) was introduced when the SMTP client was bundled into nodemailer at version 3.0.0. Version 0.7.1 predates this by multiple major versions and delegates all SMTP handling to the external simplesmtp dependency. The vulnerable symbols (_actionEHLO, _supportedAut..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@0.7.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@0.7.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:28:05.767443+00:00",
      "status_notes": "Vulnerability GHSA-4g23-2xm8-66gc does not affect version 0.7.1-tuxcare.2 of nodemailer. not_affected \u2014 Version 0.7.1 uses a completely different architecture from the vulnerable v10.x. The vulnerable code module `src/smtp-connection/index.ts` (containing the O(n\u00b2) SMTP response parsing functions `isPartialResponse` and `_onData`) does not exist in v0.7.1. This version delegates all SMTP connection and protocol handling to the external `simplesmtp` dependency, with no SMTP response parsing code i...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-4g23-2xm8-66gc"
      },
      "impact_statement": "not_affected \u2014 Version 0.7.1 uses a completely different architecture from the vulnerable v10.x. The vulnerable code module `src/smtp-connection/index.ts` (containing the O(n\u00b2) SMTP response parsing functions `isPartialResponse` and `_onData`) does not exist in v0.7.1. This version delegates all SMTP connection and protocol handling to the external `simplesmtp` dependency, with no SMTP response parsing code i..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@0.7.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@0.7.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:22:22.486046+00:00",
      "status_notes": "Vulnerability GHSA-6vj9-mwq6-2f5v does not affect version 0.7.1-tuxcare.2 of nodemailer. not_affected \u2014 Version 0.7.1 is not affected by GHSA-6vj9-mwq6-2f5v. The vulnerability was introduced in commit 6859b5dd on 2018-12-28 and first released in v5.0.0. Version 0.7.1 predates this introduction by approximately 6 years and uses a completely different architecture without the vulnerable DNS cache mechanism that stores servername. The target version delegates SMTP connection handling to the external...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-6vj9-mwq6-2f5v"
      },
      "impact_statement": "not_affected \u2014 Version 0.7.1 is not affected by GHSA-6vj9-mwq6-2f5v. The vulnerability was introduced in commit 6859b5dd on 2018-12-28 and first released in v5.0.0. Version 0.7.1 predates this introduction by approximately 6 years and uses a completely different architecture without the vulnerable DNS cache mechanism that stores servername. The target version delegates SMTP connection handling to the external..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@0.7.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@0.7.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:09:06.581572+00:00",
      "status_notes": "Vulnerability GHSA-85x2-q946-cp5h does not affect version 0.7.1-tuxcare.2 of nodemailer. not_affected \u2014 Nodemailer v0.7.1 is not affected by GHSA-85x2-q946-cp5h. The vulnerable addressparser module was introduced in nodemailer v3.0.0 (January 2017), several years after this version. Version 0.7.1 does not contain the addressparser component, has no local email address parsing/tokenization logic, and delegates email composition to external dependencies. This is a Rule 5 Type A1 case: the vulnerabl...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-85x2-q946-cp5h"
      },
      "impact_statement": "not_affected \u2014 Nodemailer v0.7.1 is not affected by GHSA-85x2-q946-cp5h. The vulnerable addressparser module was introduced in nodemailer v3.0.0 (January 2017), several years after this version. Version 0.7.1 does not contain the addressparser component, has no local email address parsing/tokenization logic, and delegates email composition to external dependencies. This is a Rule 5 Type A1 case: the vulnerabl..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@0.7.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@0.7.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:13:44.782673+00:00",
      "status_notes": "Vulnerability GHSA-8c8m-p3m8-cjg8 does not affect version 0.7.1-tuxcare.2 of nodemailer. not_affected \u2014 Version 0.7.1 is not affected by GHSA-8c8m-p3m8-cjg8. The vulnerable addressparser module does not exist in this version - it was introduced in nodemailer 3.0.0. This version delegates address parsing to the mailcomposer dependency (which uses mimelib.parseAddresses), not nodemailer's own addressparser. The CVE explicitly states affected versions are 3.0.0 through 10.1.3, and TuxCare backported...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-8c8m-p3m8-cjg8"
