{ "@id": "urn:uuid:c67f6d04-db5b-48ff-b6c9-6474941b27db", "role": "Document Creator", "author": "https://tuxcare.com", "version": 38, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-11T10:30:01.132512+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.5" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2020-7769 affects version 9.0.5 of nodemailer.", "vulnerability": { "name": "CVE-2020-7769" }, "action_statement": "Vulnerability CVE-2020-7769 affects version 9.0.5 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.5" } } ], "timestamp": "2026-11-03T17:15:39.453186+00:00", "status_notes": "Vulnerability CVE-2021-23400 does not affect version 9.0.5 of nodemailer. not_affected \u2014 CVE-2021-23400 is NOT present in nodemailer 9.0.5-tuxcare.8. The vulnerability (HTTP header injection via newlines/carriage returns in email addresses) was fixed in upstream v6.6.1 (May 2021) by commit 7e02648. The fix adds `.replace(/[\\x00-\\x1F<>]+/g, ' ')` in `_normalizeAddress()` to strip control characters including newlines (\\x0A) and carriage returns (\\x0D) from email addresses before the...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-23400" }, "impact_statement": "not_affected \u2014 CVE-2021-23400 is NOT present in nodemailer 9.0.5-tuxcare.8. The vulnerability (HTTP header injection via newlines/carriage returns in email addresses) was fixed in upstream v6.6.1 (May 2021) by commit 7e02648. The fix adds `.replace(/[\\x00-\\x1F<>]+/g, ' ')` in `_normalizeAddress()` to strip control characters including newlines (\\x0A) and carriage returns (\\x0D) from email addresses before the..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.5" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2025-13033 affects version 9.0.5 of nodemailer.", "vulnerability": { "name": "CVE-2025-13033" }, "action_statement": "Vulnerability CVE-2025-13033 affects version 9.0.5 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.5" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2025-14874 affects version 9.0.5 of nodemailer.", "vulnerability": { "name": "CVE-2025-14874" }, "action_statement": "Vulnerability CVE-2025-14874 affects version 9.0.5 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.5" } } ], "timestamp": "2026-10-16T08:26:00.306939+00:00", "status_notes": "Vulnerability CVE-2026-100701 affects version 9.0.5 of nodemailer, and is fixed in 9.0.5-tuxcare.3.", "vulnerability": { "name": "CVE-2026-100701" }, "action_statement": "Vulnerability CVE-2026-100701 affects version 9.0.5 of nodemailer, and is fixed in 9.0.5-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.5" } } ], "timestamp": "2026-10-20T06:01:00.096633+00:00", "status_notes": "Vulnerability CVE-2026-110869 affects version 9.0.5 of nodemailer, and is fixed in 9.0.5-tuxcare.4.", "vulnerability": { "name": "CVE-2026-110869" }, "action_statement": "Vulnerability CVE-2026-110869 affects version 9.0.5 of nodemailer, and is fixed in 9.0.5-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.5" } } ], "timestamp": "2026-10-28T11:41:41.686776+00:00", "status_notes": "Vulnerability CVE-2026-110870 affects version 9.0.5 of nodemailer, and is fixed in 9.0.5-tuxcare.8.", "vulnerability": { "name": "CVE-2026-110870" }, "action_statement": "Vulnerability CVE-2026-110870 affects version 9.0.5 of nodemailer, and is fixed in 9.0.5-tuxcare.8." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.5" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability CVE-2026-110871 affects version 9.0.5 of nodemailer, and is fixed in 9.0.5-tuxcare.5.", "vulnerability": { "name": "CVE-2026-110871" }, "action_statement": "Vulnerability CVE-2026-110871 affects version 9.0.5 of nodemailer, and is fixed in 9.0.5-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.5" } } ], "timestamp": "2026-10-20T06:01:00.096633+00:00", "status_notes": "Vulnerability CVE-2026-110872 affects version 9.0.5 of nodemailer, and is fixed in 9.0.5-tuxcare.4.", "vulnerability": { "name": "CVE-2026-110872" }, "action_statement": "Vulnerability CVE-2026-110872 affects version 9.0.5 of nodemailer, and is fixed in 9.0.5-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.5" } } ], "timestamp": "2026-11-03T14:36:48.497569+00:00", "status_notes": "Vulnerability CVE-2026-121424 affects version 9.0.5 of