{ "@id": "urn:uuid:4108c2ae-7798-4406-b04e-c98d2c0b5b77", "role": "Document Creator", "author": "https://tuxcare.com", "version": 36, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-11T10:39:00.112295+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.2", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.2" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2020-7769 affects version 9.0.2 of nodemailer.", "vulnerability": { "name": "CVE-2020-7769" }, "action_statement": "Vulnerability CVE-2020-7769 affects version 9.0.2 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.2", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.2" } } ], "timestamp": "2026-11-03T17:15:39.453186+00:00", "status_notes": "Vulnerability CVE-2021-23400 does not affect version 9.0.2 of nodemailer. not_affected \u2014 The target nodemailer 9.0.2-tuxcare.8 is NOT AFFECTED by CVE-2021-23400. The vulnerability (HTTP Header Injection via unsanitized newlines/carriage returns in email addresses) was fixed in upstream v6.6.1 (May 2021) by commit 7e02648cc8cd863f5085bad3cd09087bccf84b9f. This fix is present in the target at lib/mime-node/index.js:1341, where control characters (0x00-0x1F) and angle brackets are str...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-23400" }, "impact_statement": "not_affected \u2014 The target nodemailer 9.0.2-tuxcare.8 is NOT AFFECTED by CVE-2021-23400. The vulnerability (HTTP Header Injection via unsanitized newlines/carriage returns in email addresses) was fixed in upstream v6.6.1 (May 2021) by commit 7e02648cc8cd863f5085bad3cd09087bccf84b9f. This fix is present in the target at lib/mime-node/index.js:1341, where control characters (0x00-0x1F) and angle brackets are str..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.2", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.2" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2025-13033 affects version 9.0.2 of nodemailer.", "vulnerability": { "name": "CVE-2025-13033" }, "action_statement": "Vulnerability CVE-2025-13033 affects version 9.0.2 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.2", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.2" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2025-14874 affects version 9.0.2 of nodemailer.", "vulnerability": { "name": "CVE-2025-14874" }, "action_statement": "Vulnerability CVE-2025-14874 affects version 9.0.2 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.2", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.2" } } ], "timestamp": "2026-10-16T00:39:00.156743+00:00", "status_notes": "Vulnerability CVE-2026-100701 affects version 9.0.2 of nodemailer, and is fixed in 9.0.2-tuxcare.3.", "vulnerability": { "name": "CVE-2026-100701" }, "action_statement": "Vulnerability CVE-2026-100701 affects version 9.0.2 of nodemailer, and is fixed in 9.0.2-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.2", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.2" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2026-110869 affects version 9.0.2 of nodemailer, and is fixed in 9.0.2-tuxcare.4.", "vulnerability": { "name": "CVE-2026-110869" }, "action_statement": "Vulnerability CVE-2026-110869 affects version 9.0.2 of nodemailer, and is fixed in 9.0.2-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.2", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.2" } } ], "timestamp": "2026-10-28T17:44:00.090347+00:00", "status_notes": "Vulnerability CVE-2026-110870 affects version 9.0.2 of nodemailer, and is fixed in 9.0.2-tuxcare.8.", "vulnerability": { "name": "CVE-2026-110870" }, "action_statement": "Vulnerability CVE-2026-110870 affects version 9.0.2 of nodemailer, and is fixed in 9.0.2-tuxcare.8." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.2", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.2" } } ], "timestamp": "2026-10-20T15:12:00.074992+00:00", "status_notes": "Vulnerability CVE-2026-110871 affects version 9.0.2 of nodemailer, and is fixed in 9.0.2-tuxcare.5.", "vulnerability": { "name": "CVE-2026-110871" }, "action_statement": "Vulnerability CVE-2026-110871 affects version 9.0.2 of nodemailer, and is fixed in 9.0.2-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.2", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.2" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2026-110872 affects version 9.0.2 of nodemailer, and is fixed in 9.0.2-tuxcare.4.", "vulnerability": { "name": "CVE-2026-110872" }, "action_statement": "Vulnerability CVE-2026-110872 affects version 9.0.2 of nodemailer, and is fixed in 