      },
      "impact_statement": "not_affected \u2014 Version 0.7.1 is not affected by GHSA-8c8m-p3m8-cjg8. The vulnerable addressparser module does not exist in this version - it was introduced in nodemailer 3.0.0. This version delegates address parsing to the mailcomposer dependency (which uses mimelib.parseAddresses), not nodemailer's own addressparser. The CVE explicitly states affected versions are 3.0.0 through 10.1.3, and TuxCare backported..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@0.7.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@0.7.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-8m3c-c648-2xjj does not affect version 0.7.1-tuxcare.2 of nodemailer. not_affected \u2014 Version 0.7.1 is not affected by GHSA-8m3c-c648-2xjj. The vulnerability describes a bypass of Nodemailer's security sandbox options (disableFileAccess/disableUrlAccess) through a legacy resolveContent() API path. These security sandbox features were introduced in version 3.0.1, which postdates the target version 0.7.1 by multiple major versions. The target uses a completely different architectu...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-8m3c-c648-2xjj"
      },
      "impact_statement": "not_affected \u2014 Version 0.7.1 is not affected by GHSA-8m3c-c648-2xjj. The vulnerability describes a bypass of Nodemailer's security sandbox options (disableFileAccess/disableUrlAccess) through a legacy resolveContent() API path. These security sandbox features were introduced in version 3.0.1, which postdates the target version 0.7.1 by multiple major versions. The target uses a completely different architectu..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@0.7.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@0.7.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-29T20:02:53.345979+00:00",
      "status_notes": "Vulnerability GHSA-8vvx-rff5-p5rq does not affect version 0.7.1-tuxcare.2 of nodemailer. not_affected \u2014 Version 0.7.1 predates the vulnerable architecture by many years. The CVE's vulnerable code path (MimeNode._parseAddresses \u2192 addressparser \u2192 Tokenizer \u2192 Array.toString recursion) does not exist in this version. Address processing is delegated to external mailcomposer v0.2.10, a completely different architecture from the affected versions (which use mailcomposer 4.0.1+ or internal code starting ...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "GHSA-8vvx-rff5-p5rq"
      },
      "impact_statement": "not_affected \u2014 Version 0.7.1 predates the vulnerable architecture by many years. The CVE's vulnerable code path (MimeNode._parseAddresses \u2192 addressparser \u2192 Tokenizer \u2192 Array.toString recursion) does not exist in this version. Address processing is delegated to external mailcomposer v0.2.10, a completely different architecture from the affected versions (which use mailcomposer 4.0.1+ or internal code starting ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@0.7.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@0.7.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-9h6g-pr28-7cqp does not affect version 0.7.1-tuxcare.2 of nodemailer. not_affected \u2014 Nodemailer version 0.7.1 is not affected by GHSA-9h6g-pr28-7cqp. The ReDoS vulnerability exists in data URI parsing functionality that was not introduced until version 1.2.2. Version 0.7.1 does not contain any data URI processing code and therefore cannot be exploited via this attack vector.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-9h6g-pr28-7cqp"
      },
      "impact_statement": "not_affected \u2014 Nodemailer version 0.7.1 is not affected by GHSA-9h6g-pr28-7cqp. The ReDoS vulnerability exists in data URI parsing functionality that was not introduced until version 1.2.2. Version 0.7.1 does not contain any data URI processing code and therefore cannot be exploited via this attack vector."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@0.7.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@0.7.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-c7w3-x93f-qmm8 does not affect version 0.7.1-tuxcare.2 of nodemailer. not_affected \u2014 Nodemailer version 0.7.1 is not affected by GHSA-c7w3-x93f-qmm8. This version uses a fundamentally different architecture where all SMTP protocol handling and command construction is delegated to the external 'simplesmtp' npm package. The vulnerable code path (lib/smtp-connection/index.js with unsanitized envelope.size concatenation into MAIL FROM commands) does not exist in version 0.7.1 and w...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-c7w3-x93f-qmm8"
      },
