{ "@id": "urn:uuid:4b78a1e4-bda5-49c3-aca1-0500dac428c5", "role": "Document Creator", "author": "https://tuxcare.com", "version": 22, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-13T23:52:34.370227+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.12", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.12" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2020-7769 affects version 10.0.12 of nodemailer.", "vulnerability": { "name": "CVE-2020-7769" }, "action_statement": "Vulnerability CVE-2020-7769 affects version 10.0.12 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.12", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.12" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2021-23400 affects version 10.0.12 of nodemailer.", "vulnerability": { "name": "CVE-2021-23400" }, "action_statement": "Vulnerability CVE-2021-23400 affects version 10.0.12 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.12", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.12" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2025-13033 affects version 10.0.12 of nodemailer.", "vulnerability": { "name": "CVE-2025-13033" }, "action_statement": "Vulnerability CVE-2025-13033 affects version 10.0.12 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.12", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.12" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2025-14874 affects version 10.0.12 of nodemailer.", "vulnerability": { "name": "CVE-2025-14874" }, "action_statement": "Vulnerability CVE-2025-14874 affects version 10.0.12 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.12", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.12" } } ], "timestamp": "2026-10-15T15:49:00.133726+00:00", "status_notes": "Vulnerability CVE-2026-110869 affects version 10.0.12 of nodemailer.", "vulnerability": { "name": "CVE-2026-110869" }, "action_statement": "Vulnerability CVE-2026-110869 affects version 10.0.12 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.12", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.12" } } ], "timestamp": "2026-10-26T15:35:33.946658+00:00", "status_notes": "Vulnerability CVE-2026-110870 affects version 10.0.12 of nodemailer.", "vulnerability": { "name": "CVE-2026-110870" }, "action_statement": "Vulnerability CVE-2026-110870 affects version 10.0.12 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.12", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.12" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2026-110871 affects version 10.0.12 of nodemailer.", "vulnerability": { "name": "CVE-2026-110871" }, "action_statement": "Vulnerability CVE-2026-110871 affects version 10.0.12 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.12", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.12" } } ], "timestamp": "2026-11-03T14:36:48.497569+00:00", "status_notes": "Vulnerability CVE-2026-121424 affects version 10.0.12 of nodemailer.", "vulnerability": { "name": "CVE-2026-121424" }, "action_statement": "Vulnerability CVE-2026-121424 affects version 10.0.12 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.12", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.12" } } ], "timestamp": "2026-11-03T14:36:48.497569+00:00", "status_notes": "Vulnerability CVE-2026-121425 affects version 10.0.12 of nodemailer.", "vulnerability": { "name": "CVE-2026-121425" }, "action_statement": "Vulnerability CVE-2026-121425 affects version 10.0.12 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.12", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.12" } } ], "timestamp": "2026-11-03T14:36:48.497569+00:00", "status_notes": "Vulnerability CVE-2026-121426 affects version 10.0.12 of nodemailer.", "vulnerability": { "name": "CVE-2026-121426" }, "action_statement": "Vulnerability CVE-2026-121426 affects version 10.0.12 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.12", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.12" } } ], "timestamp": "2026-11-10T15:30:00.075367+00:00", "status_notes": "Vulnerability CVE-2026-125755 affects version 10.0.12 of nodemailer.", "vulnerability": { "name": "CVE-2026-125755" }, "action_statement": "Vulnerability CVE-2026-125755 affects version 10.0.12 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.12", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.12" } } ], "timestamp": "2026-11-13T22:31:00.045181+00:00", "status_notes": "Vulnerability CVE-2026-82659 does not affect version 10.0.12 of nodemailer. not_affected \u2014 Target nodemailer 10.0.12 already contains the upstream fix (commit a82e060, \"enforce disableFileAccess/disableUrlAccess for raw message option\"). The raw root node in MailComposer.compile() is built with disableFileAccess and disableUrlAccess, and MimeNode._getStream rejects path and href content when either flag is set. The fix is upstream-authored and shipped in the release. HEAD has no TuxC...