{
  "@id": "urn:uuid:5f1949ae-1356-4ec0-8c6d-4c18902e06fd",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 20,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-13T23:55:10.702055+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.15",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.15"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2020-7769 affects version 10.0.15 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2020-7769"
      },
      "action_statement": "Vulnerability CVE-2020-7769 affects version 10.0.15 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.15",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.15"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2021-23400 affects version 10.0.15 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2021-23400"
      },
      "action_statement": "Vulnerability CVE-2021-23400 affects version 10.0.15 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.15",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.15"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2025-13033 affects version 10.0.15 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2025-13033"
      },
      "action_statement": "Vulnerability CVE-2025-13033 affects version 10.0.15 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.15",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.15"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2025-14874 affects version 10.0.15 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2025-14874"
      },
      "action_statement": "Vulnerability CVE-2025-14874 affects version 10.0.15 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.15",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.15"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2026-110871 affects version 10.0.15 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-110871"
      },
      "action_statement": "Vulnerability CVE-2026-110871 affects version 10.0.15 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.15",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.15"
          }
        }
      ],
      "timestamp": "2026-11-03T14:36:48.497569+00:00",
      "status_notes": "Vulnerability CVE-2026-121424 affects version 10.0.15 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-121424"
      },
      "action_statement": "Vulnerability CVE-2026-121424 affects version 10.0.15 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.15",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.15"
          }
        }
      ],
      "timestamp": "2026-11-03T14:36:48.497569+00:00",
      "status_notes": "Vulnerability CVE-2026-121425 affects version 10.0.15 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-121425"
      },
      "action_statement": "Vulnerability CVE-2026-121425 affects version 10.0.15 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.15",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.15"
          }
        }
      ],
      "timestamp": "2026-11-03T14:36:48.497569+00:00",
      "status_notes": "Vulnerability CVE-2026-121426 affects version 10.0.15 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-121426"
      },
      "action_statement": "Vulnerability CVE-2026-121426 affects version 10.0.15 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.15",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.15"
          }
        }
      ],
      "timestamp": "2026-11-10T15:30:00.075367+00:00",
      "status_notes": "Vulnerability CVE-2026-125755 affects version 10.0.15 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-125755"
      },
      "action_statement": "Vulnerability CVE-2026-125755 affects version 10.0.15 of nodemailer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.15",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.15"
          }
        }
      ],
      "timestamp": "2026-11-13T22:31:00.045181+00:00",
      "status_notes": "Vulnerability CVE-2026-82659 does not affect version 10.0.15 of nodemailer. not_affected \u2014 Nodemailer 10.0.15 already contains the upstream fix a82e060d (\"enforce disableFileAccess/disableUrlAccess for raw message option\"). MailComposer.compile() builds the raw root MimeNode with disableUrlAccess and disableFileAccess, so the raw {path}/{href} bypass from CVE-2026-82659 is not present. The fix shipped in the upstream release, not through a TuxCare backport.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-82659"
      },
      "impact_statement": "not_affected \u2014 Nodemailer 10.0.15 already contains the upstream fix a82e060d (\"enforce disableFileAccess/disableUrlAccess for raw message option\"). MailComposer.compile() builds the raw root MimeNode with disableUrlAccess and disableFileAccess, so the raw {path}/{href} bypass from CVE-2026-82659 is not present. The fix shipped in the upstream release, not through a TuxCare backport."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.15",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.15"
          }
        }
      ],