      "impact_statement": "not_affected \u2014 Nodemailer version 0.7.1 is not affected by GHSA-c7w3-x93f-qmm8. This version uses a fundamentally different architecture where all SMTP protocol handling and command construction is delegated to the external 'simplesmtp' npm package. The vulnerable code path (lib/smtp-connection/index.js with unsanitized envelope.size concatenation into MAIL FROM commands) does not exist in version 0.7.1 and w..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@0.7.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@0.7.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:09:41.975072+00:00",
      "status_notes": "Vulnerability GHSA-cc9r-2j5m-2m83 does not affect version 0.7.1-tuxcare.2 of nodemailer. not_affected \u2014 Version 0.7.1 is not affected by GHSA-cc9r-2j5m-2m83. The vulnerable code (lib/addressparser/index.js) does not exist in this version - it was introduced in v3.0.0 (2017), approximately 4-5 years after v0.7.1 was released. Version 0.7.1 uses a completely different architecture, delegating all email address parsing to the external mailcomposer dependency (v0.2.10), with no address parsing logic ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-cc9r-2j5m-2m83"
      },
      "impact_statement": "not_affected \u2014 Version 0.7.1 is not affected by GHSA-cc9r-2j5m-2m83. The vulnerable code (lib/addressparser/index.js) does not exist in this version - it was introduced in v3.0.0 (2017), approximately 4-5 years after v0.7.1 was released. Version 0.7.1 uses a completely different architecture, delegating all email address parsing to the external mailcomposer dependency (v0.2.10), with no address parsing logic ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@0.7.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@0.7.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-20T12:46:51.138394+00:00",
      "status_notes": "Vulnerability GHSA-frj6-5rhh-vwfw is a false positive for nodemailer 0.7.1-tuxcare.2.",
      "vulnerability": {
        "name": "GHSA-frj6-5rhh-vwfw"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@0.7.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@0.7.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:10:09.687234+00:00",
      "status_notes": "Vulnerability GHSA-g57g-f23g-4646 does not affect version 0.7.1-tuxcare.2 of nodemailer. not_affected \u2014 Version 0.7.1 is NOT AFFECTED by GHSA-g57g-f23g-4646. The GitHub advisory explicitly limits the vulnerable version range to \">= 9.1.0, < 10.0.9\". Version 0.7.1 (released ~2013) predates the vulnerable code by 6+ years. The vulnerability exists in nodemailer's own address parser (src/addressparser/index.ts), which was introduced in v6.0.0 (2019) and refactored in the 2026 TypeScript migration. V...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-g57g-f23g-4646"
      },
      "impact_statement": "not_affected \u2014 Version 0.7.1 is NOT AFFECTED by GHSA-g57g-f23g-4646. The GitHub advisory explicitly limits the vulnerable version range to \">= 9.1.0, < 10.0.9\". Version 0.7.1 (released ~2013) predates the vulnerable code by 6+ years. The vulnerability exists in nodemailer's own address parser (src/addressparser/index.ts), which was introduced in v6.0.0 (2019) and refactored in the 2026 TypeScript migration. V..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@0.7.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@0.7.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:10:39.097044+00:00",
      "status_notes": "Vulnerability GHSA-g73g-hqqh-jr95 does not affect version 0.7.1-tuxcare.2 of nodemailer. not_affected \u2014 Version 0.7.1 is not affected by GHSA-g73g-hqqh-jr95. The vulnerability exists in nodemailer's own addressparser module (src/addressparser/index.ts) which was introduced in version 6.x+. Version 0.7.1 uses a completely different architecture: it delegates all address parsing to the external mailcomposer module (~0.2.10) which uses mimelib.parseAddresses. The vulnerable code path (the single-slo...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "GHSA-g73g-hqqh-jr95"
      },
      "impact_statement": "not_affected \u2014 Version 0.7.1 is not affected by GHSA-g73g-hqqh-jr95. The vulnerability exists in nodemailer's own addressparser module (src/addressparser/index.ts) which was introduced in version 6.x+. Version 0.7.1 uses a completely different architecture: it delegates all address parsing to the external mailcomposer module (~0.2.10) which uses mimelib.parseAddresses. The vulnerable code path (the single-slo..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@0.7.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@0.7.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-20T12:46:51.138394+00:00",
