{
  "@id": "urn:uuid:4cffd405-3ee0-4a42-920c-d7801bb041f9",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 19,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-13T23:53:00.038549+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.16",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.16"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2020-7769 affects version 10.0.16 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2020-7769"
      },
      "action_statement": "Vulnerability CVE-2020-7769 affects version 10.0.16 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.16",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.16"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2021-23400 affects version 10.0.16 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2021-23400"
      },
      "action_statement": "Vulnerability CVE-2021-23400 affects version 10.0.16 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.16",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.16"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2025-13033 affects version 10.0.16 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2025-13033"
      },
      "action_statement": "Vulnerability CVE-2025-13033 affects version 10.0.16 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.16",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.16"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2025-14874 affects version 10.0.16 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2025-14874"
      },
      "action_statement": "Vulnerability CVE-2025-14874 affects version 10.0.16 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.16",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.16"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2026-110871 affects version 10.0.16 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-110871"
      },
      "action_statement": "Vulnerability CVE-2026-110871 affects version 10.0.16 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.16",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.16"
          }
        }
      ],
      "timestamp": "2026-11-03T14:36:48.497569+00:00",
      "status_notes": "Vulnerability CVE-2026-121424 affects version 10.0.16 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-121424"
      },
      "action_statement": "Vulnerability CVE-2026-121424 affects version 10.0.16 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.16",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.16"
          }
        }
      ],
      "timestamp": "2026-11-03T14:36:48.497569+00:00",
      "status_notes": "Vulnerability CVE-2026-121425 affects version 10.0.16 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-121425"
      },
      "action_statement": "Vulnerability CVE-2026-121425 affects version 10.0.16 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.16",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.16"
          }
        }
      ],
      "timestamp": "2026-11-03T14:36:48.497569+00:00",
      "status_notes": "Vulnerability CVE-2026-121426 affects version 10.0.16 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-121426"
      },
      "action_statement": "Vulnerability CVE-2026-121426 affects version 10.0.16 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.16",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.16"
          }
        }
      ],
      "timestamp": "2026-11-10T15:30:00.075367+00:00",
      "status_notes": "Vulnerability CVE-2026-125755 affects version 10.0.16 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-125755"
      },
      "action_statement": "Vulnerability CVE-2026-125755 affects version 10.0.16 of nodemailer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.16",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.16"
          }
        }
      ],
      "timestamp": "2026-11-13T22:31:00.045181+00:00",
      "status_notes": "Vulnerability CVE-2026-82659 does not affect version 10.0.16 of nodemailer. not_affected \u2014 The target (nodemailer 10.0.16, TypeScript) already contains the upstream fix a82e060 (\"fix: enforce disableFileAccess/disableUrlAccess for raw message option\"). MailComposer.compile() passes both access flags to the raw root MimeNode. The fix commit is by upstream author andris@reinman.eu and shipped in the upstream release before TuxCare's only commit, a build-config addition.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-82659"
      },
      "impact_statement": "not_affected \u2014 The target (nodemailer 10.0.16, TypeScript) already contains the upstream fix a82e060 (\"fix: enforce disableFileAccess/disableUrlAccess for raw message option\"). MailComposer.compile() passes both access flags to the raw root MimeNode. The fix commit is by upstream author andris@reinman.eu and shipped in the upstream release before TuxCare's only commit, a build-config addition."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.16",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.16"
          }
        }
