{ "@id": "urn:uuid:081f8eed-bf93-489d-a205-da0d02bf73b5", "role": "Document Creator", "author": "https://tuxcare.com", "version": 26, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-13T23:51:19.449689+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.9", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.9" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2020-7769 affects version 10.0.9 of nodemailer.", "vulnerability": { "name": "CVE-2020-7769" }, "action_statement": "Vulnerability CVE-2020-7769 affects version 10.0.9 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.9", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.9" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2021-23400 affects version 10.0.9 of nodemailer.", "vulnerability": { "name": "CVE-2021-23400" }, "action_statement": "Vulnerability CVE-2021-23400 affects version 10.0.9 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.9", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.9" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2025-13033 affects version 10.0.9 of nodemailer.", "vulnerability": { "name": "CVE-2025-13033" }, "action_statement": "Vulnerability CVE-2025-13033 affects version 10.0.9 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.9", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.9" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2025-14874 affects version 10.0.9 of nodemailer.", "vulnerability": { "name": "CVE-2025-14874" }, "action_statement": "Vulnerability CVE-2025-14874 affects version 10.0.9 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.9", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.9" } } ], "timestamp": "2026-10-15T15:49:00.133726+00:00", "status_notes": "Vulnerability CVE-2026-110869 affects version 10.0.9 of nodemailer.", "vulnerability": { "name": "CVE-2026-110869" }, "action_statement": "Vulnerability CVE-2026-110869 affects version 10.0.9 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.9", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.9" } } ], "timestamp": "2026-10-26T15:35:33.946658+00:00", "status_notes": "Vulnerability CVE-2026-110870 affects version 10.0.9 of nodemailer.", "vulnerability": { "name": "CVE-2026-110870" }, "action_statement": "Vulnerability CVE-2026-110870 affects version 10.0.9 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.9", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.9" } } ], "timestamp": "2026-10-20T02:47:06.846725+00:00", "status_notes": "Vulnerability CVE-2026-110871 affects version 10.0.9 of nodemailer.", "vulnerability": { "name": "CVE-2026-110871" }, "action_statement": "Vulnerability CVE-2026-110871 affects version 10.0.9 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.9", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.9" } } ], "timestamp": "2026-10-15T14:52:00.136801+00:00", "status_notes": "Vulnerability CVE-2026-110872 affects version 10.0.9 of nodemailer.", "vulnerability": { "name": "CVE-2026-110872" }, "action_statement": "Vulnerability CVE-2026-110872 affects version 10.0.9 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.9", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.9" } } ], "timestamp": "2026-11-03T14:36:48.497569+00:00", "status_notes": "Vulnerability CVE-2026-121424 affects version 10.0.9 of nodemailer.", "vulnerability": { "name": "CVE-2026-121424" }, "action_statement": "Vulnerability CVE-2026-121424 affects version 10.0.9 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.9", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.9" } } ], "timestamp": "2026-11-03T14:36:48.497569+00:00", "status_notes": "Vulnerability CVE-2026-121425 affects version 10.0.9 of nodemailer.", "vulnerability": { "name": "CVE-2026-121425" }, "action_statement": "Vulnerability CVE-2026-121425 affects version 10.0.9 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.9", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.9" } } ], "timestamp": "2026-11-03T14:36:48.497569+00:00", "status_notes": "Vulnerability CVE-2026-121426 affects version 10.0.9 of nodemailer.", "vulnerability": { "name": "CVE-2026-121426" }, "action_statement": "Vulnerability CVE-2026-121426 affects version 10.0.9 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.9", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.9" } } ], "timestamp": "2026-11-10T15:30:00.075367+00:00", "status_notes": "Vulnerability CVE-2026-125755 affects version 10.0.9 of nodemailer.", "vulnerability": { "name": "CVE-2026-125755" }, "action_statement": "Vulnerability CVE-2026-125755 affects version 10.0.9 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.9", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.9" } } ], "timestamp": "2026-11-13T22:31:00.045181+00:00", "status_notes": "Vulnerability CVE-2026-82659 does not affect version 10.0.9 of nodemailer. not_affected \u2014 Target (nodemailer 10.0.9, TypeScript source under src/) already contains the upstream fix a82e060: MailComposer.compile() passes disableUrlAccess/disableFileAccess to the raw-message root MimeNode, so MimeNode's access checks reject raw {path}/{href} content when the flags are set. The fix shipped in the upstream release; HEAD has no TuxCare-domain commits.