{
  "@id": "urn:uuid:39b36f23-8f62-4eb0-9282-e508a10b56b8",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 35,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-11T10:30:01.132512+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@9.0.3",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@9.0.3"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2020-7769 affects version 9.0.3 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2020-7769"
      },
      "action_statement": "Vulnerability CVE-2020-7769 affects version 9.0.3 of nodemailer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@9.0.3",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@9.0.3"
          }
        }
      ],
      "timestamp": "2026-11-03T17:15:39.453186+00:00",
      "status_notes": "Vulnerability CVE-2021-23400 does not affect version 9.0.3 of nodemailer. not_affected \u2014 The target nodemailer version 9.0.3 is NOT AFFECTED by CVE-2021-23400. The vulnerability (HTTP Header Injection via unsanitized newlines/carriage returns in email addresses) was fixed in upstream version 6.6.1 by commit 7e02648. This fix was already present in the upstream release that TuxCare onboarded to create the 9.0.3 branch. The vulnerable code pattern (missing control character sanitizat...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-23400"
      },
      "impact_statement": "not_affected \u2014 The target nodemailer version 9.0.3 is NOT AFFECTED by CVE-2021-23400. The vulnerability (HTTP Header Injection via unsanitized newlines/carriage returns in email addresses) was fixed in upstream version 6.6.1 by commit 7e02648. This fix was already present in the upstream release that TuxCare onboarded to create the 9.0.3 branch. The vulnerable code pattern (missing control character sanitizat..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@9.0.3",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@9.0.3"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2025-13033 affects version 9.0.3 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2025-13033"
      },
      "action_statement": "Vulnerability CVE-2025-13033 affects version 9.0.3 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@9.0.3",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@9.0.3"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2025-14874 affects version 9.0.3 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2025-14874"
      },
      "action_statement": "Vulnerability CVE-2025-14874 affects version 9.0.3 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@9.0.3",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@9.0.3"
          }
        }
      ],
      "timestamp": "2026-10-16T00:37:00.218819+00:00",
      "status_notes": "Vulnerability CVE-2026-100701 affects version 9.0.3 of nodemailer, and is fixed in 9.0.3-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-100701"
      },
      "action_statement": "Vulnerability CVE-2026-100701 affects version 9.0.3 of nodemailer, and is fixed in 9.0.3-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@9.0.3",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@9.0.3"
          }
        }
      ],
      "timestamp": "2026-10-20T08:50:15.314310+00:00",
      "status_notes": "Vulnerability CVE-2026-110869 affects version 9.0.3 of nodemailer, and is fixed in 9.0.3-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-110869"
      },
      "action_statement": "Vulnerability CVE-2026-110869 affects version 9.0.3 of nodemailer, and is fixed in 9.0.3-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@9.0.3",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@9.0.3"
          }
        }
      ],
      "timestamp": "2026-10-28T17:04:35.245782+00:00",
      "status_notes": "Vulnerability CVE-2026-110870 affects version 9.0.3 of nodemailer, and is fixed in 9.0.3-tuxcare.7.",
      "vulnerability": {
        "name": "CVE-2026-110870"
      },
      "action_statement": "Vulnerability CVE-2026-110870 affects version 9.0.3 of nodemailer, and is fixed in 9.0.3-tuxcare.7."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@9.0.3",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@9.0.3"
          }
        }
      ],
      "timestamp": "2026-10-20T14:20:16.638440+00:00",