      ],
      "timestamp": "2026-11-13T23:13:38.875037+00:00",
      "status_notes": "Vulnerability CVE-2026-82662 does not affect version 10.0.16 of nodemailer. not_affected \u2014 Not vulnerable. The target is nodemailer 10.0.16 (TypeScript). The internal fetch client sets rejectUnauthorized: true by default, and the OAuth2 and Ethereal credential requests pin strict TLS. The fix, upstream commit 833d6e58, is in HEAD's upstream history, and an earlier upstream commit (6a947ac7) made strict TLS the fetch default.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-82662"
      },
      "impact_statement": "not_affected \u2014 Not vulnerable. The target is nodemailer 10.0.16 (TypeScript). The internal fetch client sets rejectUnauthorized: true by default, and the OAuth2 and Ethereal credential requests pin strict TLS. The fix, upstream commit 833d6e58, is in HEAD's upstream history, and an earlier upstream commit (6a947ac7) made strict TLS the fetch default."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.16",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.16"
          }
        }
      ],
      "timestamp": "2026-11-13T23:28:00.053366+00:00",
      "status_notes": "Vulnerability CVE-2026-82854 does not affect version 10.0.16 of nodemailer. not_affected \u2014 Target nodemailer 10.0.16 already contains the upstream fix (commit 2d7b9710, \"sanitize envelope size to prevent SMTP command injection\"). In src/smtp-connection/index.ts:1892-1897, envelope.size is coerced with Number() and only appended as SIZE=<number> if it is greater than 0, so CRLF payloads become NaN and are dropped. The fix shipped in the upstream release and no TuxCare backport commit ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-82854"
      },
      "impact_statement": "not_affected \u2014 Target nodemailer 10.0.16 already contains the upstream fix (commit 2d7b9710, \"sanitize envelope size to prevent SMTP command injection\"). In src/smtp-connection/index.ts:1892-1897, envelope.size is coerced with Number() and only appended as SIZE=<number> if it is greater than 0, so CRLF payloads become NaN and are dropped. The fix shipped in the upstream release and no TuxCare backport commit ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.16",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.16"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2026-90776 affects version 10.0.16 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-90776"
      },
      "action_statement": "Vulnerability CVE-2026-90776 affects version 10.0.16 of nodemailer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.16",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.16"
          }
        }
      ],
      "timestamp": "2026-11-13T22:17:00.046957+00:00",
      "status_notes": "Vulnerability GHSA-268h-hp4c-crq3 does not affect version 10.0.16 of nodemailer. not_affected \u2014 Nodemailer 10.0.16 already contains the upstream fix for GHSA-268h-hp4c-crq3. _getListHeaders in src/mailer/mail-message.ts replaces CR/LF in list.*.comment with a space before building the prepared List-* header value. The fix is upstream commit 5f69497 (author andris@reinman.eu). It is an ancestor of HEAD and is included in release 10.0.16, before any TuxCare commit.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-268h-hp4c-crq3"
      },
      "impact_statement": "not_affected \u2014 Nodemailer 10.0.16 already contains the upstream fix for GHSA-268h-hp4c-crq3. _getListHeaders in src/mailer/mail-message.ts replaces CR/LF in list.*.comment with a space before building the prepared List-* header value. The fix is upstream commit 5f69497 (author andris@reinman.eu). It is an ancestor of HEAD and is included in release 10.0.16, before any TuxCare commit."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.16",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.16"
          }
        }
      ],
      "timestamp": "2026-11-13T22:45:11.501462+00:00",
      "status_notes": "Vulnerability GHSA-2x7j-588g-ccc2 does not affect version 10.0.16 of nodemailer. not_affected \u2014 Target is nodemailer 10.0.16, a plain upstream release. It already contains the upstream fixes for all three quadratic paths from GHSA-2x7j-588g-ccc2. The addressparser accumulator uses in-place push. The display-name merge is a single back-to-front pass. Recipient dedupe uses a Set. The maxRecipients cap exists. The flatten in _parseAddresses no longer uses concat.apply. All fixes are upstream...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-2x7j-588g-ccc2"
      },
      "impact_statement": "not_affected \u2014 Target is nodemailer 10.0.16, a plain upstream release. It already contains the upstream fixes for all three quadratic paths from GHSA-2x7j-588g-ccc2. The addressparser accumulator uses in-place push. The display-name merge is a single back-to-front pass. Recipient dedupe uses a Set. The maxRecipients cap exists. The flatten in _parseAddresses no longer uses concat.apply. All fixes are upstream..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.16",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.16"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-46j5-6fg5-4gv3 is a false positive for nodemailer 10.0.16.",