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-82659" }, "impact_statement": "not_affected \u2014 Target (nodemailer 10.0.9, TypeScript source under src/) already contains the upstream fix a82e060: MailComposer.compile() passes disableUrlAccess/disableFileAccess to the raw-message root MimeNode, so MimeNode's access checks reject raw {path}/{href} content when the flags are set. The fix shipped in the upstream release; HEAD has no TuxCare-domain commits." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.9", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.9" } } ], "timestamp": "2026-11-13T23:16:05.427829+00:00", "status_notes": "Vulnerability CVE-2026-82662 does not affect version 10.0.9 of nodemailer. not_affected \u2014 Target is nodemailer 10.0.9. The internal fetch client no longer disables TLS verification: src/fetch/index.ts sets rejectUnauthorized: true by default, and the OAuth2 token fetch pins it to true. The upstream fix, 6a947ac (\"fix!: validate TLS certificates by default when fetching remote content\"), shipped in 9.0.0 and is in the upstream release that HEAD is built on.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-82662" }, "impact_statement": "not_affected \u2014 Target is nodemailer 10.0.9. The internal fetch client no longer disables TLS verification: src/fetch/index.ts sets rejectUnauthorized: true by default, and the OAuth2 token fetch pins it to true. The upstream fix, 6a947ac (\"fix!: validate TLS certificates by default when fetching remote content\"), shipped in 9.0.0 and is in the upstream release that HEAD is built on." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.9", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.9" } } ], "timestamp": "2026-11-13T23:28:00.053366+00:00", "status_notes": "Vulnerability CVE-2026-82854 does not affect version 10.0.9 of nodemailer. not_affected \u2014 Nodemailer 10.0.9 already contains the upstream fix for CVE-2026-82854. The fix is commit 2d7b971 (\"fix: sanitize envelope size to prevent SMTP command injection\") by Andris Reinman. In src/smtp-connection/index.ts, envelope.size is coerced with Number() and appended as SIZE= only when the result is a positive number, so CRLF cannot reach the MAIL FROM line. The fix shipped in the upstream rele...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-82854" }, "impact_statement": "not_affected \u2014 Nodemailer 10.0.9 already contains the upstream fix for CVE-2026-82854. The fix is commit 2d7b971 (\"fix: sanitize envelope size to prevent SMTP command injection\") by Andris Reinman. In src/smtp-connection/index.ts, envelope.size is coerced with Number() and appended as SIZE= only when the result is a positive number, so CRLF cannot reach the MAIL FROM line. The fix shipped in the upstream rele..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.9", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.9" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2026-90776 affects version 10.0.9 of nodemailer.", "vulnerability": { "name": "CVE-2026-90776" }, "action_statement": "Vulnerability CVE-2026-90776 affects version 10.0.9 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.9", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.9" } } ], "timestamp": "2026-11-13T22:18:00.036497+00:00", "status_notes": "Vulnerability GHSA-268h-hp4c-crq3 does not affect version 10.0.9 of nodemailer. not_affected \u2014 Target (nodemailer 10.0.9) already strips CR/LF from list.*.comment before building the prepared List-* header values. This is the upstream fix (commit 5f69497, author andris@reinman.eu), which shipped in the upstream release. HEAD has no TuxCare-domain commits.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-268h-hp4c-crq3" }, "impact_statement": "not_affected \u2014 Target (nodemailer 10.0.9) already strips CR/LF from list.*.comment before building the prepared List-* header values. This is the upstream fix (commit 5f69497, author andris@reinman.eu), which shipped in the upstream release. HEAD has no TuxCare-domain commits." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.9", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.9" } } ], "timestamp": "2026-11-13T22:42:00.042020+00:00", "status_notes": "Vulnerability GHSA-2x7j-588g-ccc2 does not affect version 10.0.9 of nodemailer. not_affected \u2014 Target nodemailer 10.0.9 already contains the upstream fixes for all three quadratic paths in GHSA-2x7j-588g-ccc2. The addressparser accumulator, the display-name merge loop, and the recipient dedupe in MimeNode are now linear. The fixes shipped in the upstream release and were authored by upstream (andris@reinman.eu). HEAD has no TuxCare-authored commit in its history.