nodemailer.", "vulnerability": { "name": "CVE-2026-121424" }, "action_statement": "Vulnerability CVE-2026-121424 affects version 9.0.5 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.5" } } ], "timestamp": "2026-11-06T08:00:04.916776+00:00", "status_notes": "Vulnerability CVE-2026-121425 does not affect version 9.0.5 of nodemailer. not_affected \u2014 The upstream fix (nodemailer commit 1cd57d2, \"honour quoted strings and comments inside an angle-addr and a group\") is already in the 9.0.5 release this target ships. lib/addressparser/index.js ignores ';' inside quoted strings and comments when closing a group. The commit is authored by upstream (andris@reinman.eu) and predates the first TuxCare commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-121425" }, "impact_statement": "not_affected \u2014 The upstream fix (nodemailer commit 1cd57d2, \"honour quoted strings and comments inside an angle-addr and a group\") is already in the 9.0.5 release this target ships. lib/addressparser/index.js ignores ';' inside quoted strings and comments when closing a group. The commit is authored by upstream (andris@reinman.eu) and predates the first TuxCare commit." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.5" } } ], "timestamp": "2026-11-03T14:36:48.497569+00:00", "status_notes": "Vulnerability CVE-2026-121426 affects version 9.0.5 of nodemailer.", "vulnerability": { "name": "CVE-2026-121426" }, "action_statement": "Vulnerability CVE-2026-121426 affects version 9.0.5 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.5" } } ], "timestamp": "2026-11-10T20:23:25.911548+00:00", "status_notes": "Vulnerability CVE-2026-125755 affects version 9.0.5 of nodemailer, and is fixed in 9.0.5-tuxcare.10.", "vulnerability": { "name": "CVE-2026-125755" }, "action_statement": "Vulnerability CVE-2026-125755 affects version 9.0.5 of nodemailer, and is fixed in 9.0.5-tuxcare.10." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.5" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2026-82659 affects version 9.0.5 of nodemailer.", "vulnerability": { "name": "CVE-2026-82659" }, "action_statement": "Vulnerability CVE-2026-82659 affects version 9.0.5 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.5" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2026-82662 affects version 9.0.5 of nodemailer.", "vulnerability": { "name": "CVE-2026-82662" }, "action_statement": "Vulnerability CVE-2026-82662 affects version 9.0.5 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.5" } } ], "timestamp": "2026-11-03T22:35:13.241226+00:00", "status_notes": "Vulnerability CVE-2026-82854 does not affect version 9.0.5 of nodemailer. not_affected \u2014 CVE-2026-82854 (SMTP command injection via unsanitized envelope.size) is not present in nodemailer 9.0.5-tuxcare.8. The upstream fix (commit 2d7b9710) by Andris Reinman was already included in the upstream release 9.0.5 before TuxCare's maintenance work began. The vulnerable code pattern (direct concatenation of this._envelope.size into SMTP commands) has been replaced with defensive code that ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-82854" }, "impact_statement": "not_affected \u2014 CVE-2026-82854 (SMTP command injection via unsanitized envelope.size) is not present in nodemailer 9.0.5-tuxcare.8. The upstream fix (commit 2d7b9710) by Andris Reinman was already included in the upstream release 9.0.5 before TuxCare's maintenance work began. The vulnerable code pattern (direct concatenation of this._envelope.size into SMTP commands) has been replaced with defensive code that ..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.5" } } ], "timestamp": "2026-11-11T10:30:01.132512+00:00", "status_notes": "Vulnerability CVE-2026-90776 affects version 9.0.5 of nodemailer, and is fixed in 9.0.5-tuxcare.10.", "vulnerability": { "name": "CVE-2026-90776" }, "action_statement": "Vulnerability CVE-2026-90776 affects version 9.0.5 of nodemailer, and is fixed in 9.0.5-tuxcare.10." