pwnmyvibecode_

Nodemailer vulnerabilities and security advisories

The newest reviewed advisories for nodemailer on npm. Each one shows which versions are affected, which version fixes it, and a prompt that has your AI agent check your project and upgrade only if it needs to.

Get an email when Nodemailer has a new one

Email alerts are coming soon. This page updates every hour.

$ latest 15 · 4 critical, high or exploited

  • mediumSep 8, 2026

    Nodemailer: IDN/Punycode domain allow-list bypass leads to email delivery to an attacker-controlled domain

    • nodemailer < 9.1.0 · fixed in 9.1.0
    GHSA-wmmp-3585-3rmp
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-wmmp-3585-3rmp, severity medium
What it is: Nodemailer: IDN/Punycode domain allow-list bypass leads to email delivery to an attacker-controlled domain
Affected packages:
- nodemailer: affected versions < 9.1.0. Fixed in 9.1.0.
Details: https://github.com/advisories/GHSA-wmmp-3585-3rmp

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • highSep 8, 2026

    Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address list

    • nodemailer < 9.1.0 · fixed in 9.1.0
    GHSA-2x7j-588g-ccc2
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-2x7j-588g-ccc2, severity high
What it is: Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address list
Affected packages:
- nodemailer: affected versions < 9.1.0. Fixed in 9.1.0.
Details: https://github.com/advisories/GHSA-2x7j-588g-ccc2

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • mediumSep 8, 2026

    Nodemailer: Recipient-domain validation bypass via RFC 5322 comment mis-parsing leads to email delivery to an attacker-controlled domain

    • nodemailer >= 6.9.16, < 9.1.0 · fixed in 9.1.0
    GHSA-cc9r-2j5m-2m83
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-cc9r-2j5m-2m83, severity medium
What it is: Nodemailer: Recipient-domain validation bypass via RFC 5322 comment mis-parsing leads to email delivery to an attacker-controlled domain
Affected packages:
- nodemailer: affected versions >= 6.9.16, < 9.1.0. Fixed in 9.1.0.
Details: https://github.com/advisories/GHSA-cc9r-2j5m-2m83

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • mediumSep 8, 2026

    Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disableUrlAccess when called with the legacy signature

    • nodemailer <= 9.1.0 · fixed in 9.1.1
    GHSA-8m3c-c648-2xjj
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-8m3c-c648-2xjj, severity medium
What it is: Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disableUrlAccess when called with the legacy signature
Affected packages:
- nodemailer: affected versions <= 9.1.0. Fixed in 9.1.1.
Details: https://github.com/advisories/GHSA-8m3c-c648-2xjj

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • highJun 18, 2026

    Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered message

    • nodemailer <= 9.0.0 · fixed in 9.0.1
    GHSA-p6gq-j5cr-w38fCVE-2026-82659
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-p6gq-j5cr-w38f (CVE-2026-82659), severity high
What it is: Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered message
Affected packages:
- nodemailer: affected versions <= 9.0.0. Fixed in 9.0.1.
Details: https://github.com/advisories/GHSA-p6gq-j5cr-w38f

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • mediumJun 15, 2026

    Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message header injection

    • nodemailer <= 8.0.8 · fixed in 8.0.9
    GHSA-268h-hp4c-crq3
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-268h-hp4c-crq3, severity medium
What it is: Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message header injection
Affected packages:
- nodemailer: affected versions <= 8.0.8. Fixed in 8.0.9.
Details: https://github.com/advisories/GHSA-268h-hp4c-crq3

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • mediumJun 15, 2026

    Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess during message normalization

    • nodemailer <= 8.0.8 · fixed in 8.0.9
    GHSA-wqvq-jvpq-h66f
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-wqvq-jvpq-h66f, severity medium
What it is: Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess during message normalization
Affected packages:
- nodemailer: affected versions <= 8.0.8. Fixed in 8.0.9.
Details: https://github.com/advisories/GHSA-wqvq-jvpq-h66f

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • mediumJun 15, 2026

    Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interception

    • nodemailer <= 8.0.7 · fixed in 8.0.8
    GHSA-r7g4-qg5f-qqm2
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-r7g4-qg5f-qqm2, severity medium
What it is: Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interception
Affected packages:
- nodemailer: affected versions <= 8.0.7. Fixed in 8.0.8.
Details: https://github.com/advisories/GHSA-r7g4-qg5f-qqm2

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • mediumApr 8, 2026

    Nodemailer Vulnerable to SMTP Command Injection via CRLF in Transport name Option (EHLO/HELO)