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-2x7j-588g-ccc2" }, "impact_statement": "not_affected \u2014 Target nodemailer 10.0.9 already contains the upstream fixes for all three quadratic paths in GHSA-2x7j-588g-ccc2. The addressparser accumulator, the display-name merge loop, and the recipient dedupe in MimeNode are now linear. The fixes shipped in the upstream release and were authored by upstream (andris@reinman.eu). HEAD has no TuxCare-authored commit in its history." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.9", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.9" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-46j5-6fg5-4gv3 is a false positive for nodemailer 10.0.9.", "vulnerability": { "name": "GHSA-46j5-6fg5-4gv3" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.9", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.9" } } ], "timestamp": "2026-10-27T15:13:32.414812+00:00", "status_notes": "Vulnerability GHSA-4ffr-jq9g-5ffx affects version 10.0.9 of nodemailer.", "vulnerability": { "name": "GHSA-4ffr-jq9g-5ffx" }, "action_statement": "Vulnerability GHSA-4ffr-jq9g-5ffx affects version 10.0.9 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.9", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.9" } } ], "timestamp": "2026-10-27T15:13:32.414812+00:00", "status_notes": "Vulnerability GHSA-4g23-2xm8-66gc affects version 10.0.9 of nodemailer.", "vulnerability": { "name": "GHSA-4g23-2xm8-66gc" }, "action_statement": "Vulnerability GHSA-4g23-2xm8-66gc affects version 10.0.9 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.9", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.9" } } ], "timestamp": "2026-11-13T23:50:38.012686+00:00", "status_notes": "Vulnerability GHSA-6vj9-mwq6-2f5v does not affect version 10.0.9 of nodemailer. not_affected \u2014 Target (nodemailer 10.0.9) already contains the upstream fix a6512db \"fix(shared): keep the TLS server name out of the DNS cache\". The DNS cache stores only addresses. servername is computed per call from the current caller's options, so one transport can no longer inject its TLS server name into another transport's connection.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6vj9-mwq6-2f5v" }, "impact_statement": "not_affected \u2014 Target (nodemailer 10.0.9) already contains the upstream fix a6512db \"fix(shared): keep the TLS server name out of the DNS cache\". The DNS cache stores only addresses. servername is computed per call from the current caller's options, so one transport can no longer inject its TLS server name into another transport's connection." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.9", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.9" } } ], "timestamp": "2026-10-23T22:01:00.144162+00:00", "status_notes": "Vulnerability GHSA-85x2-q946-cp5h affects version 10.0.9 of nodemailer.", "vulnerability": { "name": "GHSA-85x2-q946-cp5h" }, "action_statement": "Vulnerability GHSA-85x2-q946-cp5h affects version 10.0.9 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.9", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.9" } } ], "timestamp": "2026-10-23T22:01:00.144162+00:00", "status_notes": "Vulnerability GHSA-8c8m-p3m8-cjg8 affects version 10.0.9 of nodemailer.", "vulnerability": { "name": "GHSA-8c8m-p3m8-cjg8" }, "action_statement": "Vulnerability GHSA-8c8m-p3m8-cjg8 affects version 10.0.9 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.9", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.9" } } ], "timestamp": "2026-11-13T22:32:00.034202+00:00", "status_notes": "Vulnerability GHSA-8m3c-c648-2xjj does not affect version 10.0.9 of nodemailer. not_affected \u2014 Not affected. The target (nodemailer 10.0.9, TypeScript source) already contains the upstream fix. MailMessage.resolveContent now folds the message-level disableFileAccess/disableUrlAccess flags into the policy passed to shared.resolveContent, including for the legacy (data, key, callback) signature. The fix commits dc48ed3 and ab7ef34 are authored and committed by upstream (andris@reinman.eu) ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-8m3c-c648-2xjj" }, "impact_statement": "not_affected \u2014 Not affected. The target (nodemailer 10.0.9, TypeScript source) already contains the upstream fix. MailMessage.resolveContent now folds the message-level disableFileAccess/disableUrlAccess flags into the policy passed to shared.resolveContent, including for the legacy (data, key, callback) signature. The fix commits dc48ed3 and ab7ef34 are authored and committed by upstream (andris@reinman.eu) ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.9", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.9" } } ], "timestamp": "2026-11-13T23:51:19.449689+00:00", "status_notes": "Vulnerability GHSA-8vvx-rff5-p5rq does not affect version 10.0.9 of nodemailer. not_affected \u2014 Target is nodemailer 10.0.9, which already contains the upstream fix (commit ebe0849, \"flatten nested recipient arrays without recursion\", shipped in 10.0.2). MimeNode._parseAddresses now flattens nested arrays iteratively with an explicit stack and a WeakSet cycle guard, so deeply nested arrays never reach addressparser/Tokenizer.toString().", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-8vvx-rff5-p5rq" }, "impact_statement": "not_affected \u2014 Target is nodemailer 10.0.9, which already contains the upstream fix (commit ebe0849, \"flatten nested recipient arrays without recursion\", shipped in 10.0.2). MimeNode._parseAddresses now flattens nested arrays iteratively with an explicit stack and a WeakSet cycle guard, so deeply nested arrays never reach addressparser/Tokenizer.toString()." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.9", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.9" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-9h6g-pr28-7cqp affects version 10.0.9 of nodemailer.", "vulnerability": { "name": "GHSA-9h6g-pr28-7cqp" }, "action_statement": "Vulnerability GHSA-9h6g-pr28-7cqp affects version 10.0.9 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.9", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.9" } } ], "timestamp": "2026-11-13T22:08:24.214185+00:00", "status_notes": "Vulnerability GHSA-c7w3-x93f-qmm8 does not affect version 10.0.9 of nodemailer. not_affected \u2014 Not affected. In nodemailer 10.0.9, src/smtp-connection/index.ts coerces envelope.size with Number() and only appends 'SIZE=' + the resulting number (when > 0) to MAIL FROM. A CRLF-bearing size string becomes NaN, then 0, and is dropped. The vulnerable raw concatenation of 'SIZE=' + envelope.size is not present. This coercion has been in the code since the upstream TypeScript migration, before ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-c7w3-x93f-qmm8" }, "impact_statement": "not_affected \u2014 Not affected. In nodemailer 10.0.9, src/smtp-connection/index.ts coerces envelope.size with Number() and only appends 'SIZE=' + the resulting number (when > 0) to MAIL FROM. A CRLF-bearing size string becomes NaN, then 0, and is dropped. The vulnerable raw concatenation of 'SIZE=' + envelope.size is not present. This coercion has been in the code since the upstream TypeScript migration, before ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.9", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.9" } } ], "timestamp": "2026-11-13T22:58:00.049762+00:00", "status_notes": "Vulnerability GHSA-cc9r-2j5m-2m83 does not affect version 10.0.9 of nodemailer. not_affected \u2014 The target (nodemailer 10.0.9) already contains the upstream fix for GHSA-cc9r-2j5m-2m83. In src/addressparser/index.ts, _handleAddress no longer glues the token after a comment-closing ')' onto the preceding token unless one side carries the '@'. So user@good-corp.com(x)evil.com yields address user@good-corp.com, not good-corp.comevil.com. The fix is upstream commit 902b63e (author andris@rein...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-cc9r-2j5m-2m83" }, "impact_statement": "not_affected \u2014 The target (nodemailer 10.0.9) already contains the upstream fix for GHSA-cc9r-2j5m-2m83. In src/addressparser/index.ts, _handleAddress no longer glues the token after a comment-closing ')' onto the preceding token unless one side carries the '@'. So user@good-corp.com(x)evil.com yields address user@good-corp.com, not good-corp.comevil.com. The fix is upstream commit 902b63e (author andris@rein..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.9", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.9" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-frj6-5rhh-vwfw is a false positive for nodemailer 10.0.9.", "vulnerability": { "name": "GHSA-frj6-5rhh-vwfw" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.9", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.9" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-g57g-f23g-4646 affects version 10.0.9 of nodemailer.", "vulnerability": { "name": "GHSA-g57g-f23g-4646" }, "action_statement": "Vulnerability GHSA-g57g-f23g-4646 affects version 10.0.9 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.9", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.9" } } ], "timestamp": "2026-10-27T15:13:36.008785+00:00", "status_notes": "Vulnerability GHSA-g73g-hqqh-jr95 affects version 10.0.9 of nodemailer.", "vulnerability": { "name": "GHSA-g73g-hqqh-jr95" }, "action_statement": "Vulnerability GHSA-g73g-hqqh-jr95 affects version 10.0.9 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.9", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.9" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-h3hj-cmcx-xc66 is a false positive for nodemailer 10.0.9.", "vulnerability": { "name": "GHSA-h3hj-cmcx-xc66" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.9", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.9" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-jj37-3377-m6vv is a false positive