{
  "@id": "urn:uuid:26d7695b-ca1a-429b-ad6e-6a3f7d068560",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 23,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-14T01:09:00.039410+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.13",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.13"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2020-7769 affects version 10.0.13 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2020-7769"
      },
      "action_statement": "Vulnerability CVE-2020-7769 affects version 10.0.13 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.13",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.13"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2021-23400 affects version 10.0.13 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2021-23400"
      },
      "action_statement": "Vulnerability CVE-2021-23400 affects version 10.0.13 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.13",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.13"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2025-13033 affects version 10.0.13 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2025-13033"
      },
      "action_statement": "Vulnerability CVE-2025-13033 affects version 10.0.13 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.13",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.13"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2025-14874 affects version 10.0.13 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2025-14874"
      },
      "action_statement": "Vulnerability CVE-2025-14874 affects version 10.0.13 of nodemailer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.13",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.13"
          }
        }
      ],
      "timestamp": "2026-11-14T00:46:00.044001+00:00",
      "status_notes": "Vulnerability CVE-2026-110871 does not affect version 10.0.13 of nodemailer. not_affected \u2014 Not affected. The target (nodemailer 10.0.13) already has the upstream fix, commit 28a5909 \"fix(dkim): unfold folded header lines in linear time\" by andris@reinman.eu. MessageParser.parseHeaders in src/dkim/message-parser.ts now unfolds in one forward pass and tests only freshly split lines against /^[ \\t]/. The quadratic backward loop that re-tested the growing merged line is gone.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-110871"
      },
      "impact_statement": "not_affected \u2014 Not affected. The target (nodemailer 10.0.13) already has the upstream fix, commit 28a5909 \"fix(dkim): unfold folded header lines in linear time\" by andris@reinman.eu. MessageParser.parseHeaders in src/dkim/message-parser.ts now unfolds in one forward pass and tests only freshly split lines against /^[ \\t]/. The quadratic backward loop that re-tested the growing merged line is gone."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.13",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.13"
          }
        }
      ],
      "timestamp": "2026-11-03T14:36:48.497569+00:00",
      "status_notes": "Vulnerability CVE-2026-121424 affects version 10.0.13 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-121424"
      },
      "action_statement": "Vulnerability CVE-2026-121424 affects version 10.0.13 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.13",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.13"
          }
        }
      ],
      "timestamp": "2026-11-03T14:36:48.497569+00:00",
      "status_notes": "Vulnerability CVE-2026-121425 affects version 10.0.13 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-121425"
      },
      "action_statement": "Vulnerability CVE-2026-121425 affects version 10.0.13 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.13",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.13"
          }
        }
      ],
      "timestamp": "2026-11-03T14:36:48.497569+00:00",
      "status_notes": "Vulnerability CVE-2026-121426 affects version 10.0.13 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-121426"
      },
      "action_statement": "Vulnerability CVE-2026-121426 affects version 10.0.13 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.13",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.13"
          }
        }
      ],
      "timestamp": "2026-11-10T15:30:00.075367+00:00",
      "status_notes": "Vulnerability CVE-2026-125755 affects version 10.0.13 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-125755"
      },
      "action_statement": "Vulnerability CVE-2026-125755 affects version 10.0.13 of nodemailer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.13",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.13"
          }
        }
      ],
      "timestamp": "2026-11-13T22:32:00.034202+00:00",