      "vulnerability": {
        "name": "GHSA-46j5-6fg5-4gv3"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.16",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.16"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-4ffr-jq9g-5ffx affects version 10.0.16 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-4ffr-jq9g-5ffx"
      },
      "action_statement": "Vulnerability GHSA-4ffr-jq9g-5ffx affects version 10.0.16 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.16",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.16"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-4g23-2xm8-66gc affects version 10.0.16 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-4g23-2xm8-66gc"
      },
      "action_statement": "Vulnerability GHSA-4g23-2xm8-66gc affects version 10.0.16 of nodemailer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.16",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.16"
          }
        }
      ],
      "timestamp": "2026-11-13T23:51:00.917323+00:00",
      "status_notes": "Vulnerability GHSA-6vj9-mwq6-2f5v does not affect version 10.0.16 of nodemailer. not_affected \u2014 Target nodemailer 10.0.16 already contains the upstream fix (a6512dbc, \"keep the TLS server name out of the DNS cache\"). The DNS cache stores only addresses. servername is computed per call from the current request's options.servername, so one transport can no longer set another transport's SNI or certificate-verification name.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-6vj9-mwq6-2f5v"
      },
      "impact_statement": "not_affected \u2014 Target nodemailer 10.0.16 already contains the upstream fix (a6512dbc, \"keep the TLS server name out of the DNS cache\"). The DNS cache stores only addresses. servername is computed per call from the current request's options.servername, so one transport can no longer set another transport's SNI or certificate-verification name."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.16",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.16"
          }
        }
      ],
      "timestamp": "2026-10-23T22:01:12.702168+00:00",
      "status_notes": "Vulnerability GHSA-85x2-q946-cp5h affects version 10.0.16 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-85x2-q946-cp5h"
      },
      "action_statement": "Vulnerability GHSA-85x2-q946-cp5h affects version 10.0.16 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.16",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.16"
          }
        }
      ],
      "timestamp": "2026-10-23T22:01:12.702168+00:00",
      "status_notes": "Vulnerability GHSA-8c8m-p3m8-cjg8 affects version 10.0.16 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-8c8m-p3m8-cjg8"
      },
      "action_statement": "Vulnerability GHSA-8c8m-p3m8-cjg8 affects version 10.0.16 of nodemailer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.16",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.16"
          }
        }
      ],
      "timestamp": "2026-11-13T22:32:41.845963+00:00",
      "status_notes": "Vulnerability GHSA-8m3c-c648-2xjj does not affect version 10.0.16 of nodemailer. not_affected \u2014 Target (nodemailer 10.0.16) already contains the upstream fix for GHSA-8m3c-c648-2xjj. MailMessage.resolveContent in src/mailer/mail-message.ts no longer passes its arguments straight through to shared.resolveContent. It normalizes the legacy (data, key, callback) signature and builds a policy from this.data.disableFileAccess/disableUrlAccess OR'd with any explicit options. It passes that polic...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-8m3c-c648-2xjj"
      },
      "impact_statement": "not_affected \u2014 Target (nodemailer 10.0.16) already contains the upstream fix for GHSA-8m3c-c648-2xjj. MailMessage.resolveContent in src/mailer/mail-message.ts no longer passes its arguments straight through to shared.resolveContent. It normalizes the legacy (data, key, callback) signature and builds a policy from this.data.disableFileAccess/disableUrlAccess OR'd with any explicit options. It passes that polic..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.16",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.16"
          }
        }
      ],
      "timestamp": "2026-11-13T23:53:00.038549+00:00",
      "status_notes": "Vulnerability GHSA-8vvx-rff5-p5rq does not affect version 10.0.16 of nodemailer. not_affected \u2014 Target nodemailer 10.0.16 already contains the upstream fix. MimeNode._parseAddresses() flattens nested recipient arrays iteratively with an explicit stack and a WeakSet cycle guard, so nested arrays never reach addressparser()/Tokenizer.toString(). The fix is upstream commit ebe0849 (andris@reinman.eu), which is in the upstream release; the history contains no TuxCare-domain commit.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-8vvx-rff5-p5rq"