      "status_notes": "Vulnerability CVE-2026-110871 affects version 9.0.3 of nodemailer, and is fixed in 9.0.3-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-110871"
      },
      "action_statement": "Vulnerability CVE-2026-110871 affects version 9.0.3 of nodemailer, and is fixed in 9.0.3-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@9.0.3",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@9.0.3"
          }
        }
      ],
      "timestamp": "2026-10-20T08:50:15.314310+00:00",
      "status_notes": "Vulnerability CVE-2026-110872 affects version 9.0.3 of nodemailer, and is fixed in 9.0.3-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-110872"
      },
      "action_statement": "Vulnerability CVE-2026-110872 affects version 9.0.3 of nodemailer, and is fixed in 9.0.3-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@9.0.3",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@9.0.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:36:48.497569+00:00",
      "status_notes": "Vulnerability CVE-2026-121424 affects version 9.0.3 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-121424"
      },
      "action_statement": "Vulnerability CVE-2026-121424 affects version 9.0.3 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@9.0.3",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@9.0.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:36:48.497569+00:00",
      "status_notes": "Vulnerability CVE-2026-121425 affects version 9.0.3 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-121425"
      },
      "action_statement": "Vulnerability CVE-2026-121425 affects version 9.0.3 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@9.0.3",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@9.0.3"
          }
        }
      ],
      "timestamp": "2026-11-03T14:36:48.497569+00:00",
      "status_notes": "Vulnerability CVE-2026-121426 affects version 9.0.3 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-121426"
      },
      "action_statement": "Vulnerability CVE-2026-121426 affects version 9.0.3 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@9.0.3",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@9.0.3"
          }
        }
      ],
      "timestamp": "2026-11-11T00:19:00.052114+00:00",
      "status_notes": "Vulnerability CVE-2026-125755 affects version 9.0.3 of nodemailer, and is fixed in 9.0.3-tuxcare.9.",
      "vulnerability": {
        "name": "CVE-2026-125755"
      },
      "action_statement": "Vulnerability CVE-2026-125755 affects version 9.0.3 of nodemailer, and is fixed in 9.0.3-tuxcare.9."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@9.0.3",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@9.0.3"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2026-82659 affects version 9.0.3 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-82659"
      },
      "action_statement": "Vulnerability CVE-2026-82659 affects version 9.0.3 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@9.0.3",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@9.0.3"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2026-82662 affects version 9.0.3 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-82662"
      },
      "action_statement": "Vulnerability CVE-2026-82662 affects version 9.0.3 of nodemailer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@9.0.3",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@9.0.3"
          }
        }
      ],
      "timestamp": "2026-11-03T22:34:29.636715+00:00",
      "status_notes": "Vulnerability CVE-2026-82854 does not affect version 9.0.3 of nodemailer. not_affected \u2014 The target nodemailer version 9.0.3-tuxcare.7 is NOT AFFECTED by CVE-2026-82854. The vulnerability (SMTP command injection via unsanitized envelope.size) was fixed in upstream nodemailer 8.0.4 by commit 2d7b9710 (author: Andris Reinman). The target's version 9.0.3 already contains this upstream fix\u2014the code at lib/smtp-connection/index.js:1349-1354 casts envelope.size to Number and validates po...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-82854"
      },