      "status_notes": "Vulnerability CVE-2026-82659 does not affect version 10.0.13 of nodemailer. not_affected \u2014 The upstream fix for the raw-option access-flag bypass is already in this target (nodemailer 10.0.13). MailComposer.compile() now passes disableUrlAccess and disableFileAccess to the raw root MimeNode. MimeNode._getStream also checks _accessDisabled(), which walks the parent chain, so the flags cannot be lost. The fix is upstream-authored and shipped in the release TuxCare onboarded, so the ver...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-82659"
      },
      "impact_statement": "not_affected \u2014 The upstream fix for the raw-option access-flag bypass is already in this target (nodemailer 10.0.13). MailComposer.compile() now passes disableUrlAccess and disableFileAccess to the raw root MimeNode. MimeNode._getStream also checks _accessDisabled(), which walks the parent chain, so the flags cannot be lost. The fix is upstream-authored and shipped in the release TuxCare onboarded, so the ver..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.13",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.13"
          }
        }
      ],
      "timestamp": "2026-11-13T23:13:04.466781+00:00",
      "status_notes": "Vulnerability CVE-2026-82662 does not affect version 10.0.13 of nodemailer. not_affected \u2014 Target (nodemailer 10.0.13) already validates TLS certificates by default in the internal fetch client and in the OAuth2 token request. The upstream fix was shipped in the upstream release, so the vulnerable `rejectUnauthorized: false` default is not present.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-82662"
      },
      "impact_statement": "not_affected \u2014 Target (nodemailer 10.0.13) already validates TLS certificates by default in the internal fetch client and in the OAuth2 token request. The upstream fix was shipped in the upstream release, so the vulnerable `rejectUnauthorized: false` default is not present."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.13",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.13"
          }
        }
      ],
      "timestamp": "2026-11-13T23:28:00.053366+00:00",
      "status_notes": "Vulnerability CVE-2026-82854 does not affect version 10.0.13 of nodemailer. not_affected \u2014 Not affected. The upstream fix 2d7b971 (\"sanitize envelope size to prevent SMTP command injection\") is already in HEAD (version 10.0.13). The envelope size is coerced to a number before it is appended to MAIL FROM, so CRLF cannot reach the SMTP command line.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-82854"
      },
      "impact_statement": "not_affected \u2014 Not affected. The upstream fix 2d7b971 (\"sanitize envelope size to prevent SMTP command injection\") is already in HEAD (version 10.0.13). The envelope size is coerced to a number before it is appended to MAIL FROM, so CRLF cannot reach the SMTP command line."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.13",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.13"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2026-90776 affects version 10.0.13 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-90776"
      },
      "action_statement": "Vulnerability CVE-2026-90776 affects version 10.0.13 of nodemailer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.13",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.13"
          }
        }
      ],
      "timestamp": "2026-11-13T22:17:00.046957+00:00",
      "status_notes": "Vulnerability GHSA-268h-hp4c-crq3 does not affect version 10.0.13 of nodemailer. not_affected \u2014 nodemailer 10.0.13 already contains the upstream fix for GHSA-268h-hp4c-crq3. _getListHeaders in src/mailer/mail-message.ts replaces CR/LF in list comments with spaces before the prepared List-* value is built, so no standalone injected header line can be emitted. The fix is upstream commit 5f69497 (author andris@reinman.eu). It is an ancestor of HEAD, and HEAD's history has no TuxCare commit.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-268h-hp4c-crq3"
      },
      "impact_statement": "not_affected \u2014 nodemailer 10.0.13 already contains the upstream fix for GHSA-268h-hp4c-crq3. _getListHeaders in src/mailer/mail-message.ts replaces CR/LF in list comments with spaces before the prepared List-* value is built, so no standalone injected header line can be emitted. The fix is upstream commit 5f69497 (author andris@reinman.eu). It is an ancestor of HEAD, and HEAD's history has no TuxCare commit."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.13",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.13"
          }
        }
      ],
      "timestamp": "2026-11-13T22:45:11.501462+00:00",