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-82659" }, "impact_statement": "not_affected \u2014 Target nodemailer 10.0.12 already contains the upstream fix (commit a82e060, \"enforce disableFileAccess/disableUrlAccess for raw message option\"). The raw root node in MailComposer.compile() is built with disableFileAccess and disableUrlAccess, and MimeNode._getStream rejects path and href content when either flag is set. The fix is upstream-authored and shipped in the release. HEAD has no TuxC..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.12", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.12" } } ], "timestamp": "2026-11-13T23:13:21.676667+00:00", "status_notes": "Vulnerability CVE-2026-82662 does not affect version 10.0.12 of nodemailer. not_affected \u2014 Nodemailer 10.0.12 is not affected. The internal HTTPS fetch client (src/fetch/index.ts) sets rejectUnauthorized: true by default. The OAuth2 token request and the attachment fetch path both pin it to true again. The upstream author (andris@reinman.eu) made this change in the TypeScript migration commit f7cbf83, which is an ancestor of HEAD. The only TuxCare-side commit is a tuxcare.yaml config...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-82662" }, "impact_statement": "not_affected \u2014 Nodemailer 10.0.12 is not affected. The internal HTTPS fetch client (src/fetch/index.ts) sets rejectUnauthorized: true by default. The OAuth2 token request and the attachment fetch path both pin it to true again. The upstream author (andris@reinman.eu) made this change in the TypeScript migration commit f7cbf83, which is an ancestor of HEAD. The only TuxCare-side commit is a tuxcare.yaml config..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.12", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.12" } } ], "timestamp": "2026-11-13T23:28:00.053366+00:00", "status_notes": "Vulnerability CVE-2026-82854 does not affect version 10.0.12 of nodemailer. not_affected \u2014 Target (nodemailer 10.0.12) already contains the upstream fix for CVE-2026-82854. In src/smtp-connection/index.ts the envelope size is coerced with Number() and emitted as SIZE= only when it is a positive number, so CRLF content cannot reach the MAIL FROM line. The fix commit 2d7b971 (author andris@reinman.eu) is an ancestor of HEAD and predates the only TuxCare commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-82854" }, "impact_statement": "not_affected \u2014 Target (nodemailer 10.0.12) already contains the upstream fix for CVE-2026-82854. In src/smtp-connection/index.ts the envelope size is coerced with Number() and emitted as SIZE= only when it is a positive number, so CRLF content cannot reach the MAIL FROM line. The fix commit 2d7b971 (author andris@reinman.eu) is an ancestor of HEAD and predates the only TuxCare commit." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.12", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.12" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2026-90776 affects version 10.0.12 of nodemailer.", "vulnerability": { "name": "CVE-2026-90776" }, "action_statement": "Vulnerability CVE-2026-90776 affects version 10.0.12 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.12", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.12" } } ], "timestamp": "2026-11-13T22:18:00.036497+00:00", "status_notes": "Vulnerability GHSA-268h-hp4c-crq3 does not affect version 10.0.12 of nodemailer. not_affected \u2014 nodemailer 10.0.12 is not affected by GHSA-268h-hp4c-crq3. In src/mailer/mail-message.ts, _getListHeaders replaces CR/LF in list.*.comment with a space before the prepared List-* header value is built. The comment is then quoted, escaped or encoded as an RFC 2047 word, so a CRLF in a comment cannot start a new header line. This sanitization is upstream-authored and present in the upstream relea...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-268h-hp4c-crq3" }, "impact_statement": "not_affected \u2014 nodemailer 10.0.12 is not affected by GHSA-268h-hp4c-crq3. In src/mailer/mail-message.ts, _getListHeaders replaces CR/LF in list.*.comment with a space before the prepared List-* header value is built. The comment is then quoted, escaped or encoded as an RFC 2047 word, so a CRLF in a comment cannot start a new header line. This sanitization is upstream-authored and present in the upstream relea..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.12", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.12" } } ], "timestamp": "2026-11-13T22:49:00.060071+00:00", "status_notes": "Vulnerability GHSA-2x7j-588g-ccc2 does not affect version 10.0.12 of nodemailer. not_affected \u2014 Nodemailer 10.0.12 already contains the 9.1.0 fixes for GHSA-2x7j-588g-ccc2. The accumulator, the display-name merge and recipient dedupe all run in linear time, and a maxRecipients cap (default 100000) is enforced. The fix shipped in the upstream release, and no TuxCare commit authored it.