      "impact_statement": "not_affected \u2014 The target nodemailer version 9.0.3-tuxcare.7 is NOT AFFECTED by CVE-2026-82854. The vulnerability (SMTP command injection via unsanitized envelope.size) was fixed in upstream nodemailer 8.0.4 by commit 2d7b9710 (author: Andris Reinman). The target's version 9.0.3 already contains this upstream fix\u2014the code at lib/smtp-connection/index.js:1349-1354 casts envelope.size to Number and validates po..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@9.0.3",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@9.0.3"
          }
        }
      ],
      "timestamp": "2026-11-11T10:30:01.132512+00:00",
      "status_notes": "Vulnerability CVE-2026-90776 affects version 9.0.3 of nodemailer, and is fixed in 9.0.3-tuxcare.9.",
      "vulnerability": {
        "name": "CVE-2026-90776"
      },
      "action_statement": "Vulnerability CVE-2026-90776 affects version 9.0.3 of nodemailer, and is fixed in 9.0.3-tuxcare.9."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@9.0.3",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@9.0.3"
          }
        }
      ],
      "timestamp": "2026-10-12T12:00:06.442883+00:00",
      "status_notes": "Vulnerability CVE-2026-92596 affects version 9.0.3 of nodemailer, and is fixed in 9.0.3-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-92596"
      },
      "action_statement": "Vulnerability CVE-2026-92596 affects version 9.0.3 of nodemailer, and is fixed in 9.0.3-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@9.0.3",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@9.0.3"
          }
        }
      ],
      "timestamp": "2026-10-16T00:37:00.218819+00:00",
      "status_notes": "Vulnerability CVE-2026-92598 affects version 9.0.3 of nodemailer, and is fixed in 9.0.3-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-92598"
      },
      "action_statement": "Vulnerability CVE-2026-92598 affects version 9.0.3 of nodemailer, and is fixed in 9.0.3-tuxcare.3."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@9.0.3",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@9.0.3"
          }
        }
      ],
      "timestamp": "2026-11-03T17:11:43.788711+00:00",
      "status_notes": "Vulnerability GHSA-268h-hp4c-crq3 does not affect version 9.0.3 of nodemailer. not_affected \u2014 The CRLF injection vulnerability (GHSA-268h-hp4c-crq3) in List-* header comments is NOT present in nodemailer 9.0.3-tuxcare.7. The upstream fix (commit 5f694977da2e0e13dc947037566e8e689a01217e) was included in the upstream nodemailer v9.0.3 release (2026-06-30) before TuxCare onboarded it. The vulnerable code pattern\u2014unfiltered insertion of list.*.comment into prepared headers\u2014has been replaced...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-268h-hp4c-crq3"
      },
      "impact_statement": "not_affected \u2014 The CRLF injection vulnerability (GHSA-268h-hp4c-crq3) in List-* header comments is NOT present in nodemailer 9.0.3-tuxcare.7. The upstream fix (commit 5f694977da2e0e13dc947037566e8e689a01217e) was included in the upstream nodemailer v9.0.3 release (2026-06-30) before TuxCare onboarded it. The vulnerable code pattern\u2014unfiltered insertion of list.*.comment into prepared headers\u2014has been replaced..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@9.0.3",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@9.0.3"
          }
        }
      ],
      "timestamp": "2026-10-12T12:00:06.442883+00:00",
      "status_notes": "Vulnerability GHSA-2x7j-588g-ccc2 affects version 9.0.3 of nodemailer, and is fixed in 9.0.3-tuxcare.1.",
      "vulnerability": {
        "name": "GHSA-2x7j-588g-ccc2"
      },
      "action_statement": "Vulnerability GHSA-2x7j-588g-ccc2 affects version 9.0.3 of nodemailer, and is fixed in 9.0.3-tuxcare.1."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@9.0.3",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@9.0.3"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-46j5-6fg5-4gv3 is a false positive for nodemailer 9.0.3.",
      "vulnerability": {
        "name": "GHSA-46j5-6fg5-4gv3"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@9.0.3",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@9.0.3"
          }
        }
      ],
      "timestamp": "2026-10-27T15:13:32.414812+00:00",
      "status_notes": "Vulnerability GHSA-4ffr-jq9g-5ffx affects version 9.0.3 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-4ffr-jq9g-5ffx"