      "status_notes": "Vulnerability GHSA-2x7j-588g-ccc2 does not affect version 10.0.13 of nodemailer. not_affected \u2014 Target is nodemailer 10.0.13 (TypeScript build), which is later than the 9.1.0 release that fixed GHSA-2x7j-588g-ccc2. All the fixes are already in the shipped upstream code. src/addressparser/index.ts accumulates in place with push (no per-address concat) and folds display-name fragments in one back-to-front pass instead of splicing. MimeNode._convertAddresses uses a Set for uniqueness. _parse...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-2x7j-588g-ccc2"
      },
      "impact_statement": "not_affected \u2014 Target is nodemailer 10.0.13 (TypeScript build), which is later than the 9.1.0 release that fixed GHSA-2x7j-588g-ccc2. All the fixes are already in the shipped upstream code. src/addressparser/index.ts accumulates in place with push (no per-address concat) and folds display-name fragments in one back-to-front pass instead of splicing. MimeNode._convertAddresses uses a Set for uniqueness. _parse..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.13",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.13"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-46j5-6fg5-4gv3 is a false positive for nodemailer 10.0.13.",
      "vulnerability": {
        "name": "GHSA-46j5-6fg5-4gv3"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.13",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.13"
          }
        }
      ],
      "timestamp": "2026-11-14T00:53:00.050388+00:00",
      "status_notes": "Vulnerability GHSA-4ffr-jq9g-5ffx does not affect version 10.0.13 of nodemailer. not_affected \u2014 Target 10.0.13 already contains the upstream fix b5a896f (\"read the advertised SASL methods without backtracking regexes\"). The four ambiguous AUTH mechanism regexes are gone from _actionEHLO and replaced by a linear-time tokenizer. The fix is authored by the upstream maintainer (andris@reinman.eu) and shipped in the upstream release.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-4ffr-jq9g-5ffx"
      },
      "impact_statement": "not_affected \u2014 Target 10.0.13 already contains the upstream fix b5a896f (\"read the advertised SASL methods without backtracking regexes\"). The four ambiguous AUTH mechanism regexes are gone from _actionEHLO and replaced by a linear-time tokenizer. The fix is authored by the upstream maintainer (andris@reinman.eu) and shipped in the upstream release."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.13",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.13"
          }
        }
      ],
      "timestamp": "2026-11-14T00:54:50.858005+00:00",
      "status_notes": "Vulnerability GHSA-4g23-2xm8-66gc does not affect version 10.0.13 of nodemailer. not_affected \u2014 Target 10.0.13 already contains the upstream fix f2d82fa (\"reassemble multiline replies in linear time\", author andris@reinman.eu). _onData now tracks continuation state per line with isPartialLine(lines[i]) and a _responsePartial flag, rather than re-slicing the growing accumulator. It also enforces maxResponseSize (default 1 MB) on both the partial reply entry and the line remainder. The quad...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-4g23-2xm8-66gc"
      },
      "impact_statement": "not_affected \u2014 Target 10.0.13 already contains the upstream fix f2d82fa (\"reassemble multiline replies in linear time\", author andris@reinman.eu). _onData now tracks continuation state per line with isPartialLine(lines[i]) and a _responsePartial flag, rather than re-slicing the growing accumulator. It also enforces maxResponseSize (default 1 MB) on both the partial reply entry and the line remainder. The quad..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.13",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.13"
          }
        }
      ],
      "timestamp": "2026-11-13T23:50:46.957981+00:00",
      "status_notes": "Vulnerability GHSA-6vj9-mwq6-2f5v does not affect version 10.0.13 of nodemailer. not_affected \u2014 Target nodemailer 10.0.13 already contains the upstream fix a6512db (\"keep the TLS server name out of the DNS cache\"). The DNS cache stores only addresses. The server name is computed from each caller's own options.servername on every resolveHostname call. The fix shipped in the upstream release, before the first TuxCare commit, which is the build config at HEAD.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-6vj9-mwq6-2f5v"
      },
      "impact_statement": "not_affected \u2014 Target nodemailer 10.0.13 already contains the upstream fix a6512db (\"keep the TLS server name out of the DNS cache\"). The DNS cache stores only addresses. The server name is computed from each caller's own options.servername on every resolveHostname call. The fix shipped in the upstream release, before the first TuxCare commit, which is the build config at HEAD."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.13",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.13"