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.5" } } ], "timestamp": "2026-10-12T14:22:02.231466+00:00", "status_notes": "Vulnerability CVE-2026-92596 affects version 9.0.5 of nodemailer, and is fixed in 9.0.5-tuxcare.2.", "vulnerability": { "name": "CVE-2026-92596" }, "action_statement": "Vulnerability CVE-2026-92596 affects version 9.0.5 of nodemailer, and is fixed in 9.0.5-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.5" } } ], "timestamp": "2026-10-16T08:26:00.306939+00:00", "status_notes": "Vulnerability CVE-2026-92598 affects version 9.0.5 of nodemailer, and is fixed in 9.0.5-tuxcare.3.", "vulnerability": { "name": "CVE-2026-92598" }, "action_statement": "Vulnerability CVE-2026-92598 affects version 9.0.5 of nodemailer, and is fixed in 9.0.5-tuxcare.3." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.5" } } ], "timestamp": "2026-11-03T17:13:05.282153+00:00", "status_notes": "Vulnerability GHSA-268h-hp4c-crq3 does not affect version 9.0.5 of nodemailer. not_affected \u2014 The target nodemailer 9.0.5-tuxcare.8 is NOT AFFECTED by GHSA-268h-hp4c-crq3 (List-* header CRLF injection). The vulnerable pattern is not present because the upstream vendor fix (commit 5f694977da2e0e13dc947037566e8e689a01217e by Andris Reinman) was already included in the upstream release that TuxCare onboarded. The fix sanitizes CR/LF characters in list.*.comment fields by replacing them wit...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-268h-hp4c-crq3" }, "impact_statement": "not_affected \u2014 The target nodemailer 9.0.5-tuxcare.8 is NOT AFFECTED by GHSA-268h-hp4c-crq3 (List-* header CRLF injection). The vulnerable pattern is not present because the upstream vendor fix (commit 5f694977da2e0e13dc947037566e8e689a01217e by Andris Reinman) was already included in the upstream release that TuxCare onboarded. The fix sanitizes CR/LF characters in list.*.comment fields by replacing them wit..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.5" } } ], "timestamp": "2026-10-12T08:58:00.064891+00:00", "status_notes": "Vulnerability GHSA-2x7j-588g-ccc2 affects version 9.0.5 of nodemailer, and is fixed in 9.0.5-tuxcare.1.", "vulnerability": { "name": "GHSA-2x7j-588g-ccc2" }, "action_statement": "Vulnerability GHSA-2x7j-588g-ccc2 affects version 9.0.5 of nodemailer, and is fixed in 9.0.5-tuxcare.1." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.5" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-46j5-6fg5-4gv3 is a false positive for nodemailer 9.0.5.", "vulnerability": { "name": "GHSA-46j5-6fg5-4gv3" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.5" } } ], "timestamp": "2026-10-27T15:13:32.414812+00:00", "status_notes": "Vulnerability GHSA-4ffr-jq9g-5ffx affects version 9.0.5 of nodemailer.", "vulnerability": { "name": "GHSA-4ffr-jq9g-5ffx" }, "action_statement": "Vulnerability GHSA-4ffr-jq9g-5ffx affects version 9.0.5 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.5" } } ], "timestamp": "2026-10-27T15:13:32.414812+00:00", "status_notes": "Vulnerability GHSA-4g23-2xm8-66gc affects version 9.0.5 of nodemailer.", "vulnerability": { "name": "GHSA-4g23-2xm8-66gc" }, "action_statement": "Vulnerability GHSA-4g23-2xm8-66gc affects version 9.0.5 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.5" } } ], "timestamp": "2026-10-15T12:59:26.638264+00:00", "status_notes": "Vulnerability GHSA-6vj9-mwq6-2f5v affects version 9.0.5 of nodemailer.", "vulnerability": { "name": "GHSA-6vj9-mwq6-2f5v" }, "action_statement": "Vulnerability GHSA-6vj9-mwq6-2f5v affects version 9.0.5 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.5" } } ], "timestamp": "2026-10-27T11:58:30.826972+00:00", "status_notes": "Vulnerability GHSA-85x2-q946-cp5h affects version 9.0.5 of nodemailer, and is fixed in 9.0.5-tuxcare.6.", "vulnerability": { "name": "GHSA-85x2-q946-cp5h" }, "action_statement": "Vulnerability GHSA-85x2-q946-cp5h affects version 9.0.5 of nodemailer, and is fixed in 9.0.5-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.5" } } ], "timestamp": "2026-10-27T14:00:14.897813+00:00", "status_notes": "Vulnerability GHSA-8c8m-p3m8-cjg8 affects version 9.0.5 of nodemailer, and is fixed in 9.0.5-tuxcare.7.", "vulnerability": { "name": "GHSA-8c8m-p3m8-cjg8" }, "action_statement": "Vulnerability GHSA-8c8m-p3m8-cjg8 affects version 9.0.5 of nodemailer, and is fixed in 9.0.5-tuxcare.7." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.5" } } ], "timestamp": "2026-10-12T14:22:02.231466+00:00", "status_notes": "Vulnerability GHSA-8m3c-c648-2xjj affects version 9.0.5 of nodemailer, and is fixed in 9.0.5-tuxcare.2.", "vulnerability": { "name": "GHSA-8m3c-c648-2xjj" }, "action_statement": "Vulnerability GHSA-8m3c-c648-2xjj affects version 9.0.5 of nodemailer, and is fixed in 9.0.5-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.5" } } ], "timestamp": "2026-10-12T14:22:02.231466+00:00", "status_notes": "Vulnerability GHSA-8vvx-rff5-p5rq affects version 9.0.5 of nodemailer, and is fixed in 9.0.5-tuxcare.2.", "vulnerability": { "name": "GHSA-8vvx-rff5-p5rq" }, "action_statement": "Vulnerability GHSA-8vvx-rff5-p5rq affects version 9.0.5 of nodemailer, and is fixed in 9.0.5-tuxcare.2." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.5" } } ], "timestamp": "2026-11-03T17:25:45.061178+00:00", "status_notes": "Vulnerability GHSA-9h6g-pr28-7cqp does not affect version 9.0.5 of nodemailer. not_affected \u2014 The target repository nodemailer 9.0.5 is NOT AFFECTED by GHSA-9h6g-pr28-7cqp. The ReDoS vulnerability patterns have been eliminated through comprehensive fixes that were already present in the upstream nodemailer v9.0.5 release. Both vulnerable locations\u2014the data URI parsing regex in mail-composer and the HTML img src regex in mailer\u2014have been remediated with linear-time string operations and ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-9h6g-pr28-7cqp" }, "impact_statement": "not_affected \u2014 The target repository nodemailer 9.0.5 is NOT AFFECTED by GHSA-9h6g-pr28-7cqp. The ReDoS vulnerability patterns have been eliminated through comprehensive fixes that were already present in the upstream nodemailer v9.0.5 release. Both vulnerable locations\u2014the data URI parsing regex in mail-composer and the HTML img src regex in mailer\u2014have been remediated with linear-time string operations and ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.5" } } ], "timestamp": "2026-11-03T17:26:20.261617+00:00", "status_notes": "Vulnerability GHSA-c7w3-x93f-qmm8 does not affect version 9.0.5 of nodemailer. not_affected \u2014 The target nodemailer 9.0.5-tuxcare.8 is NOT AFFECTED by GHSA-c7w3-x93f-qmm8 (SMTP command injection via CRLF in envelope.size). The vulnerability pattern is not present because the upstream fix commit 2d7b9710e63555a1eb13d721296c51186d4b5651 by Andris Reinman (andris@reinman.eu) was already included in the nodemailer 9.0.5 upstream release before TuxCare began maintaining this version branch. ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-c7w3-x93f-qmm8" }, "impact_statement": "not_affected \u2014 The target nodemailer 9.0.5-tuxcare.8 is NOT AFFECTED by GHSA-c7w3-x93f-qmm8 (SMTP command injection via CRLF in envelope.size). The vulnerability pattern is not present because the upstream fix commit 2d7b9710e63555a1eb13d721296c51186d4b5651 by Andris Reinman (andris@reinman.eu) was already included in the nodemailer 9.0.5 upstream release before TuxCare began maintaining this version branch. ..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.5" } } ], "timestamp": "2026-10-12T14:22:02.231466+00:00", "status_notes": "Vulnerability GHSA-cc9r-2j5m-2m83 affects version 9.0.5 of nodemailer, and is fixed in 9.0.5-tuxcare.2.", "vulnerability": { "name": "GHSA-cc9r-2j5m-2m83" }, "action_statement": "Vulnerability GHSA-cc9r-2j5m-2m83 affects version 9.0.5 of nodemailer, and is fixed in 9.0.5-tuxcare.2." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.5" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-frj6-5rhh-vwfw is a false positive for nodemailer 9.0.5.", "vulnerability": { "name": "GHSA-frj6-5rhh-vwfw" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.5" } } ], "timestamp": "2026-11-04T15:18:23.926764+00:00", "status_notes": "Vulnerability GHSA-g57g-f23g-4646 affects version 9.0.5 of nodemailer, and is fixed in 9.0.5-tuxcare.9.", "vulnerability": { "name": "GHSA-g57g-f23g-4646" }, "action_statement": "Vulnerability GHSA-g57g-f23g-4646 affects version 9.0.5 of nodemailer, and is fixed in 9.0.5-tuxcare.9." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.5" } } ], "timestamp": "2026-10-28T11:41:41.686776+00:00", "status_notes": "Vulnerability GHSA-g73g-hqqh-jr95 affects version 9.0.5 of nodemailer, and is fixed in 9.0.5-tuxcare.8.", "vulnerability": { "name": "GHSA-g73g-hqqh-jr95" }, "action_statement": "Vulnerability GHSA-g73g-hqqh-jr95 affects version 9.0.5 of nodemailer, and is fixed in 9.0.5-tuxcare.8." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.5" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-h3hj-cmcx-xc66 is a false positive for nodemailer 9.0.5.", "vulnerability": { "name": "GHSA-h3hj-cmcx-xc66" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.5" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-jj37-3377-m6vv is a false positive for nodemailer 9.0.5.", "vulnerability": { "name": "GHSA-jj37-3377-m6vv" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.5" } } ], "timestamp": "2026-10-27T11:58:30.826972+00:00", "status_notes": "Vulnerability GHSA-m943-m63m-w62w affects version 9.0.5 of nodemailer, and is fixed in 9.0.5-tuxcare.6.", "vulnerability": { "name": "GHSA-m943-m63m-w62w" }, "action_statement": "Vulnerability GHSA-m943-m63m-w62w affects version 9.0.5 of nodemailer, and is fixed in 9.0.5-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.5" } } ], "timestamp": "2026-10-12T14:22:02.231466+00:00", "status_notes": "Vulnerability GHSA-v53p-9fqp-m79j affects version 9.0.5 of nodemailer, and is fixed in 9.0.5-tuxcare.2.", "vulnerability": { "name": "GHSA-v53p-9fqp-m79j" }, "action_statement": "Vulnerability GHSA-v53p-9fqp-m79j affects version 9.0.5 of nodemailer, and is fixed in 9.0.5-tuxcare.2." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.5" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-vm5r-23w9-m8hx is a false positive for nodemailer 9.0.5.", "vulnerability": { "name": "GHSA-vm5r-23w9-m8hx" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.5" } } ], "timestamp": "2026-11-03T17:17:53.657243+00:00", "status_notes": "Vulnerability GHSA-vvjj-xcjg-gr5g does not affect version 9.0.5 of nodemailer. not_affected \u2014 The target nodemailer 9.0.5-tuxcare.8 is NOT AFFECTED by GHSA-vvjj-xcjg-gr5g (SMTP command injection via CRLF in transport name option). The upstream vendor (Andris Reinman) already fixed this vulnerability in commit 0a43876, which was included in the upstream release before TuxCare onboarded version 9.0.5. The fix sanitizes the name option by stripping all CRLF characters at line 121 of lib/sm...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-vvjj-xcjg-gr5g" }, "impact_statement": "not_affected \u2014 The target nodemailer 9.0.5-tuxcare.8 is NOT AFFECTED by GHSA-vvjj-xcjg-gr5g (SMTP command injection via CRLF in transport name option). The upstream vendor (Andris Reinman) already fixed this vulnerability in commit 0a43876, which was included in the upstream release before TuxCare onboarded version 9.0.5. The fix sanitizes the name option by stripping all CRLF characters at line 121 of lib/sm..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wmmp-3585-3rmp affects version 9.0.5 of nodemailer.", "vulnerability": { "name": "GHSA-wmmp-3585-3rmp" }, "action_statement": "Vulnerability GHSA-wmmp-3585-3rmp affects version 9.0.5 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.5" } } ], "timestamp": "2026-11-03T17:21:51.506888+00:00", "status_notes": "Vulnerability GHSA-wqvq-jvpq-h66f does not affect version 9.0.5 of nodemailer. not_affected \u2014 The target nodemailer 9.0.5-tuxcare.8 is NOT AFFECTED by GHSA-wqvq-jvpq-h66f (jsonTransport access bypass). The vulnerability allowed attackers to bypass disableFileAccess/disableUrlAccess flags when using jsonTransport because shared.resolveContent() did not check these flags before reading files or fetching URLs. The upstream fix (commit 5f69497 by andris@reinman.eu, May 26 2026) added access...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wqvq-jvpq-h66f" }, "impact_statement": "not_affected \u2014 The target nodemailer 9.0.5-tuxcare.8 is NOT AFFECTED by GHSA-wqvq-jvpq-h66f (jsonTransport access bypass). The vulnerability allowed attackers to bypass disableFileAccess/disableUrlAccess flags when using jsonTransport because shared.resolveContent() did not check these flags before reading files or fetching URLs. The upstream fix (commit 5f69497 by andris@reinman.eu, May 26 2026) added access..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.5" } } ], "timestamp": "2026-10-22T17:05:00.556684+00:00", "status_notes": "Vulnerability GHSA-wxxx-r42m-9rp8 is a false positive for nodemailer 9.0.5.", "vulnerability": { "name": "GHSA-wxxx-r42m-9rp8" }, "impact_statement": "The vulnerability has been withdrawn." } ] }