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-2x7j-588g-ccc2" }, "impact_statement": "not_affected \u2014 Nodemailer 10.0.12 already contains the 9.1.0 fixes for GHSA-2x7j-588g-ccc2. The accumulator, the display-name merge and recipient dedupe all run in linear time, and a maxRecipients cap (default 100000) is enforced. The fix shipped in the upstream release, and no TuxCare commit authored it." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.12", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.12" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-46j5-6fg5-4gv3 is a false positive for nodemailer 10.0.12.", "vulnerability": { "name": "GHSA-46j5-6fg5-4gv3" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.12", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.12" } } ], "timestamp": "2026-10-27T15:13:32.414812+00:00", "status_notes": "Vulnerability GHSA-4ffr-jq9g-5ffx affects version 10.0.12 of nodemailer.", "vulnerability": { "name": "GHSA-4ffr-jq9g-5ffx" }, "action_statement": "Vulnerability GHSA-4ffr-jq9g-5ffx affects version 10.0.12 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.12", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.12" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-4g23-2xm8-66gc affects version 10.0.12 of nodemailer.", "vulnerability": { "name": "GHSA-4g23-2xm8-66gc" }, "action_statement": "Vulnerability GHSA-4g23-2xm8-66gc affects version 10.0.12 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.12", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.12" } } ], "timestamp": "2026-11-13T23:49:00.055034+00:00", "status_notes": "Vulnerability GHSA-6vj9-mwq6-2f5v does not affect version 10.0.12 of nodemailer. not_affected \u2014 Not affected. The target (nodemailer 10.0.12) already contains the upstream fix a6512dbc (\"keep the TLS server name out of the DNS cache\"). The DNS cache stores only addresses, and the TLS servername is derived from the current call's options on every path, so one transport's servername cannot leak to another.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6vj9-mwq6-2f5v" }, "impact_statement": "not_affected \u2014 Not affected. The target (nodemailer 10.0.12) already contains the upstream fix a6512dbc (\"keep the TLS server name out of the DNS cache\"). The DNS cache stores only addresses, and the TLS servername is derived from the current call's options on every path, so one transport's servername cannot leak to another." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.12", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.12" } } ], "timestamp": "2026-10-23T22:01:00.144162+00:00", "status_notes": "Vulnerability GHSA-85x2-q946-cp5h affects version 10.0.12 of nodemailer.", "vulnerability": { "name": "GHSA-85x2-q946-cp5h" }, "action_statement": "Vulnerability GHSA-85x2-q946-cp5h affects version 10.0.12 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.12", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.12" } } ], "timestamp": "2026-10-23T22:01:00.144162+00:00", "status_notes": "Vulnerability GHSA-8c8m-p3m8-cjg8 affects version 10.0.12 of nodemailer.", "vulnerability": { "name": "GHSA-8c8m-p3m8-cjg8" }, "action_statement": "Vulnerability GHSA-8c8m-p3m8-cjg8 affects version 10.0.12 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.12", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.12" } } ], "timestamp": "2026-11-13T22:32:41.845963+00:00", "status_notes": "Vulnerability GHSA-8m3c-c648-2xjj does not affect version 10.0.12 of nodemailer. not_affected \u2014 Target nodemailer 10.0.12 is not affected. MailMessage.resolveContent in src/mailer/mail-message.ts now merges the message-level disableFileAccess/disableUrlAccess flags into the policy passed to shared.resolveContent, including for the legacy (data, key, callback) signature. The fix was authored upstream by Andris Reinman and shipped in the upstream release before any TuxCare commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-8m3c-c648-2xjj" }, "impact_statement": "not_affected \u2014 Target nodemailer 10.0.12 is not affected. MailMessage.resolveContent in src/mailer/mail-message.ts now merges the message-level disableFileAccess/disableUrlAccess flags into the policy passed to shared.resolveContent, including for the legacy (data, key, callback) signature. The fix was authored upstream by Andris Reinman and shipped in the upstream release before any TuxCare commit." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.12", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.12" } } ], "timestamp": "2026-11-13T23:52:34.370227+00:00", "status_notes": "Vulnerability GHSA-8vvx-rff5-p5rq does not affect version 10.0.12 of nodemailer. not_affected \u2014 The upstream fix (ebe0849, \"flatten nested recipient arrays without recursion\") is already in this nodemailer 10.0.12 tree, so the nested-array stack-exhaustion path is closed. MimeNode._parseAddresses now walks nested arrays with an explicit stack and a WeakSet, so arrays are never passed to addressparser or stringified.