      "timestamp": "2026-11-13T23:13:21.676667+00:00",
      "status_notes": "Vulnerability CVE-2026-82662 does not affect version 10.0.15 of nodemailer. not_affected \u2014 Nodemailer 10.0.15 is not affected. The internal HTTPS fetch client (src/fetch/index.ts) sets rejectUnauthorized: true by default. The OAuth2 token fetch (src/xoauth2/index.ts) pins it to true as well. Disabling verification now needs an explicit user opt-in through tls.rejectUnauthorized=false. This validation shipped in the upstream TypeScript-migration commit f7cbf83 (author andris@reinman.e...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-82662"
      },
      "impact_statement": "not_affected \u2014 Nodemailer 10.0.15 is not affected. The internal HTTPS fetch client (src/fetch/index.ts) sets rejectUnauthorized: true by default. The OAuth2 token fetch (src/xoauth2/index.ts) pins it to true as well. Disabling verification now needs an explicit user opt-in through tls.rejectUnauthorized=false. This validation shipped in the upstream TypeScript-migration commit f7cbf83 (author andris@reinman.e..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.15",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.15"
          }
        }
      ],
      "timestamp": "2026-11-13T23:28:00.053366+00:00",
      "status_notes": "Vulnerability CVE-2026-82854 does not affect version 10.0.15 of nodemailer. not_affected \u2014 Not affected. This tree is nodemailer 10.0.15 (TypeScript in src/). The upstream fix for CVE-2026-82854 (commit 2d7b9710, author andris@reinman.eu) is already an ancestor of HEAD. src/smtp-connection/index.ts:1892-1896 coerces envelope.size with Number() and appends SIZE= only when the result is a positive number. CRLF input therefore cannot reach the MAIL FROM command line.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-82854"
      },
      "impact_statement": "not_affected \u2014 Not affected. This tree is nodemailer 10.0.15 (TypeScript in src/). The upstream fix for CVE-2026-82854 (commit 2d7b9710, author andris@reinman.eu) is already an ancestor of HEAD. src/smtp-connection/index.ts:1892-1896 coerces envelope.size with Number() and appends SIZE= only when the result is a positive number. CRLF input therefore cannot reach the MAIL FROM command line."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.15",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.15"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2026-90776 affects version 10.0.15 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-90776"
      },
      "action_statement": "Vulnerability CVE-2026-90776 affects version 10.0.15 of nodemailer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.15",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.15"
          }
        }
      ],
      "timestamp": "2026-11-13T22:18:00.036497+00:00",
      "status_notes": "Vulnerability GHSA-268h-hp4c-crq3 does not affect version 10.0.15 of nodemailer. not_affected \u2014 nodemailer 10.0.15 already contains the upstream fix for GHSA-268h-hp4c-crq3. _getListHeaders in src/mailer/mail-message.ts strips CR/LF from list.*.comment before the prepared List-* header value is built. The fix commit 5f69497 is by andris@reinman.eu (upstream) and ships in the upstream release. HEAD has no TuxCare-domain commits, so this is not a TuxCare backport.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-268h-hp4c-crq3"
      },
      "impact_statement": "not_affected \u2014 nodemailer 10.0.15 already contains the upstream fix for GHSA-268h-hp4c-crq3. _getListHeaders in src/mailer/mail-message.ts strips CR/LF from list.*.comment before the prepared List-* header value is built. The fix commit 5f69497 is by andris@reinman.eu (upstream) and ships in the upstream release. HEAD has no TuxCare-domain commits, so this is not a TuxCare backport."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.15",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.15"
          }
        }
      ],
      "timestamp": "2026-11-13T22:49:00.060071+00:00",
      "status_notes": "Vulnerability GHSA-2x7j-588g-ccc2 does not affect version 10.0.15 of nodemailer. not_affected \u2014 nodemailer 10.0.15 already contains all upstream 9.1.0 fixes for GHSA-2x7j-588g-ccc2: linear accumulation and merge in addressparser, Set-based recipient dedupe in MimeNode._convertAddresses, an iterative flatten in _parseAddresses, and a default maxRecipients cap. The fix commits are upstream-authored (andris@reinman.eu) and shipped in the upstream release.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-2x7j-588g-ccc2"
      },
      "impact_statement": "not_affected \u2014 nodemailer 10.0.15 already contains all upstream 9.1.0 fixes for GHSA-2x7j-588g-ccc2: linear accumulation and merge in addressparser, Set-based recipient dedupe in MimeNode._convertAddresses, an iterative flatten in _parseAddresses, and a default maxRecipients cap. The fix commits are upstream-authored (andris@reinman.eu) and shipped in the upstream release."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.15",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.15"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-46j5-6fg5-4gv3 is a false positive for nodemailer 10.0.15.",