          }
        }
      ],
      "timestamp": "2026-10-23T22:01:00.144162+00:00",
      "status_notes": "Vulnerability GHSA-85x2-q946-cp5h affects version 10.0.13 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-85x2-q946-cp5h"
      },
      "action_statement": "Vulnerability GHSA-85x2-q946-cp5h affects version 10.0.13 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.13",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.13"
          }
        }
      ],
      "timestamp": "2026-10-23T22:01:00.144162+00:00",
      "status_notes": "Vulnerability GHSA-8c8m-p3m8-cjg8 affects version 10.0.13 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-8c8m-p3m8-cjg8"
      },
      "action_statement": "Vulnerability GHSA-8c8m-p3m8-cjg8 affects version 10.0.13 of nodemailer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.13",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.13"
          }
        }
      ],
      "timestamp": "2026-11-13T22:32:00.034202+00:00",
      "status_notes": "Vulnerability GHSA-8m3c-c648-2xjj does not affect version 10.0.13 of nodemailer. not_affected \u2014 Nodemailer 10.0.13 is not affected. The public MailMessage.resolveContent wrapper in src/mailer/mail-message.ts already merges the message-level disableFileAccess/disableUrlAccess flags into the policy it passes to shared.resolveContent, so the legacy (data, key, callback) signature no longer drops the sandbox. This was present in the upstream TypeScript migration commit f7cbf83 (author andris@...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-8m3c-c648-2xjj"
      },
      "impact_statement": "not_affected \u2014 Nodemailer 10.0.13 is not affected. The public MailMessage.resolveContent wrapper in src/mailer/mail-message.ts already merges the message-level disableFileAccess/disableUrlAccess flags into the policy it passes to shared.resolveContent, so the legacy (data, key, callback) signature no longer drops the sandbox. This was present in the upstream TypeScript migration commit f7cbf83 (author andris@..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.13",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.13"
          }
        }
      ],
      "timestamp": "2026-11-13T23:55:52.993069+00:00",
      "status_notes": "Vulnerability GHSA-8vvx-rff5-p5rq does not affect version 10.0.13 of nodemailer. not_affected \u2014 Target 10.0.13 already contains the upstream fix (commit ebe0849, \"flatten nested recipient arrays without recursion\", by Andris Reinman). MimeNode._parseAddresses now walks nested arrays with an explicit stack and a WeakSet. Arrays are never passed to addressparser or stringified, so the deep-nesting stack overflow cannot occur. The fix shipped in the upstream release, and HEAD has no TuxCare-...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-8vvx-rff5-p5rq"
      },
      "impact_statement": "not_affected \u2014 Target 10.0.13 already contains the upstream fix (commit ebe0849, \"flatten nested recipient arrays without recursion\", by Andris Reinman). MimeNode._parseAddresses now walks nested arrays with an explicit stack and a WeakSet. Arrays are never passed to addressparser or stringified, so the deep-nesting stack overflow cannot occur. The fix shipped in the upstream release, and HEAD has no TuxCare-..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.13",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.13"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-9h6g-pr28-7cqp affects version 10.0.13 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-9h6g-pr28-7cqp"
      },
      "action_statement": "Vulnerability GHSA-9h6g-pr28-7cqp affects version 10.0.13 of nodemailer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.13",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.13"
          }
        }
      ],
      "timestamp": "2026-11-13T22:09:23.418068+00:00",
      "status_notes": "Vulnerability GHSA-c7w3-x93f-qmm8 does not affect version 10.0.13 of nodemailer. not_affected \u2014 Not affected. The target (nodemailer 10.0.13) already coerces envelope.size to a number before building the MAIL FROM SIZE= argument. This is the upstream fix, which shipped in the upstream release; HEAD's history has no TuxCare commits. CRLF in envelope.size therefore cannot reach the SMTP socket.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-c7w3-x93f-qmm8"
      },
      "impact_statement": "not_affected \u2014 Not affected. The target (nodemailer 10.0.13) already coerces envelope.size to a number before building the MAIL FROM SIZE= argument. This is the upstream fix, which shipped in the upstream release; HEAD's history has no TuxCare commits. CRLF in envelope.size therefore cannot reach the SMTP socket."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.13",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.13"