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-8vvx-rff5-p5rq" }, "impact_statement": "not_affected \u2014 The upstream fix (ebe0849, \"flatten nested recipient arrays without recursion\") is already in this nodemailer 10.0.12 tree, so the nested-array stack-exhaustion path is closed. MimeNode._parseAddresses now walks nested arrays with an explicit stack and a WeakSet, so arrays are never passed to addressparser or stringified." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.12", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.12" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-9h6g-pr28-7cqp affects version 10.0.12 of nodemailer.", "vulnerability": { "name": "GHSA-9h6g-pr28-7cqp" }, "action_statement": "Vulnerability GHSA-9h6g-pr28-7cqp affects version 10.0.12 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.12", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.12" } } ], "timestamp": "2026-11-13T22:09:00.042716+00:00", "status_notes": "Vulnerability GHSA-c7w3-x93f-qmm8 does not affect version 10.0.12 of nodemailer. not_affected \u2014 Not affected. The target (nodemailer 10.0.12, TypeScript) already coerces envelope.size with Number() before building the MAIL FROM command, so CR/LF cannot reach the SMTP command line. The coercion comes from the upstream fix 2d7b9710 (author andris@reinman.eu), which is an ancestor of HEAD. HEAD has no @cloudlinux.com or @tuxcare.com commit, so this is an upstream fix, not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-c7w3-x93f-qmm8" }, "impact_statement": "not_affected \u2014 Not affected. The target (nodemailer 10.0.12, TypeScript) already coerces envelope.size with Number() before building the MAIL FROM command, so CR/LF cannot reach the SMTP command line. The coercion comes from the upstream fix 2d7b9710 (author andris@reinman.eu), which is an ancestor of HEAD. HEAD has no @cloudlinux.com or @tuxcare.com commit, so this is an upstream fix, not a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.12", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.12" } } ], "timestamp": "2026-11-13T22:58:00.049762+00:00", "status_notes": "Vulnerability GHSA-cc9r-2j5m-2m83 does not affect version 10.0.12 of nodemailer. not_affected \u2014 Target nodemailer 10.0.12 already contains the upstream fix for GHSA-cc9r-2j5m-2m83. In src/addressparser/index.ts, a comment-closing ')' no longer joins the tokens on either side of it unless one side carries '@'. So user@good-corp.com(x)evil.com is no longer glued into good-corp.comevil.com. The fix shipped in the upstream release (author andris@reinman.eu), before the first TuxCare commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-cc9r-2j5m-2m83" }, "impact_statement": "not_affected \u2014 Target nodemailer 10.0.12 already contains the upstream fix for GHSA-cc9r-2j5m-2m83. In src/addressparser/index.ts, a comment-closing ')' no longer joins the tokens on either side of it unless one side carries '@'. So user@good-corp.com(x)evil.com is no longer glued into good-corp.comevil.com. The fix shipped in the upstream release (author andris@reinman.eu), before the first TuxCare commit." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.12", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.12" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-frj6-5rhh-vwfw is a false positive for nodemailer 10.0.12.", "vulnerability": { "name": "GHSA-frj6-5rhh-vwfw" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.12", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.12" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-g57g-f23g-4646 affects version 10.0.12 of nodemailer.", "vulnerability": { "name": "GHSA-g57g-f23g-4646" }, "action_statement": "Vulnerability GHSA-g57g-f23g-4646 affects version 10.0.12 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.12", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.12" } } ], "timestamp": "2026-10-27T15:13:36.008785+00:00", "status_notes": "Vulnerability GHSA-g73g-hqqh-jr95 affects version 10.0.12 of nodemailer.", "vulnerability": { "name": "GHSA-g73g-hqqh-jr95" }, "action_statement": "Vulnerability GHSA-g73g-hqqh-jr95 affects version 10.0.12 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.12", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.12" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-h3hj-cmcx-xc66 is a false positive for nodemailer 10.0.12.", "vulnerability": { "name": "GHSA-h3hj-cmcx-xc66" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.12", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.12" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-jj37-3377-m6vv