    • nodemailer <= 8.0.4 · fixed in 8.0.5
    GHSA-vvjj-xcjg-gr5g
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-vvjj-xcjg-gr5g, severity medium
What it is: Nodemailer Vulnerable to SMTP Command Injection via CRLF in Transport name Option (EHLO/HELO)
Affected packages:
- nodemailer: affected versions <= 8.0.4. Fixed in 8.0.5.
Details: https://github.com/advisories/GHSA-vvjj-xcjg-gr5g

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • lowMar 26, 2026

    Nodemailer has SMTP command injection due to unsanitized `envelope.size` parameter

    • nodemailer < 8.0.4 · fixed in 8.0.4
    GHSA-c7w3-x93f-qmm8
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-c7w3-x93f-qmm8, severity low
What it is: Nodemailer has SMTP command injection due to unsanitized `envelope.size` parameter
Affected packages:
- nodemailer: affected versions < 8.0.4. Fixed in 8.0.4.
Details: https://github.com/advisories/GHSA-c7w3-x93f-qmm8

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • highDec 1, 2025

    Nodemailer’s addressparser is vulnerable to DoS caused by recursive calls

    • nodemailer >= 3.0.0, <= 7.0.10 · fixed in 7.0.11
    GHSA-rcmh-qjqh-p98vCVE-2025-14874
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-rcmh-qjqh-p98v (CVE-2025-14874), severity high
What it is: Nodemailer’s addressparser is vulnerable to DoS caused by recursive calls
Affected packages:
- nodemailer: affected versions >= 3.0.0, <= 7.0.10. Fixed in 7.0.11.
Details: https://github.com/advisories/GHSA-rcmh-qjqh-p98v

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • mediumOct 7, 2025

    Nodemailer: Email to an unintended domain can occur due to Interpretation Conflict

    • nodemailer < 7.0.7 · fixed in 7.0.7
    GHSA-mm7p-fcc7-pg87CVE-2025-13033
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-mm7p-fcc7-pg87 (CVE-2025-13033), severity medium
What it is: Nodemailer: Email to an unintended domain can occur due to Interpretation Conflict
Affected packages:
- nodemailer: affected versions < 7.0.7. Fixed in 7.0.7.
Details: https://github.com/advisories/GHSA-mm7p-fcc7-pg87

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • mediumJan 31, 2024

    nodemailer ReDoS when trying to send a specially crafted email

    • nodemailer <= 6.9.8 · fixed in 6.9.9
    GHSA-9h6g-pr28-7cqp
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-9h6g-pr28-7cqp, severity medium
What it is: nodemailer ReDoS when trying to send a specially crafted email
Affected packages:
- nodemailer: affected versions <= 6.9.8. Fixed in 6.9.9.
Details: https://github.com/advisories/GHSA-9h6g-pr28-7cqp

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • mediumDec 10, 2021

    Header injection in nodemailer

    • nodemailer < 6.6.1 · fixed in 6.6.1
    GHSA-hwqf-gcqm-7353CVE-2021-23400
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-hwqf-gcqm-7353 (CVE-2021-23400), severity medium
What it is: Header injection in nodemailer
Affected packages:
- nodemailer: affected versions < 6.6.1. Fixed in 6.6.1.
Details: https://github.com/advisories/GHSA-hwqf-gcqm-7353

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.
  • criticalMay 10, 2021

    Command injection in nodemailer

    • nodemailer < 6.4.16 · fixed in 6.4.16
    GHSA-48ww-j4fc-435pCVE-2020-7769
    prompt for your AI agent
    paste into your agent
    A security advisory covers a package this project may use.

Advisory: GHSA-48ww-j4fc-435p (CVE-2020-7769), severity critical
What it is: Command injection in nodemailer
Affected packages:
- nodemailer: affected versions < 6.4.16. Fixed in 6.4.16.
Details: https://github.com/advisories/GHSA-48ww-j4fc-435p

Please:
1. Check package.json and the lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock or bun.lock) for these packages, including copies pulled in by other dependencies, and tell me which versions are installed.
2. If none of them are installed, or every installed version is outside the affected ranges, say so and change nothing.
3. If an installed version is affected, upgrade it to the fixed version for its release line or later. When the package only comes in through another dependency, upgrade that dependency, or add an override or resolution if it has no fixed release yet.
4. If there is no fixed version, read the advisory and apply its workaround, or tell me the options.
5. Reinstall, run the build and the tests, and fix anything the upgrade breaks.
6. Tell me what you changed and which versions are installed now.

From the GitHub Advisory Database, refreshed hourly. Full history on GitHub.

Keeping Nodemailer patched

  • npm audit (or pnpm audit) lists known vulnerable packages in your lockfile, including ones pulled in by other packages.
  • Turn on Dependabot for your GitHub repo and it opens the upgrade for you when an advisory lands.
  • A patched framework doesn't cover your own setup: headers, cookies and HTTPS. The free check looks at those.