          }
        }
      ],
      "timestamp": "2026-11-13T22:57:00.061178+00:00",
      "status_notes": "Vulnerability GHSA-cc9r-2j5m-2m83 does not affect version 10.0.13 of nodemailer. not_affected \u2014 The target (nodemailer 10.0.13) already contains the upstream fix 902b63e for GHSA-cc9r-2j5m-2m83. In src/addressparser/index.ts, _handleAddress only joins a token across a comment-closing ')' when one side carries '@'. 'user@good-corp.com(x)evil.com' therefore no longer collapses into 'good-corp.comevil.com'. The fix shipped in the upstream release and was authored by the upstream maintainer, ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-cc9r-2j5m-2m83"
      },
      "impact_statement": "not_affected \u2014 The target (nodemailer 10.0.13) already contains the upstream fix 902b63e for GHSA-cc9r-2j5m-2m83. In src/addressparser/index.ts, _handleAddress only joins a token across a comment-closing ')' when one side carries '@'. 'user@good-corp.com(x)evil.com' therefore no longer collapses into 'good-corp.comevil.com'. The fix shipped in the upstream release and was authored by the upstream maintainer, ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.13",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.13"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-frj6-5rhh-vwfw is a false positive for nodemailer 10.0.13.",
      "vulnerability": {
        "name": "GHSA-frj6-5rhh-vwfw"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.13",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.13"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-g57g-f23g-4646 affects version 10.0.13 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-g57g-f23g-4646"
      },
      "action_statement": "Vulnerability GHSA-g57g-f23g-4646 affects version 10.0.13 of nodemailer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.13",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.13"
          }
        }
      ],
      "timestamp": "2026-11-14T01:09:00.039410+00:00",
      "status_notes": "Vulnerability GHSA-g73g-hqqh-jr95 does not affect version 10.0.13 of nodemailer. not_affected \u2014 Target (nodemailer 10.0.13) already contains the upstream fix for GHSA-g73g-hqqh-jr95. Upstream commit a502247 (\"strip comments inside an angle-addr before it becomes the address\", author andris@reinman.eu) is an ancestor of HEAD and shipped in release 10.0.13. It adds _stripAddressComments() and calls it in _handleAddress() on every angle-address part, so 'Name <user@good-corp.com(x)evil.com>'...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-g73g-hqqh-jr95"
      },
      "impact_statement": "not_affected \u2014 Target (nodemailer 10.0.13) already contains the upstream fix for GHSA-g73g-hqqh-jr95. Upstream commit a502247 (\"strip comments inside an angle-addr before it becomes the address\", author andris@reinman.eu) is an ancestor of HEAD and shipped in release 10.0.13. It adds _stripAddressComments() and calls it in _handleAddress() on every angle-address part, so 'Name <user@good-corp.com(x)evil.com>'..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.13",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.13"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-h3hj-cmcx-xc66 is a false positive for nodemailer 10.0.13.",
      "vulnerability": {
        "name": "GHSA-h3hj-cmcx-xc66"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.13",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.13"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-jj37-3377-m6vv is a false positive for nodemailer 10.0.13.",
      "vulnerability": {
        "name": "GHSA-jj37-3377-m6vv"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.13",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.13"
          }
        }
      ],
      "timestamp": "2026-10-23T22:01:49.029239+00:00",
      "status_notes": "Vulnerability GHSA-m943-m63m-w62w affects version 10.0.13 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-m943-m63m-w62w"
      },
      "action_statement": "Vulnerability GHSA-m943-m63m-w62w affects version 10.0.13 of nodemailer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.13",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.13"
          }
        }
      ],
      "timestamp": "2026-11-14T00:17:33.916697+00:00",
      "status_notes": "Vulnerability GHSA-v53p-9fqp-m79j does not affect version 10.0.13 of nodemailer. not_affected \u2014 Target 10.0.13 already contains the upstream fix for GHSA-v53p-9fqp-m79j. The quadratic unanchored free-text search is gone. A linear scan (_looseAddressStart) now picks one offset, and a sticky regex is run only there. The fix was authored upstream by andris@reinman.eu and is not a TuxCare commit.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-v53p-9fqp-m79j"
