nodemailer vulnerabilities
26 published CVEs name nodemailer among the affected products.
- 26Published CVEs26 of them scored
- 26Last 12 monthspublished in the last year
- 1Critical17 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-125755
Nodemailer 3.0.0 before 10.4.1 Recipient Allow-List Bypass via addressparser
nodemailer · nodemailer
High8.3 - CVE-2026-121426
Nodemailer 3.0.0 before 10.1.4 Recipient Domain Confusion via addressparser
nodemailer · nodemailer
High8.3 - CVE-2026-121425
Nodemailer 3.0.0 before 10.1.4 Recipient Injection via addressparser Group Parsing
nodemailer · nodemailer
High8.3 - CVE-2026-121424
Nodemailer 3.0.0 before 10.1.4 Address Parsing Bypass via Nested Comments
nodemailer · nodemailer
High8.3 - CVE-2026-110872
Nodemailer 3.0.0 before 10.0.10 Denial of Service via SMTP Reply Parsing
nodemailer · nodemailer
High8.2 - CVE-2026-110871
Nodemailer 3.0.0 before 10.0.10 Quadratic DKIM Header Unfolding Denial of Service
nodemailer · nodemailer
High7.1 - CVE-2026-110870
Nodemailer before 10.0.13 Improper Input Validation via Angle-Bracket Address Comments
nodemailer · nodemailer
Medium6.9 - CVE-2026-110869
Nodemailer 3.0.0 before 10.0.13 ReDoS via SMTP AUTH Mechanism Detection Regexes
nodemailer · nodemailer
High8.7 - CVE-2026-100702
Nodemailer before 10.0.2 Stack Exhaustion via Nested Recipient Arrays
nodemailer · nodemailer
High8.2 - CVE-2026-100701
Nodemailer 5.0.0 through 10.0.1 TLS servername Cache Confusion
nodemailer · nodemailer
Medium6.0