      },
      "action_statement": "Vulnerability GHSA-4ffr-jq9g-5ffx affects version 9.0.3 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@9.0.3",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@9.0.3"
          }
        }
      ],
      "timestamp": "2026-10-27T15:13:32.414812+00:00",
      "status_notes": "Vulnerability GHSA-4g23-2xm8-66gc affects version 9.0.3 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-4g23-2xm8-66gc"
      },
      "action_statement": "Vulnerability GHSA-4g23-2xm8-66gc affects version 9.0.3 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@9.0.3",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@9.0.3"
          }
        }
      ],
      "timestamp": "2026-10-15T12:59:26.638264+00:00",
      "status_notes": "Vulnerability GHSA-6vj9-mwq6-2f5v affects version 9.0.3 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-6vj9-mwq6-2f5v"
      },
      "action_statement": "Vulnerability GHSA-6vj9-mwq6-2f5v affects version 9.0.3 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@9.0.3",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@9.0.3"
          }
        }
      ],
      "timestamp": "2026-10-27T12:02:00.069063+00:00",
      "status_notes": "Vulnerability GHSA-85x2-q946-cp5h affects version 9.0.3 of nodemailer, and is fixed in 9.0.3-tuxcare.6.",
      "vulnerability": {
        "name": "GHSA-85x2-q946-cp5h"
      },
      "action_statement": "Vulnerability GHSA-85x2-q946-cp5h affects version 9.0.3 of nodemailer, and is fixed in 9.0.3-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@9.0.3",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@9.0.3"
          }
        }
      ],
      "timestamp": "2026-10-27T12:02:00.069063+00:00",
      "status_notes": "Vulnerability GHSA-8c8m-p3m8-cjg8 affects version 9.0.3 of nodemailer, and is fixed in 9.0.3-tuxcare.6.",
      "vulnerability": {
        "name": "GHSA-8c8m-p3m8-cjg8"
      },
      "action_statement": "Vulnerability GHSA-8c8m-p3m8-cjg8 affects version 9.0.3 of nodemailer, and is fixed in 9.0.3-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@9.0.3",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@9.0.3"
          }
        }
      ],
      "timestamp": "2026-10-12T16:09:00.076113+00:00",
      "status_notes": "Vulnerability GHSA-8m3c-c648-2xjj affects version 9.0.3 of nodemailer, and is fixed in 9.0.3-tuxcare.2.",
      "vulnerability": {
        "name": "GHSA-8m3c-c648-2xjj"
      },
      "action_statement": "Vulnerability GHSA-8m3c-c648-2xjj affects version 9.0.3 of nodemailer, and is fixed in 9.0.3-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@9.0.3",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@9.0.3"
          }
        }
      ],
      "timestamp": "2026-10-12T16:09:00.076113+00:00",
      "status_notes": "Vulnerability GHSA-8vvx-rff5-p5rq affects version 9.0.3 of nodemailer, and is fixed in 9.0.3-tuxcare.2.",
      "vulnerability": {
        "name": "GHSA-8vvx-rff5-p5rq"
      },
      "action_statement": "Vulnerability GHSA-8vvx-rff5-p5rq affects version 9.0.3 of nodemailer, and is fixed in 9.0.3-tuxcare.2."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@9.0.3",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@9.0.3"
          }
        }
      ],
      "timestamp": "2026-11-03T17:25:45.061178+00:00",
      "status_notes": "Vulnerability GHSA-9h6g-pr28-7cqp does not affect version 9.0.3 of nodemailer. not_affected \u2014 The target repository (nodemailer 9.0.3-tuxcare.7) is NOT AFFECTED by GHSA-9h6g-pr28-7cqp (ReDoS vulnerability). All three upstream security patches addressing this vulnerability are present in the codebase. The vulnerable regex patterns have been replaced with safe linear string parsing operations, bounded quantifiers have been added to remaining regexes, and explicit size limits prevent malic...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-9h6g-pr28-7cqp"
      },
      "impact_statement": "not_affected \u2014 The target repository (nodemailer 9.0.3-tuxcare.7) is NOT AFFECTED by GHSA-9h6g-pr28-7cqp (ReDoS vulnerability). All three upstream security patches addressing this vulnerability are present in the codebase. The vulnerable regex patterns have been replaced with safe linear string parsing operations, bounded quantifiers have been added to remaining regexes, and explicit size limits prevent malic..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@9.0.3",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@9.0.3"
