{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:a1118322-e873-5ffb-aaaa-74a7797d547e",
  "version": 1,
  "metadata": {
    "tools": [
      {
        "name": "tuxcare-vex-generator",
        "version": "1.0.0"
      }
    ]
  },
  "components": [
    {
      "bom-ref": "pkg:npm/nodemailer@0.7.1-tuxcare.1",
      "type": "library",
      "name": "nodemailer",
      "version": "0.7.1-tuxcare.1",
      "purl": "pkg:npm/nodemailer@0.7.1-tuxcare.1"
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "urn:uuid:9e7f4bfb-f3a8-5ed5-b20d-eaac230f435c",
      "id": "CVE-2017-20162",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2017-20162 is fixed in version 0.7.1-tuxcare.1 of nodemailer."
      },
      "affects": [
        {
          "ref": "pkg:npm/nodemailer@0.7.1-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:b5c6871a-fd9b-5b5c-83a0-1714c0a920f4",
      "id": "CVE-2020-7769",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2020-7769 is fixed in version 0.7.1-tuxcare.1 of nodemailer."
      },
      "affects": [
        {
          "ref": "pkg:npm/nodemailer@0.7.1-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:65aae61c-b394-5d6b-bad2-4badfffab8c6",
      "id": "CVE-2021-23400",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-23400 does not affect version 0.7.1-tuxcare.1 of nodemailer. not_affected \u2014 Version 0.7.1 is not affected by CVE-2021-23400. The vulnerability exists in nodemailer's internal address formatting code (lib/mime-node/index.js _normalizeAddress method) introduced in later versions (4.x+) when mailcomposer was internalized. Version 0.7.1 uses external mailcomposer package (~0.2.10) for all address formatting and does not contain the vulnerable code pattern in its own codebase."
      },
      "affects": [
        {
          "ref": "pkg:npm/nodemailer@0.7.1-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:3ca0c11c-7f51-51e6-aaec-2d2ae8a03740",
      "id": "CVE-2025-13033",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-13033 does not affect version 0.7.1-tuxcare.1 of nodemailer. not_affected \u2014 Version 0.7.1 does not contain the vulnerable addressparser module. The addressparser was introduced in nodemailer v3.0.0 (January 2017), years after version 0.7.1. The vulnerability pattern (email address extraction from text tokens using regex) does not exist in 0.7.1's architecture."
      },
      "affects": [
        {
          "ref": "pkg:npm/nodemailer@0.7.1-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f0178b2a-7a3a-5f78-b21e-f6f54afb464b",
      "id": "CVE-2025-14874",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-14874 does not affect version 0.7.1-tuxcare.1 of nodemailer. not_affected \u2014 Version 0.7.1 is not affected by CVE-2025-14874. The vulnerable lib/addressparser/index.js module with recursive group-flattening logic was introduced in v3.0.0 (2017-01-31), 2.5 years after v0.7.1 (2014-07-09). Version 0.7.1 uses a different architecture where address handling is delegated to the mailcomposer external dependency, and contains no recursive address parsing code."
      },
      "affects": [
        {
          "ref": "pkg:npm/nodemailer@0.7.1-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:f6d59128-6f14-58ac-adac-7d923b648b4d",
      "id": "GHSA-268h-hp4c-crq3",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability GHSA-268h-hp4c-crq3 does not affect version 0.7.1-tuxcare.1 of nodemailer. not_affected \u2014 Version 0.7.1 does not contain the List-* header functionality that is vulnerable to CRLF injection. The entire `list` message option and associated header generation code does not exist in this architecture."
      },
      "affects": [
        {
          "ref": "pkg:npm/nodemailer@0.7.1-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:6ffc2217-135f-55af-8188-94eebb139953",
      "id": "GHSA-46j5-6fg5-4gv3",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability GHSA-46j5-6fg5-4gv3 is a false positive for nodemailer 0.7.1-tuxcare.1."
      },
      "affects": [
        {
          "ref": "pkg:npm/nodemailer@0.7.1-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:cd322c9b-c3a5-59fd-a777-3f38733a4d7b",
      "id": "GHSA-9h6g-pr28-7cqp",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability GHSA-9h6g-pr28-7cqp does not affect version 0.7.1-tuxcare.1 of nodemailer. not_affected \u2014 Nodemailer version 0.7.1 is not affected by GHSA-9h6g-pr28-7cqp. The ReDoS vulnerability exists in data URI parsing functionality that was not introduced until version 1.2.2. Version 0.7.1 does not contain any data URI processing code and therefore cannot be exploited via this attack vector."