is a false positive for nodemailer 10.0.12.", "vulnerability": { "name": "GHSA-jj37-3377-m6vv" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.12", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.12" } } ], "timestamp": "2026-10-23T22:01:49.029239+00:00", "status_notes": "Vulnerability GHSA-m943-m63m-w62w affects version 10.0.12 of nodemailer.", "vulnerability": { "name": "GHSA-m943-m63m-w62w" }, "action_statement": "Vulnerability GHSA-m943-m63m-w62w affects version 10.0.12 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.12", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.12" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-v53p-9fqp-m79j affects version 10.0.12 of nodemailer.", "vulnerability": { "name": "GHSA-v53p-9fqp-m79j" }, "action_statement": "Vulnerability GHSA-v53p-9fqp-m79j affects version 10.0.12 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.12", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.12" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-vm5r-23w9-m8hx is a false positive for nodemailer 10.0.12.", "vulnerability": { "name": "GHSA-vm5r-23w9-m8hx" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.12", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.12" } } ], "timestamp": "2026-11-13T22:09:40.579854+00:00", "status_notes": "Vulnerability GHSA-vvjj-xcjg-gr5g does not affect version 10.0.12 of nodemailer. not_affected \u2014 The target is nodemailer 10.0.12, an upstream release. Its SMTP connection constructor already strips CR/LF from the transport `name` option before the value reaches EHLO, HELO or LHLO. The vulnerable pattern (unsanitized `name`) is not present in HEAD, and the fix is upstream-authored, not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-vvjj-xcjg-gr5g" }, "impact_statement": "not_affected \u2014 The target is nodemailer 10.0.12, an upstream release. Its SMTP connection constructor already strips CR/LF from the transport `name` option before the value reaches EHLO, HELO or LHLO. The vulnerable pattern (unsanitized `name`) is not present in HEAD, and the fix is upstream-authored, not a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.12", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.12" } } ], "timestamp": "2026-11-13T22:58:00.049762+00:00", "status_notes": "Vulnerability GHSA-wmmp-3585-3rmp does not affect version 10.0.12 of nodemailer. not_affected \u2014 Target is nodemailer 10.0.12, an upstream release that already ships both upstream fixes for GHSA-wmmp-3585-3rmp: 259c32d (apply UTS-46 mapping when encoding a domain) and b212ac4 (keep URL delimiters away from the domain mapper). _normalizeAddress calls normalizeDomain, which uses url.domainToASCII / domainToUnicode and guards against the characters / \\ ? # % and control chars. The vulnerable ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wmmp-3585-3rmp" }, "impact_statement": "not_affected \u2014 Target is nodemailer 10.0.12, an upstream release that already ships both upstream fixes for GHSA-wmmp-3585-3rmp: 259c32d (apply UTS-46 mapping when encoding a domain) and b212ac4 (keep URL delimiters away from the domain mapper). _normalizeAddress calls normalizeDomain, which uses url.domainToASCII / domainToUnicode and guards against the characters / \\ ? # % and control chars. The vulnerable ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.12", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.12" } } ], "timestamp": "2026-11-13T22:15:08.551507+00:00", "status_notes": "Vulnerability GHSA-wqvq-jvpq-h66f does not affect version 10.0.12 of nodemailer. not_affected \u2014 Nodemailer 10.0.12 is not affected. The upstream fix for GHSA-wqvq-jvpq-h66f (nodemailer commit 5f69497, \"fix: two pending security advisories (jsonTransport access bypass, ...)\") is an ancestor of HEAD. It is already in the upstream release that was onboarded. shared.resolveContent now takes an access policy and rejects URL and file content with EURLACCESS / EFILEACCESS. MailMessage.resolveCon...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wqvq-jvpq-h66f" }, "impact_statement": "not_affected \u2014 Nodemailer 10.0.12 is not affected. The upstream fix for GHSA-wqvq-jvpq-h66f (nodemailer commit 5f69497, \"fix: two pending security advisories (jsonTransport access bypass, ...)\") is an ancestor of HEAD. It is already in the upstream release that was onboarded. shared.resolveContent now takes an access policy and rejects URL and file content with EURLACCESS / EFILEACCESS. MailMessage.resolveCon..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.12", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.12" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-wxxx-r42m-9rp8 is a false positive for nodemailer 10.0.12.", "vulnerability": { "name": "GHSA-wxxx-r42m-9rp8" }, "impact_statement": "The vulnerability has been withdrawn." } ] }