      },
      "impact_statement": "not_affected \u2014 Target nodemailer 10.0.16 already contains the upstream fix. MimeNode._parseAddresses() flattens nested recipient arrays iteratively with an explicit stack and a WeakSet cycle guard, so nested arrays never reach addressparser()/Tokenizer.toString(). The fix is upstream commit ebe0849 (andris@reinman.eu), which is in the upstream release; the history contains no TuxCare-domain commit."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.16",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.16"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-9h6g-pr28-7cqp affects version 10.0.16 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-9h6g-pr28-7cqp"
      },
      "action_statement": "Vulnerability GHSA-9h6g-pr28-7cqp affects version 10.0.16 of nodemailer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.16",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.16"
          }
        }
      ],
      "timestamp": "2026-11-13T22:09:00.042716+00:00",
      "status_notes": "Vulnerability GHSA-c7w3-x93f-qmm8 does not affect version 10.0.16 of nodemailer. not_affected \u2014 The target (nodemailer 10.0.16, TypeScript source) already contains the upstream fix. In src/smtp-connection/index.ts the MAIL FROM SIZE argument is coerced with Number() and only appended if positive, so CRLF in envelope.size cannot reach the SMTP command line. The fix is upstream commit 2d7b971 by andris@reinman.eu, which is an ancestor of HEAD. The only commit above it is a tuxcare.yaml buil...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-c7w3-x93f-qmm8"
      },
      "impact_statement": "not_affected \u2014 The target (nodemailer 10.0.16, TypeScript source) already contains the upstream fix. In src/smtp-connection/index.ts the MAIL FROM SIZE argument is coerced with Number() and only appended if positive, so CRLF in envelope.size cannot reach the SMTP command line. The fix is upstream commit 2d7b971 by andris@reinman.eu, which is an ancestor of HEAD. The only commit above it is a tuxcare.yaml buil..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.16",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.16"
          }
        }
      ],
      "timestamp": "2026-11-13T22:57:00.061178+00:00",
      "status_notes": "Vulnerability GHSA-cc9r-2j5m-2m83 does not affect version 10.0.16 of nodemailer. not_affected \u2014 Target (nodemailer 10.0.16) already contains the upstream fix 902b63e (\"terminate the domain at an RFC 5322 comment\"). In src/addressparser/index.ts _handleAddress, a token after a closing \")\" is joined to the previous token only if the accumulated run ends in \"@\" or the new token starts with \"@\". So user@good-corp.com(x)evil.com no longer becomes good-corp.comevil.com. The fix shipped in the u...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-cc9r-2j5m-2m83"
      },
      "impact_statement": "not_affected \u2014 Target (nodemailer 10.0.16) already contains the upstream fix 902b63e (\"terminate the domain at an RFC 5322 comment\"). In src/addressparser/index.ts _handleAddress, a token after a closing \")\" is joined to the previous token only if the accumulated run ends in \"@\" or the new token starts with \"@\". So user@good-corp.com(x)evil.com no longer becomes good-corp.comevil.com. The fix shipped in the u..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.16",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.16"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-frj6-5rhh-vwfw is a false positive for nodemailer 10.0.16.",
      "vulnerability": {
        "name": "GHSA-frj6-5rhh-vwfw"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.16",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.16"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-g57g-f23g-4646 affects version 10.0.16 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-g57g-f23g-4646"
      },
      "action_statement": "Vulnerability GHSA-g57g-f23g-4646 affects version 10.0.16 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.16",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.16"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-g73g-hqqh-jr95 affects version 10.0.16 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-g73g-hqqh-jr95"
      },
      "action_statement": "Vulnerability GHSA-g73g-hqqh-jr95 affects version 10.0.16 of nodemailer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.16",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.16"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-h3hj-cmcx-xc66 is a false positive for nodemailer 10.0.16.",
      "vulnerability": {
        "name": "GHSA-h3hj-cmcx-xc66"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.16",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.16"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-jj37-3377-m6vv is a false positive for nodemailer 10.0.16.",
      "vulnerability": {
        "name": "GHSA-jj37-3377-m6vv"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.16",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.16"