      },
      "affects": [
        {
          "ref": "pkg:npm/nodemailer@0.7.1-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:0cae2ee1-bcc2-5652-b251-027e5b22d4e0",
      "id": "GHSA-c7w3-x93f-qmm8",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability GHSA-c7w3-x93f-qmm8 does not affect version 0.7.1-tuxcare.1 of nodemailer. not_affected \u2014 Nodemailer version 0.7.1 is not affected by GHSA-c7w3-x93f-qmm8. This version uses a fundamentally different architecture where all SMTP protocol handling and command construction is delegated to the external 'simplesmtp' npm package. The vulnerable code path (lib/smtp-connection/index.js with unsanitized envelope.size concatenation into MAIL FROM commands) does not exist in version 0.7.1 and w..."
      },
      "affects": [
        {
          "ref": "pkg:npm/nodemailer@0.7.1-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:4f1fce7c-8fb6-5958-850e-690e7e81ccff",
      "id": "GHSA-jj37-3377-m6vv",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability GHSA-jj37-3377-m6vv is a false positive for nodemailer 0.7.1-tuxcare.1."
      },
      "affects": [
        {
          "ref": "pkg:npm/nodemailer@0.7.1-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:360b5165-5fc0-53e7-bce0-d053e8e7ea0f",
      "id": "GHSA-p6gq-j5cr-w38f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability GHSA-p6gq-j5cr-w38f does not affect version 0.7.1-tuxcare.1 of nodemailer. not_affected \u2014 Version 0.7.1 of nodemailer is not affected by GHSA-p6gq-j5cr-w38f. The vulnerability concerns bypassing disableFileAccess/disableUrlAccess security flags when using the message-level 'raw' option, but version 0.7.1 has neither the 'raw' message option nor the security flags. The target uses a fundamentally different architecture (external mailcomposer package) that predates the security model ..."
      },
      "affects": [
        {
          "ref": "pkg:npm/nodemailer@0.7.1-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:eac98da5-f33e-5576-bf12-466c68e36fe4",
      "id": "GHSA-r7g4-qg5f-qqm2",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability GHSA-r7g4-qg5f-qqm2 does not affect version 0.7.1-tuxcare.1 of nodemailer. not_affected \u2014 Nodemailer version 0.7.1 is not affected by GHSA-r7g4-qg5f-qqm2. The vulnerability concerns nodemailer's internal HTTPS fetch client (lib/fetch/index.js) that disables TLS certificate verification (rejectUnauthorized: false) when making OAuth2 token requests. Version 0.7.1 does not contain this vulnerable code path - it lacks both lib/fetch/ and lib/xoauth2/ directories and delegates all OAuth2..."
      },
      "affects": [
        {
          "ref": "pkg:npm/nodemailer@0.7.1-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:2e4ba1aa-710a-552d-8321-821be248a760",
      "id": "GHSA-vvjj-xcjg-gr5g",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability GHSA-vvjj-xcjg-gr5g does not affect version 0.7.1-tuxcare.1 of nodemailer. not_affected \u2014 Version 0.7.1 uses a fundamentally different architecture than the affected versions. The vulnerability exists in lib/smtp-connection/index.js (lines 1333, 1336, 1384, 1517, 1520) where modern nodemailer constructs EHLO/HELO/LHLO commands using unsanitized name input. Version 0.7.1 does not contain this file or code. Instead, it delegates all SMTP protocol handling to the external 'simplesmtp' ..."
      },
      "affects": [
        {
          "ref": "pkg:npm/nodemailer@0.7.1-tuxcare.1"
        }
      ]
    },
    {
      "bom-ref": "urn:uuid:4a38b177-0fb0-5fe8-b643-8c2e4ddc5ff1",
      "id": "GHSA-wqvq-jvpq-h66f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability GHSA-wqvq-jvpq-h66f does not affect version 0.7.1-tuxcare.1 of nodemailer. not_affected \u2014 Version 0.7.1 does not contain the vulnerability pattern described in GHSA-wqvq-jvpq-h66f. The vulnerability requires jsonTransport feature and disableFileAccess/disableUrlAccess security controls to exist so they can be bypassed. Version 0.7.1 uses a fundamentally different architecture that predates these features entirely."
      },
      "affects": [
        {
          "ref": "pkg:npm/nodemailer@0.7.1-tuxcare.1"
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/nodemailer@0.7.1-tuxcare.1"
    }
  ]
}