for nodemailer 10.0.9.", "vulnerability": { "name": "GHSA-jj37-3377-m6vv" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.9", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.9" } } ], "timestamp": "2026-10-23T22:01:49.029239+00:00", "status_notes": "Vulnerability GHSA-m943-m63m-w62w affects version 10.0.9 of nodemailer.", "vulnerability": { "name": "GHSA-m943-m63m-w62w" }, "action_statement": "Vulnerability GHSA-m943-m63m-w62w affects version 10.0.9 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.9", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.9" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-v53p-9fqp-m79j affects version 10.0.9 of nodemailer.", "vulnerability": { "name": "GHSA-v53p-9fqp-m79j" }, "action_statement": "Vulnerability GHSA-v53p-9fqp-m79j affects version 10.0.9 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.9", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.9" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-vm5r-23w9-m8hx is a false positive for nodemailer 10.0.9.", "vulnerability": { "name": "GHSA-vm5r-23w9-m8hx" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.9", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.9" } } ], "timestamp": "2026-11-13T22:09:23.418068+00:00", "status_notes": "Vulnerability GHSA-vvjj-xcjg-gr5g does not affect version 10.0.9 of nodemailer. not_affected \u2014 Target is nodemailer 10.0.9 (TypeScript sources). src/smtp-connection/index.ts:567 already strips CR/LF from the transport `name` option before it is used in EHLO/HELO/LHLO. This is the upstream fix for GHSA-vvjj-xcjg-gr5g (commit 0a43876), authored by Andris Reinman and shipped in the upstream release. The SMTP command injection is not present.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-vvjj-xcjg-gr5g" }, "impact_statement": "not_affected \u2014 Target is nodemailer 10.0.9 (TypeScript sources). src/smtp-connection/index.ts:567 already strips CR/LF from the transport `name` option before it is used in EHLO/HELO/LHLO. This is the upstream fix for GHSA-vvjj-xcjg-gr5g (commit 0a43876), authored by Andris Reinman and shipped in the upstream release. The SMTP command injection is not present." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.9", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.9" } } ], "timestamp": "2026-11-13T23:05:15.656839+00:00", "status_notes": "Vulnerability GHSA-wmmp-3585-3rmp does not affect version 10.0.9 of nodemailer. not_affected \u2014 Target is nodemailer 10.0.9, which is newer than the 9.1.0 fix for GHSA-wmmp-3585-3rmp. src/mime-node/index.ts already contains the upstream fix: _normalizeAddress calls normalizeDomain(), which uses url.domainToASCII/domainToUnicode (UTS-46 mapping). Characters that end a host or break URL parsing are kept away from the mapper by URL_PARSER_UNSAFE. The fix is upstream-authored (andris@reinman....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wmmp-3585-3rmp" }, "impact_statement": "not_affected \u2014 Target is nodemailer 10.0.9, which is newer than the 9.1.0 fix for GHSA-wmmp-3585-3rmp. src/mime-node/index.ts already contains the upstream fix: _normalizeAddress calls normalizeDomain(), which uses url.domainToASCII/domainToUnicode (UTS-46 mapping). Characters that end a host or break URL parsing are kept away from the mapper by URL_PARSER_UNSAFE. The fix is upstream-authored (andris@reinman...." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.9", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.9" } } ], "timestamp": "2026-11-13T22:15:08.551507+00:00", "status_notes": "Vulnerability GHSA-wqvq-jvpq-h66f does not affect version 10.0.9 of nodemailer. not_affected \u2014 Target (nodemailer 10.0.9, TypeScript) already contains the upstream fix for GHSA-wqvq-jvpq-h66f. shared.resolveContent() takes an access policy and rejects URL/file content with EURLACCESS/EFILEACCESS. jsonTransport (resolveAll) and attachDataUrls (_convertDataImages) both pass the policy. The fix is upstream commit 5f69497 (author andris@reinman.eu, committer noreply@github.com), an ancestor ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wqvq-jvpq-h66f" }, "impact_statement": "not_affected \u2014 Target (nodemailer 10.0.9, TypeScript) already contains the upstream fix for GHSA-wqvq-jvpq-h66f. shared.resolveContent() takes an access policy and rejects URL/file content with EURLACCESS/EFILEACCESS. jsonTransport (resolveAll) and attachDataUrls (_convertDataImages) both pass the policy. The fix is upstream commit 5f69497 (author andris@reinman.eu, committer noreply@github.com), an ancestor ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.9", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.9" } } ], "timestamp": "2026-10-22T17:05:00.556684+00:00", "status_notes": "Vulnerability GHSA-wxxx-r42m-9rp8 is a false positive for nodemailer 10.0.9.", "vulnerability": { "name": "GHSA-wxxx-r42m-9rp8" }, "impact_statement": "The vulnerability has been withdrawn." } ] }