      "status_notes": "Vulnerability GHSA-h3hj-cmcx-xc66 is a false positive for nodemailer 0.7.1-tuxcare.2.",
      "vulnerability": {
        "name": "GHSA-h3hj-cmcx-xc66"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@0.7.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@0.7.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-20T12:46:51.138394+00:00",
      "status_notes": "Vulnerability GHSA-jj37-3377-m6vv is a false positive for nodemailer 0.7.1-tuxcare.2.",
      "vulnerability": {
        "name": "GHSA-jj37-3377-m6vv"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@0.7.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@0.7.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-11-03T17:07:24.314148+00:00",
      "status_notes": "Vulnerability GHSA-m943-m63m-w62w does not affect version 0.7.1-tuxcare.2 of nodemailer. not_affected \u2014 Nodemailer 0.7.1 is not affected by GHSA-m943-m63m-w62w. The vulnerability exists in the addressparser module introduced in nodemailer v3.0.0 (per CVE: \"Affected: 3.0.0 through 10.1.3\"). Version 0.7.1 predates this module by several years and uses a completely different architecture based on the mailcomposer dependency for address handling. The vulnerable addressparser tokenizer code (with inne...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-m943-m63m-w62w"
      },
      "impact_statement": "not_affected \u2014 Nodemailer 0.7.1 is not affected by GHSA-m943-m63m-w62w. The vulnerability exists in the addressparser module introduced in nodemailer v3.0.0 (per CVE: \"Affected: 3.0.0 through 10.1.3\"). Version 0.7.1 predates this module by several years and uses a completely different architecture based on the mailcomposer dependency for address handling. The vulnerable addressparser tokenizer code (with inne..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@0.7.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@0.7.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-p6gq-j5cr-w38f does not affect version 0.7.1-tuxcare.2 of nodemailer. not_affected \u2014 Version 0.7.1 of nodemailer is not affected by GHSA-p6gq-j5cr-w38f. The vulnerability concerns bypassing disableFileAccess/disableUrlAccess security flags when using the message-level 'raw' option, but version 0.7.1 has neither the 'raw' message option nor the security flags. The target uses a fundamentally different architecture (external mailcomposer package) that predates the security model ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-p6gq-j5cr-w38f"
      },
      "impact_statement": "not_affected \u2014 Version 0.7.1 of nodemailer is not affected by GHSA-p6gq-j5cr-w38f. The vulnerability concerns bypassing disableFileAccess/disableUrlAccess security flags when using the message-level 'raw' option, but version 0.7.1 has neither the 'raw' message option nor the security flags. The target uses a fundamentally different architecture (external mailcomposer package) that predates the security model ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@0.7.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@0.7.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-r7g4-qg5f-qqm2 does not affect version 0.7.1-tuxcare.2 of nodemailer. not_affected \u2014 Nodemailer version 0.7.1 is not affected by GHSA-r7g4-qg5f-qqm2. The vulnerability concerns nodemailer's internal HTTPS fetch client (lib/fetch/index.js) that disables TLS certificate verification (rejectUnauthorized: false) when making OAuth2 token requests. Version 0.7.1 does not contain this vulnerable code path - it lacks both lib/fetch/ and lib/xoauth2/ directories and delegates all OAuth2...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-r7g4-qg5f-qqm2"
      },
      "impact_statement": "not_affected \u2014 Nodemailer version 0.7.1 is not affected by GHSA-r7g4-qg5f-qqm2. The vulnerability concerns nodemailer's internal HTTPS fetch client (lib/fetch/index.js) that disables TLS certificate verification (rejectUnauthorized: false) when making OAuth2 token requests. Version 0.7.1 does not contain this vulnerable code path - it lacks both lib/fetch/ and lib/xoauth2/ directories and delegates all OAuth2..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@0.7.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@0.7.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-30T02:46:00.077375+00:00",
      "status_notes": "Vulnerability GHSA-v53p-9fqp-m79j does not affect version 0.7.1-tuxcare.2 of nodemailer. not_affected \u2014 Version 0.7.1 of nodemailer predates the introduction of the addressparser module entirely. The vulnerable component (src/addressparser/index.ts) containing the quadratically-backtracking regex pattern was introduced between v2.0.0 and v3.0.0, years after this version. Exhaustive searches found no addressparser code, no equivalent regex patterns, and no email address parsing functionality match...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-v53p-9fqp-m79j"