          }
        }
      ],
      "timestamp": "2026-10-23T22:01:49.029239+00:00",
      "status_notes": "Vulnerability GHSA-m943-m63m-w62w affects version 10.0.16 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-m943-m63m-w62w"
      },
      "action_statement": "Vulnerability GHSA-m943-m63m-w62w affects version 10.0.16 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.16",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.16"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-v53p-9fqp-m79j affects version 10.0.16 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-v53p-9fqp-m79j"
      },
      "action_statement": "Vulnerability GHSA-v53p-9fqp-m79j affects version 10.0.16 of nodemailer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.16",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.16"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-vm5r-23w9-m8hx is a false positive for nodemailer 10.0.16.",
      "vulnerability": {
        "name": "GHSA-vm5r-23w9-m8hx"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.16",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.16"
          }
        }
      ],
      "timestamp": "2026-11-13T22:09:49.702960+00:00",
      "status_notes": "Vulnerability GHSA-vvjj-xcjg-gr5g does not affect version 10.0.16 of nodemailer. not_affected \u2014 Target nodemailer 10.0.16 already contains the upstream fix for GHSA-vvjj-xcjg-gr5g. src/smtp-connection/index.ts:649 strips CR/LF from the transport `name` option before it is used in the LHLO/EHLO/HELO commands. The fix is upstream commit 0a43876 by andris@reinman.eu, which is an ancestor of HEAD, and HEAD's history contains no TuxCare-authored commit.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-vvjj-xcjg-gr5g"
      },
      "impact_statement": "not_affected \u2014 Target nodemailer 10.0.16 already contains the upstream fix for GHSA-vvjj-xcjg-gr5g. src/smtp-connection/index.ts:649 strips CR/LF from the transport `name` option before it is used in the LHLO/EHLO/HELO commands. The fix is upstream commit 0a43876 by andris@reinman.eu, which is an ancestor of HEAD, and HEAD's history contains no TuxCare-authored commit."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.16",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.16"
          }
        }
      ],
      "timestamp": "2026-11-13T23:05:15.656839+00:00",
      "status_notes": "Vulnerability GHSA-wmmp-3585-3rmp does not affect version 10.0.16 of nodemailer. not_affected \u2014 Nodemailer 10.0.16 already contains the upstream fixes for GHSA-wmmp-3585-3rmp. Recipient domains are mapped with UTS-46 (url.domainToASCII/domainToUnicode) before Punycode encoding. Host-terminating characters are kept away from the mapper. Both fix commits are authored by the upstream maintainer, and HEAD has no TuxCare-authored commits, so the fix shipped in the upstream release.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-wmmp-3585-3rmp"
      },
      "impact_statement": "not_affected \u2014 Nodemailer 10.0.16 already contains the upstream fixes for GHSA-wmmp-3585-3rmp. Recipient domains are mapped with UTS-46 (url.domainToASCII/domainToUnicode) before Punycode encoding. Host-terminating characters are kept away from the mapper. Both fix commits are authored by the upstream maintainer, and HEAD has no TuxCare-authored commits, so the fix shipped in the upstream release."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.16",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.16"
          }
        }
      ],
      "timestamp": "2026-11-13T22:16:11.634814+00:00",
      "status_notes": "Vulnerability GHSA-wqvq-jvpq-h66f does not affect version 10.0.16 of nodemailer. not_affected \u2014 nodemailer 10.0.16 already enforces disableFileAccess/disableUrlAccess in the pre-resolution path. shared.resolveContent takes an access-policy argument and rejects URL and file content with EURLACCESS/EFILEACCESS before nmfetch or fs.createReadStream runs. MailMessage.resolveContent, resolveAll (the jsonTransport normalize path) and _convertDataImages (attachDataUrls) all pass the message's fl...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-wqvq-jvpq-h66f"
      },
      "impact_statement": "not_affected \u2014 nodemailer 10.0.16 already enforces disableFileAccess/disableUrlAccess in the pre-resolution path. shared.resolveContent takes an access-policy argument and rejects URL and file content with EURLACCESS/EFILEACCESS before nmfetch or fs.createReadStream runs. MailMessage.resolveContent, resolveAll (the jsonTransport normalize path) and _convertDataImages (attachDataUrls) all pass the message's fl..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.16",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.16"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-wxxx-r42m-9rp8 is a false positive for nodemailer 10.0.16.",
      "vulnerability": {
        "name": "GHSA-wxxx-r42m-9rp8"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}