          }
        }
      ],
      "timestamp": "2026-11-03T17:25:45.061178+00:00",
      "status_notes": "Vulnerability GHSA-c7w3-x93f-qmm8 does not affect version 9.0.3 of nodemailer. not_affected \u2014 The target is NOT AFFECTED by GHSA-c7w3-x93f-qmm8 (SMTP command injection via CRLF in envelope.size). The upstream vendor (Andris Reinman) fixed this vulnerability in commit 2d7b9710e63555a1eb13d721296c51186d4b5651, which was already included in the nodemailer 9.0.3 upstream release before TuxCare onboarded it. The fix converts envelope.size to a Number before concatenation into the SMTP MAIL F...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-c7w3-x93f-qmm8"
      },
      "impact_statement": "not_affected \u2014 The target is NOT AFFECTED by GHSA-c7w3-x93f-qmm8 (SMTP command injection via CRLF in envelope.size). The upstream vendor (Andris Reinman) fixed this vulnerability in commit 2d7b9710e63555a1eb13d721296c51186d4b5651, which was already included in the nodemailer 9.0.3 upstream release before TuxCare onboarded it. The fix converts envelope.size to a Number before concatenation into the SMTP MAIL F..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@9.0.3",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@9.0.3"
          }
        }
      ],
      "timestamp": "2026-10-12T16:09:00.076113+00:00",
      "status_notes": "Vulnerability GHSA-cc9r-2j5m-2m83 affects version 9.0.3 of nodemailer, and is fixed in 9.0.3-tuxcare.2.",
      "vulnerability": {
        "name": "GHSA-cc9r-2j5m-2m83"
      },
      "action_statement": "Vulnerability GHSA-cc9r-2j5m-2m83 affects version 9.0.3 of nodemailer, and is fixed in 9.0.3-tuxcare.2."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@9.0.3",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@9.0.3"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-frj6-5rhh-vwfw is a false positive for nodemailer 9.0.3.",
      "vulnerability": {
        "name": "GHSA-frj6-5rhh-vwfw"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@9.0.3",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@9.0.3"
          }
        }
      ],
      "timestamp": "2026-11-04T17:13:36.368220+00:00",
      "status_notes": "Vulnerability GHSA-g57g-f23g-4646 affects version 9.0.3 of nodemailer, and is fixed in 9.0.3-tuxcare.8.",
      "vulnerability": {
        "name": "GHSA-g57g-f23g-4646"
      },
      "action_statement": "Vulnerability GHSA-g57g-f23g-4646 affects version 9.0.3 of nodemailer, and is fixed in 9.0.3-tuxcare.8."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@9.0.3",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@9.0.3"
          }
        }
      ],
      "timestamp": "2026-10-28T17:04:35.245782+00:00",
      "status_notes": "Vulnerability GHSA-g73g-hqqh-jr95 affects version 9.0.3 of nodemailer, and is fixed in 9.0.3-tuxcare.7.",
      "vulnerability": {
        "name": "GHSA-g73g-hqqh-jr95"
      },
      "action_statement": "Vulnerability GHSA-g73g-hqqh-jr95 affects version 9.0.3 of nodemailer, and is fixed in 9.0.3-tuxcare.7."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@9.0.3",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@9.0.3"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-h3hj-cmcx-xc66 is a false positive for nodemailer 9.0.3.",
      "vulnerability": {
        "name": "GHSA-h3hj-cmcx-xc66"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@9.0.3",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@9.0.3"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-jj37-3377-m6vv is a false positive for nodemailer 9.0.3.",
      "vulnerability": {
        "name": "GHSA-jj37-3377-m6vv"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@9.0.3",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@9.0.3"
          }
        }
      ],
      "timestamp": "2026-10-27T12:02:00.069063+00:00",
      "status_notes": "Vulnerability GHSA-m943-m63m-w62w affects version 9.0.3 of nodemailer, and is fixed in 9.0.3-tuxcare.6.",
      "vulnerability": {
        "name": "GHSA-m943-m63m-w62w"
      },