      },
      "impact_statement": "not_affected \u2014 Target 10.0.13 already contains the upstream fix for GHSA-v53p-9fqp-m79j. The quadratic unanchored free-text search is gone. A linear scan (_looseAddressStart) now picks one offset, and a sticky regex is run only there. The fix was authored upstream by andris@reinman.eu and is not a TuxCare commit."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.13",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.13"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-vm5r-23w9-m8hx is a false positive for nodemailer 10.0.13.",
      "vulnerability": {
        "name": "GHSA-vm5r-23w9-m8hx"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.13",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.13"
          }
        }
      ],
      "timestamp": "2026-11-13T22:09:43.052580+00:00",
      "status_notes": "Vulnerability GHSA-vvjj-xcjg-gr5g does not affect version 10.0.13 of nodemailer. not_affected \u2014 Nodemailer 10.0.13 already strips CR/LF from the transport `name` option before it is used in the LHLO/EHLO/HELO commands. The upstream fix for GHSA-vvjj-xcjg-gr5g (commit 0a43876, authored by the upstream maintainer) is an ancestor of HEAD and ships in the upstream release. There are no TuxCare commits in the history other than an automation commit that adds the build config, so the verdict is...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-vvjj-xcjg-gr5g"
      },
      "impact_statement": "not_affected \u2014 Nodemailer 10.0.13 already strips CR/LF from the transport `name` option before it is used in the LHLO/EHLO/HELO commands. The upstream fix for GHSA-vvjj-xcjg-gr5g (commit 0a43876, authored by the upstream maintainer) is an ancestor of HEAD and ships in the upstream release. There are no TuxCare commits in the history other than an automation commit that adds the build config, so the verdict is..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.13",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.13"
          }
        }
      ],
      "timestamp": "2026-11-13T22:58:23.343685+00:00",
      "status_notes": "Vulnerability GHSA-wmmp-3585-3rmp does not affect version 10.0.13 of nodemailer. not_affected \u2014 Target nodemailer 10.0.13 already contains the upstream fix for GHSA-wmmp-3585-3rmp. Upstream commits 259c32d (UTS-46 mapping when encoding a domain) and b212ac4 (keep URL delimiters away from the domain mapper) are ancestors of HEAD. They shipped in the upstream release, and the history has no TuxCare-domain commit. src/mime-node/index.ts normalizeDomain() now uses url.domainToASCII/domainToUn...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-wmmp-3585-3rmp"
      },
      "impact_statement": "not_affected \u2014 Target nodemailer 10.0.13 already contains the upstream fix for GHSA-wmmp-3585-3rmp. Upstream commits 259c32d (UTS-46 mapping when encoding a domain) and b212ac4 (keep URL delimiters away from the domain mapper) are ancestors of HEAD. They shipped in the upstream release, and the history has no TuxCare-domain commit. src/mime-node/index.ts normalizeDomain() now uses url.domainToASCII/domainToUn..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.13",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.13"
          }
        }
      ],
      "timestamp": "2026-11-13T22:15:08.551507+00:00",
      "status_notes": "Vulnerability GHSA-wqvq-jvpq-h66f does not affect version 10.0.13 of nodemailer. not_affected \u2014 Nodemailer 10.0.13 already enforces disableFileAccess/disableUrlAccess in the shared content resolver, and all pre-resolution callers pass the policy. The jsonTransport/normalize path (resolveAll) and the attachDataUrls path (_convertDataImages) are both covered. The enforcement shipped in the upstream TypeScript migration commit f7cbf83 by Andris Reinman (andris@reinman.eu). It is part of the ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-wqvq-jvpq-h66f"
      },
      "impact_statement": "not_affected \u2014 Nodemailer 10.0.13 already enforces disableFileAccess/disableUrlAccess in the shared content resolver, and all pre-resolution callers pass the policy. The jsonTransport/normalize path (resolveAll) and the attachDataUrls path (_convertDataImages) are both covered. The enforcement shipped in the upstream TypeScript migration commit f7cbf83 by Andris Reinman (andris@reinman.eu). It is part of the ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.13",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.13"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-wxxx-r42m-9rp8 is a false positive for nodemailer 10.0.13.",
      "vulnerability": {
        "name": "GHSA-wxxx-r42m-9rp8"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}