      "vulnerability": {
        "name": "GHSA-46j5-6fg5-4gv3"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.15",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.15"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-4ffr-jq9g-5ffx affects version 10.0.15 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-4ffr-jq9g-5ffx"
      },
      "action_statement": "Vulnerability GHSA-4ffr-jq9g-5ffx affects version 10.0.15 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.15",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.15"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-4g23-2xm8-66gc affects version 10.0.15 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-4g23-2xm8-66gc"
      },
      "action_statement": "Vulnerability GHSA-4g23-2xm8-66gc affects version 10.0.15 of nodemailer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.15",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.15"
          }
        }
      ],
      "timestamp": "2026-11-13T23:51:59.401600+00:00",
      "status_notes": "Vulnerability GHSA-6vj9-mwq6-2f5v does not affect version 10.0.15 of nodemailer. not_affected \u2014 Not affected. Target 10.0.15 already contains upstream commit a6512dbc (\"fix(shared): keep the TLS server name out of the DNS cache\"). The host-keyed DNS cache now stores only addresses, and the TLS servername is derived from the current caller's options on every call, cache hit or miss. The fix was shipped in the upstream release, so it is not a TuxCare backport.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-6vj9-mwq6-2f5v"
      },
      "impact_statement": "not_affected \u2014 Not affected. Target 10.0.15 already contains upstream commit a6512dbc (\"fix(shared): keep the TLS server name out of the DNS cache\"). The host-keyed DNS cache now stores only addresses, and the TLS servername is derived from the current caller's options on every call, cache hit or miss. The fix was shipped in the upstream release, so it is not a TuxCare backport."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.15",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.15"
          }
        }
      ],
      "timestamp": "2026-10-23T22:01:00.144162+00:00",
      "status_notes": "Vulnerability GHSA-85x2-q946-cp5h affects version 10.0.15 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-85x2-q946-cp5h"
      },
      "action_statement": "Vulnerability GHSA-85x2-q946-cp5h affects version 10.0.15 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.15",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.15"
          }
        }
      ],
      "timestamp": "2026-10-23T22:01:12.702168+00:00",
      "status_notes": "Vulnerability GHSA-8c8m-p3m8-cjg8 affects version 10.0.15 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-8c8m-p3m8-cjg8"
      },
      "action_statement": "Vulnerability GHSA-8c8m-p3m8-cjg8 affects version 10.0.15 of nodemailer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.15",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.15"
          }
        }
      ],
      "timestamp": "2026-11-13T22:32:00.034202+00:00",
      "status_notes": "Vulnerability GHSA-8m3c-c648-2xjj does not affect version 10.0.15 of nodemailer. not_affected \u2014 Target (nodemailer 10.0.15, TypeScript) already contains the upstream fix. MailMessage.resolveContent in src/mailer/mail-message.ts merges the message-level disableFileAccess/disableUrlAccess flags into the policy passed to shared.resolveContent, including for the legacy (data, key, callback) signature. The fix commits dc48ed3 and ab7ef34 are upstream-authored and ship in the release. HEAD has ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-8m3c-c648-2xjj"
      },
      "impact_statement": "not_affected \u2014 Target (nodemailer 10.0.15, TypeScript) already contains the upstream fix. MailMessage.resolveContent in src/mailer/mail-message.ts merges the message-level disableFileAccess/disableUrlAccess flags into the policy passed to shared.resolveContent, including for the legacy (data, key, callback) signature. The fix commits dc48ed3 and ab7ef34 are upstream-authored and ship in the release. HEAD has ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.15",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.15"
          }
        }
      ],
      "timestamp": "2026-11-13T23:55:10.702055+00:00",
      "status_notes": "Vulnerability GHSA-8vvx-rff5-p5rq does not affect version 10.0.15 of nodemailer. not_affected \u2014 Target nodemailer 10.0.15 already contains the upstream fix (commit ebe0849, \"flatten nested recipient arrays without recursion\", authored by andris@reinman.eu). MimeNode._parseAddresses now flattens nested arrays iteratively with an explicit stack and a WeakSet cycle guard, so nested arrays are never passed to addressparser or stringified recursively. The fix is an ancestor of HEAD and came wi...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-8vvx-rff5-p5rq"