      "action_statement": "Vulnerability GHSA-m943-m63m-w62w affects version 9.0.3 of nodemailer, and is fixed in 9.0.3-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@9.0.3",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@9.0.3"
          }
        }
      ],
      "timestamp": "2026-10-12T16:09:00.076113+00:00",
      "status_notes": "Vulnerability GHSA-v53p-9fqp-m79j affects version 9.0.3 of nodemailer, and is fixed in 9.0.3-tuxcare.2.",
      "vulnerability": {
        "name": "GHSA-v53p-9fqp-m79j"
      },
      "action_statement": "Vulnerability GHSA-v53p-9fqp-m79j affects version 9.0.3 of nodemailer, and is fixed in 9.0.3-tuxcare.2."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@9.0.3",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@9.0.3"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-vm5r-23w9-m8hx is a false positive for nodemailer 9.0.3.",
      "vulnerability": {
        "name": "GHSA-vm5r-23w9-m8hx"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@9.0.3",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@9.0.3"
          }
        }
      ],
      "timestamp": "2026-11-03T17:18:37.716688+00:00",
      "status_notes": "Vulnerability GHSA-vvjj-xcjg-gr5g does not affect version 9.0.3 of nodemailer. not_affected \u2014 Target nodemailer 9.0.3-tuxcare.7 is NOT AFFECTED by GHSA-vvjj-xcjg-gr5g (SMTP command injection via CRLF in transport name option). The vulnerability was fixed by upstream vendor Andris Reinman in commit 0a43876 at v8.0.5, before the v9.0.3 release that TuxCare onboarded. The fix strips all carriage return and line feed characters from the `name` option at assignment time (line 121 of lib/smtp...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-vvjj-xcjg-gr5g"
      },
      "impact_statement": "not_affected \u2014 Target nodemailer 9.0.3-tuxcare.7 is NOT AFFECTED by GHSA-vvjj-xcjg-gr5g (SMTP command injection via CRLF in transport name option). The vulnerability was fixed by upstream vendor Andris Reinman in commit 0a43876 at v8.0.5, before the v9.0.3 release that TuxCare onboarded. The fix strips all carriage return and line feed characters from the `name` option at assignment time (line 121 of lib/smtp..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@9.0.3",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@9.0.3"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-wmmp-3585-3rmp affects version 9.0.3 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-wmmp-3585-3rmp"
      },
      "action_statement": "Vulnerability GHSA-wmmp-3585-3rmp affects version 9.0.3 of nodemailer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@9.0.3",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@9.0.3"
          }
        }
      ],
      "timestamp": "2026-11-03T17:21:23.053995+00:00",
      "status_notes": "Vulnerability GHSA-wqvq-jvpq-h66f does not affect version 9.0.3 of nodemailer. not_affected \u2014 The target repository (nodemailer 9.0.3-tuxcare.7 at commit 3ffae530) is NOT affected by GHSA-wqvq-jvpq-h66f. The vulnerability, which allowed bypassing disableFileAccess and disableUrlAccess options in jsonTransport, has been fixed by upstream commit 5f694977 authored by Andris Reinman. This fix was included in the upstream release that TuxCare onboarded. The fix adds proper access control che...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-wqvq-jvpq-h66f"
      },
      "impact_statement": "not_affected \u2014 The target repository (nodemailer 9.0.3-tuxcare.7 at commit 3ffae530) is NOT affected by GHSA-wqvq-jvpq-h66f. The vulnerability, which allowed bypassing disableFileAccess and disableUrlAccess options in jsonTransport, has been fixed by upstream commit 5f694977 authored by Andris Reinman. This fix was included in the upstream release that TuxCare onboarded. The fix adds proper access control che..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@9.0.3",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@9.0.3"
          }
        }
      ],
      "timestamp": "2026-10-22T17:05:00.556684+00:00",
      "status_notes": "Vulnerability GHSA-wxxx-r42m-9rp8 is a false positive for nodemailer 9.0.3.",
      "vulnerability": {
        "name": "GHSA-wxxx-r42m-9rp8"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}