9.0.2-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.2", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.2" } } ], "timestamp": "2026-11-03T14:36:48.497569+00:00", "status_notes": "Vulnerability CVE-2026-121424 affects version 9.0.2 of nodemailer.", "vulnerability": { "name": "CVE-2026-121424" }, "action_statement": "Vulnerability CVE-2026-121424 affects version 9.0.2 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.2", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.2" } } ], "timestamp": "2026-11-03T14:36:48.497569+00:00", "status_notes": "Vulnerability CVE-2026-121425 affects version 9.0.2 of nodemailer.", "vulnerability": { "name": "CVE-2026-121425" }, "action_statement": "Vulnerability CVE-2026-121425 affects version 9.0.2 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.2", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.2" } } ], "timestamp": "2026-11-03T14:36:48.497569+00:00", "status_notes": "Vulnerability CVE-2026-121426 affects version 9.0.2 of nodemailer.", "vulnerability": { "name": "CVE-2026-121426" }, "action_statement": "Vulnerability CVE-2026-121426 affects version 9.0.2 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.2", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.2" } } ], "timestamp": "2026-11-11T10:39:00.112295+00:00", "status_notes": "Vulnerability CVE-2026-125755 affects version 9.0.2 of nodemailer, and is fixed in 9.0.2-tuxcare.10.", "vulnerability": { "name": "CVE-2026-125755" }, "action_statement": "Vulnerability CVE-2026-125755 affects version 9.0.2 of nodemailer, and is fixed in 9.0.2-tuxcare.10." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.2", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.2" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2026-82659 affects version 9.0.2 of nodemailer.", "vulnerability": { "name": "CVE-2026-82659" }, "action_statement": "Vulnerability CVE-2026-82659 affects version 9.0.2 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.2", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.2" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2026-82662 affects version 9.0.2 of nodemailer.", "vulnerability": { "name": "CVE-2026-82662" }, "action_statement": "Vulnerability CVE-2026-82662 affects version 9.0.2 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.2", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.2" } } ], "timestamp": "2026-11-03T22:35:00.141426+00:00", "status_notes": "Vulnerability CVE-2026-82854 does not affect version 9.0.2 of nodemailer. not_affected \u2014 The target nodemailer 9.0.2-tuxcare.8 is NOT AFFECTED by CVE-2026-82854. The vulnerability (SMTP command injection via unsanitized envelope.size parameter containing CRLF characters) was fixed in upstream version 8.0.4 by commit 2d7b9710e63555a1eb13d721296c51186d4b5651 authored by Andris Reinman. The fix converts envelope.size to a Number before concatenating it into SMTP commands, eliminating ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-82854" }, "impact_statement": "not_affected \u2014 The target nodemailer 9.0.2-tuxcare.8 is NOT AFFECTED by CVE-2026-82854. The vulnerability (SMTP command injection via unsanitized envelope.size parameter containing CRLF characters) was fixed in upstream version 8.0.4 by commit 2d7b9710e63555a1eb13d721296c51186d4b5651 authored by Andris Reinman. The fix converts envelope.size to a Number before concatenating it into SMTP commands, eliminating ..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.2", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.2" } } ], "timestamp": "2026-11-11T10:39:00.112295+00:00", "status_notes": "Vulnerability CVE-2026-90776 affects version 9.0.2 of nodemailer, and is fixed in 9.0.2-tuxcare.10.", "vulnerability": { "name": "CVE-2026-90776" }, "action_statement": "Vulnerability CVE-2026-90776 affects version 9.0.2 of nodemailer, and is fixed in 9.0.2-tuxcare.10." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.2", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.2" } } ], "timestamp": "2026-10-12T14:24:00.043783+00:00", "status_notes": "Vulnerability CVE-2026-92596 affects version 9.0.2 of nodemailer, and is fixed in 9.0.2-tuxcare.1.", "vulnerability": { "name": "CVE-2026-92596" }, "action_statement": "Vulnerability CVE-2026-92596 affects version 9.0.2 of nodemailer, and is fixed in 9.0.2-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.2", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.2" } } ], "timestamp": "2026-10-16T00:39:00.156743+00:00", "status_notes": "Vulnerability CVE-2026-92598 affects version 9.0.2 of nodemailer, and is fixed in 9.0.2-tuxcare.3.", "vulnerability": { "name": "CVE-2026-92598" }, "action_statement": "Vulnerability CVE-2026-92598 affects version 9.0.2 of nodemailer, and is fixed in 9.0.2-tuxcare.3." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.2", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.2" } } ], "timestamp": "2026-11-03T17:13:05.282153+00:00", "status_notes": "Vulnerability GHSA-268h-hp4c-crq3 does not affect version 9.0.2 of nodemailer. not_affected \u2014 The target repository (nodemailer 9.0.2-tuxcare.8 at commit b49c605) is not affected by GHSA-268h-hp4c-crq3 (List-* header CRLF injection). The vulnerability pattern is absent because the upstream fix by Andris Reinman (commit 5f69497) was already present in the upstream release that TuxCare onboarded. The fix strips CR/LF characters from list.*.comment fields before inserting them into prepare...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-268h-hp4c-crq3" }, "impact_statement": "not_affected \u2014 The target repository (nodemailer 9.0.2-tuxcare.8 at commit b49c605) is not affected by GHSA-268h-hp4c-crq3 (List-* header CRLF injection). The vulnerability pattern is absent because the upstream fix by Andris Reinman (commit 5f69497) was already present in the upstream release that TuxCare onboarded. The fix strips CR/LF characters from list.*.comment fields before inserting them into prepare..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.2", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.2" } } ], "timestamp": "2026-10-12T14:24:00.043783+00:00", "status_notes": "Vulnerability GHSA-2x7j-588g-ccc2 affects version 9.0.2 of nodemailer, and is fixed in 9.0.2-tuxcare.1.", "vulnerability": { "name": "GHSA-2x7j-588g-ccc2" }, "action_statement": "Vulnerability GHSA-2x7j-588g-ccc2 affects version 9.0.2 of nodemailer, and is fixed in 9.0.2-tuxcare.1." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.2", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.2" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-46j5-6fg5-4gv3 is a false positive for nodemailer 9.0.2.", "vulnerability": { "name": "GHSA-46j5-6fg5-4gv3" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.2", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.2" } } ], "timestamp": "2026-10-27T15:13:32.414812+00:00", "status_notes": "Vulnerability GHSA-4ffr-jq9g-5ffx affects version 9.0.2 of nodemailer.", "vulnerability": { "name": "GHSA-4ffr-jq9g-5ffx" }, "action_statement": "Vulnerability GHSA-4ffr-jq9g-5ffx affects version 9.0.2 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.2", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.2" } } ], "timestamp": "2026-10-27T15:13:32.414812+00:00", "status_notes": "Vulnerability GHSA-4g23-2xm8-66gc affects version 9.0.2 of nodemailer.", "vulnerability": { "name": "GHSA-4g23-2xm8-66gc" }, "action_statement": "Vulnerability GHSA-4g23-2xm8-66gc affects version 9.0.2 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.2", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.2" } } ], "timestamp": "2026-10-15T12:59:26.638264+00:00", "status_notes": "Vulnerability GHSA-6vj9-mwq6-2f5v affects version 9.0.2 of nodemailer.", "vulnerability": { "name": "GHSA-6vj9-mwq6-2f5v" }, "action_statement": "Vulnerability GHSA-6vj9-mwq6-2f5v affects version 9.0.2 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.2", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.2" } } ], "timestamp": "2026-10-27T11:53:43.117949+00:00", "status_notes": "Vulnerability GHSA-85x2-q946-cp5h affects version 9.0.2 of nodemailer, and is fixed in 9.0.2-tuxcare.6.", "vulnerability": { "name": "GHSA-85x2-q946-cp5h" }, "action_statement": "Vulnerability GHSA-85x2-q946-cp5h affects version 9.0.2 of nodemailer, and is fixed in 9.0.2-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.2", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.2" } } ], "timestamp": "2026-10-27T14:01:24.748311+00:00", "status_notes": "Vulnerability GHSA-8c8m-p3m8-cjg8 affects version 9.0.2 of nodemailer, and is fixed in 9.0.2-tuxcare.7.", "vulnerability": { "name": "GHSA-8c8m-p3m8-cjg8" }, "action_statement": "Vulnerability GHSA-8c8m-p3m8-cjg8 affects version 9.0.2 of nodemailer, and is fixed in 9.0.2-tuxcare.7." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.2", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.2" } } ], "timestamp": "2026-10-12T17:23:00.042747+00:00", "status_notes": "Vulnerability GHSA-8m3c-c648-2xjj affects version 9.0.2 of nodemailer, and is fixed in 9.0.2-tuxcare.2.", "vulnerability": { "name": "GHSA-8m3c-c648-2xjj" }, "action_statement": "Vulnerability GHSA-8m3c-c648-2xjj affects version 9.0.2 of nodemailer, and is fixed in 9.0.2-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.2", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.2" } } ], "timestamp": "2026-10-12T17:23:00.042747+00:00", "status_notes": "Vulnerability GHSA-8vvx-rff5-p5rq affects version 9.0.2 of nodemailer, and is fixed in 9.0.2-tuxcare.2.", "vulnerability": { "name": "GHSA-8vvx-rff5-p5rq" }, "action_statement": "Vulnerability GHSA-8vvx-rff5-p5rq affects version 9.0.2 of nodemailer, and is fixed in 9.0.2-tuxcare.2." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.2", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.2" } } ], "timestamp": "2026-11-03T17:25:26.161394+00:00", "status_notes": "Vulnerability GHSA-9h6g-pr28-7cqp does not affect version 9.0.2 of nodemailer. not_affected \u2014 The target repository nodemailer 9.0.2-tuxcare.8 is NOT affected by GHSA-9h6g-pr28-7cqp. The ReDoS vulnerability patterns have been removed by upstream vendor fixes that were already present in the upstream release before TuxCare onboarded this version. Two fix commits (dd8f5e8a4ddc99992e31df76bcff9c590035cd4a and 90b3e24d23929ebf9f4e16261049b40ee4055a39) authored by upstream maintainers are an...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-9h6g-pr28-7cqp" }, "impact_statement": "not_affected \u2014 The target repository nodemailer 9.0.2-tuxcare.8 is NOT affected by GHSA-9h6g-pr28-7cqp. The ReDoS vulnerability patterns have been removed by upstream vendor fixes that were already present in the upstream release before TuxCare onboarded this version. Two fix commits (dd8f5e8a4ddc99992e31df76bcff9c590035cd4a and 90b3e24d23929ebf9f4e16261049b40ee4055a39) authored by upstream maintainers are an..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.2", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.2" } } ], "timestamp": "2026-11-03T17:26:20.261617+00:00", "status_notes": "Vulnerability GHSA-c7w3-x93f-qmm8 does not affect version 9.0.2 of nodemailer. not_affected \u2014 The SMTP command injection vulnerability via CRLF in envelope.size (GHSA-c7w3-x93f-qmm8) is not present in this target. The fix by upstream author Andris Reinman (commit 2d7b971) was already included in the upstream release before TuxCare onboarded version 9.0.2. The code at lib/smtp-connection/index.js:1329-1334 converts envelope.size to Number before concatenation, which strips CRLF character...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-c7w3-x93f-qmm8" }, "impact_statement": "not_affected \u2014 The SMTP command injection vulnerability via CRLF in envelope.size (GHSA-c7w3-x93f-qmm8) is not present in this target. The fix by upstream author Andris Reinman (commit 2d7b971) was already included in the upstream release before TuxCare onboarded version 9.0.2. The code at lib/smtp-connection/index.js:1329-1334 converts envelope.size to Number before concatenation, which strips CRLF character..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.2", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.2" } } ], "timestamp": "2026-10-12T17:23:00.042747+00:00", "status_notes": "Vulnerability GHSA-cc9r-2j5m-2m83 affects version 9.0.2 of nodemailer, and is fixed in 9.0.2-tuxcare.2.", "vulnerability": { "name": "GHSA-cc9r-2j5m-2m83" }, "action_statement": "Vulnerability GHSA-cc9r-2j5m-2m83 affects version 9.0.2 of nodemailer, and is fixed in 9.0.2-tuxcare.2." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.2", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.2" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-frj6-5rhh-vwfw is a false positive for nodemailer 9.0.2.", "vulnerability": { "name": "GHSA-frj6-5rhh-vwfw" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.2", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.2" } } ], "timestamp": "2026-11-04T18:41:00.037033+00:00", "status_notes": "Vulnerability GHSA-g57g-f23g-4646 affects version 9.0.2 of nodemailer, and is fixed in 9.0.2-tuxcare.9.", "vulnerability": { "name": "GHSA-g57g-f23g-4646" }, "action_statement": "Vulnerability GHSA-g57g-f23g-4646 affects version 9.0.2 of nodemailer, and is fixed in 9.0.2-tuxcare.9." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.2", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.2" } } ], "timestamp": "2026-10-28T17:44:00.090347+00:00", "status_notes": "Vulnerability GHSA-g73g-hqqh-jr95 affects version 9.0.2 of nodemailer, and is fixed in 9.0.2-tuxcare.8.", "vulnerability": { "name": "GHSA-g73g-hqqh-jr95" }, "action_statement": "Vulnerability GHSA-g73g-hqqh-jr95 affects version 9.0.2 of nodemailer, and is fixed in 9.0.2-tuxcare.8." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.2", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.2" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-h3hj-cmcx-xc66 is a false positive for nodemailer 9.0.2.", "vulnerability": { "name": "GHSA-h3hj-cmcx-xc66" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.2", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.2" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-jj37-3377-m6vv is a false positive for nodemailer 9.0.2.", "vulnerability": { "name": "GHSA-jj37-3377-m6vv" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.2", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.2" } } ], "timestamp": "2026-10-27T11:53:43.117949+00:00", "status_notes": "Vulnerability GHSA-m943-m63m-w62w affects version 9.0.2 of nodemailer, and is fixed in 9.0.2-tuxcare.6.", "vulnerability": { "name": "GHSA-m943-m63m-w62w" }, "action_statement": "Vulnerability GHSA-m943-m63m-w62w affects version 9.0.2 of nodemailer, and is fixed in 9.0.2-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.2", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.2" } } ], "timestamp": "2026-10-12T17:23:00.042747+00:00", "status_notes": "Vulnerability GHSA-v53p-9fqp-m79j affects version 9.0.2 of nodemailer, and is fixed in 9.0.2-tuxcare.2.", "vulnerability": { "name": "GHSA-v53p-9fqp-m79j" }, "action_statement": "Vulnerability GHSA-v53p-9fqp-m79j affects version 9.0.2 of nodemailer, and is fixed in 9.0.2-tuxcare.2." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.2", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.2" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-vm5r-23w9-m8hx is a false positive for nodemailer 9.0.2.", "vulnerability": { "name": "GHSA-vm5r-23w9-m8hx" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.2", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.2" } } ], "timestamp": "2026-11-03T17:17:53.657243+00:00", "status_notes": "Vulnerability GHSA-vvjj-xcjg-gr5g does not affect version 9.0.2 of nodemailer. not_affected \u2014 The target nodemailer 9.0.2-tuxcare.8 is NOT AFFECTED by GHSA-vvjj-xcjg-gr5g (SMTP command injection via CRLF in transport name option). The vulnerability pattern is absent because the upstream fix commit 0a43876 by Andris Reinman was already included in the upstream nodemailer 9.0.2 release before TuxCare onboarded this version. Line 121 of lib/smtp-connection/index.js contains the sanitizatio...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-vvjj-xcjg-gr5g" }, "impact_statement": "not_affected \u2014 The target nodemailer 9.0.2-tuxcare.8 is NOT AFFECTED by GHSA-vvjj-xcjg-gr5g (SMTP command injection via CRLF in transport name option). The vulnerability pattern is absent because the upstream fix commit 0a43876 by Andris Reinman was already included in the upstream nodemailer 9.0.2 release before TuxCare onboarded this version. Line 121 of lib/smtp-connection/index.js contains the sanitizatio..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.2", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wmmp-3585-3rmp affects version 9.0.2 of nodemailer.", "vulnerability": { "name": "GHSA-wmmp-3585-3rmp" }, "action_statement": "Vulnerability GHSA-wmmp-3585-3rmp affects version 9.0.2 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.2", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.2" } } ], "timestamp": "2026-11-03T17:20:54.241430+00:00", "status_notes": "Vulnerability GHSA-wqvq-jvpq-h66f does not affect version 9.0.2 of nodemailer. not_affected \u2014 The target repository (nodemailer 9.0.2-tuxcare.8) is NOT affected by GHSA-wqvq-jvpq-h66f. The vulnerability described a bypass of disableFileAccess/disableUrlAccess options in jsonTransport and attachDataUrls paths. The upstream fix (commit 5f694977 by andris@reinman.eu) was already present in the upstream release that TuxCare onboarded. All three defense points are implemented: (1) shared.res...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wqvq-jvpq-h66f" }, "impact_statement": "not_affected \u2014 The target repository (nodemailer 9.0.2-tuxcare.8) is NOT affected by GHSA-wqvq-jvpq-h66f. The vulnerability described a bypass of disableFileAccess/disableUrlAccess options in jsonTransport and attachDataUrls paths. The upstream fix (commit 5f694977 by andris@reinman.eu) was already present in the upstream release that TuxCare onboarded. All three defense points are implemented: (1) shared.res..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.2", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.2" } } ], "timestamp": "2026-10-22T17:05:00.556684+00:00", "status_notes": "Vulnerability GHSA-wxxx-r42m-9rp8 is a false positive for nodemailer 9.0.2.", "vulnerability": { "name": "GHSA-wxxx-r42m-9rp8" }, "impact_statement": "The vulnerability has been withdrawn." } ] }