      },
      "impact_statement": "not_affected \u2014 Target nodemailer 10.0.15 already contains the upstream fix (commit ebe0849, \"flatten nested recipient arrays without recursion\", authored by andris@reinman.eu). MimeNode._parseAddresses now flattens nested arrays iteratively with an explicit stack and a WeakSet cycle guard, so nested arrays are never passed to addressparser or stringified recursively. The fix is an ancestor of HEAD and came wi..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.15",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.15"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-9h6g-pr28-7cqp affects version 10.0.15 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-9h6g-pr28-7cqp"
      },
      "action_statement": "Vulnerability GHSA-9h6g-pr28-7cqp affects version 10.0.15 of nodemailer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.15",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.15"
          }
        }
      ],
      "timestamp": "2026-11-13T22:09:32.764375+00:00",
      "status_notes": "Vulnerability GHSA-c7w3-x93f-qmm8 does not affect version 10.0.15 of nodemailer. not_affected \u2014 Target nodemailer 10.0.15 is not affected. In src/smtp-connection/index.ts:1892-1897 the envelope.size value is coerced with Number() and only a positive numeric result is appended to MAIL FROM as SIZE=<number>. A CRLF-bearing string becomes NaN, then 0, and is dropped, so no SMTP command can be injected. This numeric coercion shipped in the upstream release (introduced by upstream commit f7cbf...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-c7w3-x93f-qmm8"
      },
      "impact_statement": "not_affected \u2014 Target nodemailer 10.0.15 is not affected. In src/smtp-connection/index.ts:1892-1897 the envelope.size value is coerced with Number() and only a positive numeric result is appended to MAIL FROM as SIZE=<number>. A CRLF-bearing string becomes NaN, then 0, and is dropped, so no SMTP command can be injected. This numeric coercion shipped in the upstream release (introduced by upstream commit f7cbf..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.15",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.15"
          }
        }
      ],
      "timestamp": "2026-11-13T22:57:00.061178+00:00",
      "status_notes": "Vulnerability GHSA-cc9r-2j5m-2m83 does not affect version 10.0.15 of nodemailer. not_affected \u2014 The upstream fix for GHSA-cc9r-2j5m-2m83 (nodemailer commit 902b63e, \"terminate the domain at an RFC 5322 comment\") is already in this source tree (10.0.15). The address parser no longer glues atoms across a comment-closing \")\" unless one side carries the \"@\". The fix author and committer are both andris@reinman.eu, and the commit is an ancestor of HEAD. HEAD has no TuxCare-domain commits, only...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-cc9r-2j5m-2m83"
      },
      "impact_statement": "not_affected \u2014 The upstream fix for GHSA-cc9r-2j5m-2m83 (nodemailer commit 902b63e, \"terminate the domain at an RFC 5322 comment\") is already in this source tree (10.0.15). The address parser no longer glues atoms across a comment-closing \")\" unless one side carries the \"@\". The fix author and committer are both andris@reinman.eu, and the commit is an ancestor of HEAD. HEAD has no TuxCare-domain commits, only..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.15",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.15"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-frj6-5rhh-vwfw is a false positive for nodemailer 10.0.15.",
      "vulnerability": {
        "name": "GHSA-frj6-5rhh-vwfw"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.15",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.15"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-g57g-f23g-4646 affects version 10.0.15 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-g57g-f23g-4646"
      },
      "action_statement": "Vulnerability GHSA-g57g-f23g-4646 affects version 10.0.15 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.15",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.15"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-g73g-hqqh-jr95 affects version 10.0.15 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-g73g-hqqh-jr95"
      },
      "action_statement": "Vulnerability GHSA-g73g-hqqh-jr95 affects version 10.0.15 of nodemailer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.15",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.15"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-h3hj-cmcx-xc66 is a false positive for nodemailer 10.0.15.",
      "vulnerability": {
        "name": "GHSA-h3hj-cmcx-xc66"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.15",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.15"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-jj37-3377-m6vv is a false positive for nodemailer 10.0.15.",