      },
      "impact_statement": "not_affected \u2014 Version 0.7.1 of nodemailer predates the introduction of the addressparser module entirely. The vulnerable component (src/addressparser/index.ts) containing the quadratically-backtracking regex pattern was introduced between v2.0.0 and v3.0.0, years after this version. Exhaustive searches found no addressparser code, no equivalent regex patterns, and no email address parsing functionality match..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@0.7.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@0.7.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-vm5r-23w9-m8hx is a false positive for nodemailer 0.7.1-tuxcare.2.",
      "vulnerability": {
        "name": "GHSA-vm5r-23w9-m8hx"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@0.7.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@0.7.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-vvjj-xcjg-gr5g does not affect version 0.7.1-tuxcare.2 of nodemailer. not_affected \u2014 Version 0.7.1 uses a fundamentally different architecture than the affected versions. The vulnerability exists in lib/smtp-connection/index.js (lines 1333, 1336, 1384, 1517, 1520) where modern nodemailer constructs EHLO/HELO/LHLO commands using unsanitized name input. Version 0.7.1 does not contain this file or code. Instead, it delegates all SMTP protocol handling to the external 'simplesmtp' ...",
      "vulnerability": {
        "name": "GHSA-vvjj-xcjg-gr5g"
      },
      "impact_statement": "not_affected \u2014 Version 0.7.1 uses a fundamentally different architecture than the affected versions. The vulnerability exists in lib/smtp-connection/index.js (lines 1333, 1336, 1384, 1517, 1520) where modern nodemailer constructs EHLO/HELO/LHLO commands using unsanitized name input. Version 0.7.1 does not contain this file or code. Instead, it delegates all SMTP protocol handling to the external 'simplesmtp' ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@0.7.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@0.7.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-wmmp-3585-3rmp does not affect version 0.7.1-tuxcare.2 of nodemailer. not_affected \u2014 Version 0.7.1 is not affected by GHSA-wmmp-3585-3rmp. The vulnerability exists in nodemailer's integrated address normalization code (lib/mime-node/index.js _normalizeAddress function) that uses raw RFC-3492 Punycode encoding without UTS-46 normalization. This code path was introduced in later versions (post-6.x architecture) and does not exist in version 0.7.1. Version 0.7.1 uses a fundamental...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-wmmp-3585-3rmp"
      },
      "impact_statement": "not_affected \u2014 Version 0.7.1 is not affected by GHSA-wmmp-3585-3rmp. The vulnerability exists in nodemailer's integrated address normalization code (lib/mime-node/index.js _normalizeAddress function) that uses raw RFC-3492 Punycode encoding without UTS-46 normalization. This code path was introduced in later versions (post-6.x architecture) and does not exist in version 0.7.1. Version 0.7.1 uses a fundamental..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@0.7.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@0.7.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-wqvq-jvpq-h66f does not affect version 0.7.1-tuxcare.2 of nodemailer. not_affected \u2014 Version 0.7.1 does not contain the vulnerability pattern described in GHSA-wqvq-jvpq-h66f. The vulnerability requires jsonTransport feature and disableFileAccess/disableUrlAccess security controls to exist so they can be bypassed. Version 0.7.1 uses a fundamentally different architecture that predates these features entirely.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-wqvq-jvpq-h66f"
      },
      "impact_statement": "not_affected \u2014 Version 0.7.1 does not contain the vulnerability pattern described in GHSA-wqvq-jvpq-h66f. The vulnerability requires jsonTransport feature and disableFileAccess/disableUrlAccess security controls to exist so they can be bypassed. Version 0.7.1 uses a fundamentally different architecture that predates these features entirely."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@0.7.1-tuxcare.2",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@0.7.1-tuxcare.2"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-wxxx-r42m-9rp8 is a false positive for nodemailer 0.7.1-tuxcare.2.",
      "vulnerability": {
        "name": "GHSA-wxxx-r42m-9rp8"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}