      "vulnerability": {
        "name": "GHSA-jj37-3377-m6vv"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.15",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.15"
          }
        }
      ],
      "timestamp": "2026-10-23T22:01:49.029239+00:00",
      "status_notes": "Vulnerability GHSA-m943-m63m-w62w affects version 10.0.15 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-m943-m63m-w62w"
      },
      "action_statement": "Vulnerability GHSA-m943-m63m-w62w affects version 10.0.15 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.15",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.15"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-v53p-9fqp-m79j affects version 10.0.15 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-v53p-9fqp-m79j"
      },
      "action_statement": "Vulnerability GHSA-v53p-9fqp-m79j affects version 10.0.15 of nodemailer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.15",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.15"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-vm5r-23w9-m8hx is a false positive for nodemailer 10.0.15.",
      "vulnerability": {
        "name": "GHSA-vm5r-23w9-m8hx"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.15",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.15"
          }
        }
      ],
      "timestamp": "2026-11-13T22:09:35.112613+00:00",
      "status_notes": "Vulnerability GHSA-vvjj-xcjg-gr5g does not affect version 10.0.15 of nodemailer. not_affected \u2014 Nodemailer 10.0.15 already strips CR/LF from the SMTP `name` option at src/smtp-connection/index.ts:649, before it is used in EHLO/HELO/LHLO. The sanitization shipped in the upstream release (introduced by Andris Reinman's TypeScript migration commit), so the target is not affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-vvjj-xcjg-gr5g"
      },
      "impact_statement": "not_affected \u2014 Nodemailer 10.0.15 already strips CR/LF from the SMTP `name` option at src/smtp-connection/index.ts:649, before it is used in EHLO/HELO/LHLO. The sanitization shipped in the upstream release (introduced by Andris Reinman's TypeScript migration commit), so the target is not affected."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.15",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.15"
          }
        }
      ],
      "timestamp": "2026-11-13T23:07:36.695188+00:00",
      "status_notes": "Vulnerability GHSA-wmmp-3585-3rmp does not affect version 10.0.15 of nodemailer. not_affected \u2014 Target nodemailer 10.0.15 already contains the upstream UTS-46 domain-encoding fix (GHSA-wmmp-3585-3rmp, patched upstream in 9.1.0 via 259c32d and hardened in b212ac4). _normalizeAddress calls normalizeDomain(), which maps the domain with url.domainToASCII / domainToUnicode and rejects host-delimiter characters before the mapper. The fix shipped in the upstream release, so this is not a TuxCare...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-wmmp-3585-3rmp"
      },
      "impact_statement": "not_affected \u2014 Target nodemailer 10.0.15 already contains the upstream UTS-46 domain-encoding fix (GHSA-wmmp-3585-3rmp, patched upstream in 9.1.0 via 259c32d and hardened in b212ac4). _normalizeAddress calls normalizeDomain(), which maps the domain with url.domainToASCII / domainToUnicode and rejects host-delimiter characters before the mapper. The fix shipped in the upstream release, so this is not a TuxCare..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.15",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.15"
          }
        }
      ],
      "timestamp": "2026-11-13T22:16:11.634814+00:00",
      "status_notes": "Vulnerability GHSA-wqvq-jvpq-h66f does not affect version 10.0.15 of nodemailer. not_affected \u2014 Target (nodemailer 10.0.15) already contains the upstream fix for GHSA-wqvq-jvpq-h66f. shared.resolveContent() takes an access policy and rejects URL and file references with EURLACCESS / EFILEACCESS. The jsonTransport path (normalize -> resolveAll) and the attachDataUrls path (_convertDataImages) both pass the policy. The fix is upstream commit 5f694977, authored by Andris Reinman and shipped ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-wqvq-jvpq-h66f"
      },
      "impact_statement": "not_affected \u2014 Target (nodemailer 10.0.15) already contains the upstream fix for GHSA-wqvq-jvpq-h66f. shared.resolveContent() takes an access policy and rejects URL and file references with EURLACCESS / EFILEACCESS. The jsonTransport path (normalize -> resolveAll) and the attachDataUrls path (_convertDataImages) both pass the policy. The fix is upstream commit 5f694977, authored by Andris Reinman and shipped ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.15",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.15"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-wxxx-r42m-9rp8 is a false positive for nodemailer 10.0.15.",
      "vulnerability": {
        "name": "GHSA-wxxx-r42m-9rp8"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}