{ "@id": "urn:uuid:125b76c7-50b9-4383-aed5-52a3bd8105c9", "role": "Document Creator", "author": "https://tuxcare.com", "version": 29, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-13T23:51:32.466694+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.4" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2020-7769 affects version 10.0.4 of nodemailer.", "vulnerability": { "name": "CVE-2020-7769" }, "action_statement": "Vulnerability CVE-2020-7769 affects version 10.0.4 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.4" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2021-23400 affects version 10.0.4 of nodemailer.", "vulnerability": { "name": "CVE-2021-23400" }, "action_statement": "Vulnerability CVE-2021-23400 affects version 10.0.4 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.4" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2025-13033 affects version 10.0.4 of nodemailer.", "vulnerability": { "name": "CVE-2025-13033" }, "action_statement": "Vulnerability CVE-2025-13033 affects version 10.0.4 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.4" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2025-14874 affects version 10.0.4 of nodemailer.", "vulnerability": { "name": "CVE-2025-14874" }, "action_statement": "Vulnerability CVE-2025-14874 affects version 10.0.4 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.4" } } ], "timestamp": "2026-10-15T15:49:00.133726+00:00", "status_notes": "Vulnerability CVE-2026-110869 affects version 10.0.4 of nodemailer.", "vulnerability": { "name": "CVE-2026-110869" }, "action_statement": "Vulnerability CVE-2026-110869 affects version 10.0.4 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.4" } } ], "timestamp": "2026-10-26T15:35:33.946658+00:00", "status_notes": "Vulnerability CVE-2026-110870 affects version 10.0.4 of nodemailer.", "vulnerability": { "name": "CVE-2026-110870" }, "action_statement": "Vulnerability CVE-2026-110870 affects version 10.0.4 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.4" } } ], "timestamp": "2026-10-20T02:47:06.846725+00:00", "status_notes": "Vulnerability CVE-2026-110871 affects version 10.0.4 of nodemailer.", "vulnerability": { "name": "CVE-2026-110871" }, "action_statement": "Vulnerability CVE-2026-110871 affects version 10.0.4 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.4" } } ], "timestamp": "2026-10-15T14:52:00.136801+00:00", "status_notes": "Vulnerability CVE-2026-110872 affects version 10.0.4 of nodemailer.", "vulnerability": { "name": "CVE-2026-110872" }, "action_statement": "Vulnerability CVE-2026-110872 affects version 10.0.4 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.4" } } ], "timestamp": "2026-11-03T14:36:48.497569+00:00", "status_notes": "Vulnerability CVE-2026-121424 affects version 10.0.4 of nodemailer.", "vulnerability": { "name": "CVE-2026-121424" }, "action_statement": "Vulnerability CVE-2026-121424 affects version 10.0.4 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.4" } } ], "timestamp": "2026-11-03T14:36:48.497569+00:00", "status_notes": "Vulnerability CVE-2026-121425 affects version 10.0.4 of nodemailer.", "vulnerability": { "name": "CVE-2026-121425" }, "action_statement": "Vulnerability CVE-2026-121425 affects version 10.0.4 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.4" } } ], "timestamp": "2026-11-03T14:36:48.497569+00:00", "status_notes": "Vulnerability CVE-2026-121426 affects version 10.0.4 of nodemailer.", "vulnerability": { "name": "CVE-2026-121426" }, "action_statement": "Vulnerability CVE-2026-121426 affects version 10.0.4 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.4" } } ], "timestamp": "2026-11-10T15:30:00.075367+00:00", "status_notes": "Vulnerability CVE-2026-125755 affects version 10.0.4 of nodemailer.", "vulnerability": { "name": "CVE-2026-125755" }, "action_statement": "Vulnerability CVE-2026-125755 affects version 10.0.4 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.4" } } ], "timestamp": "2026-11-13T22:30:13.853109+00:00", "status_notes": "Vulnerability CVE-2026-82659 does not affect version 10.0.4 of nodemailer. not_affected \u2014 Target (nodemailer 10.0.4) is not affected: the message-level raw root node in MailComposer.compile() is built with disableUrlAccess and disableFileAccess, and MimeNode._getStream enforces them (also through the parent chain). The fix came from the upstream TypeScript migration commit f7cbf83, already in the 10.0.4 release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-82659" }, "impact_statement": "not_affected \u2014 Target (nodemailer 10.0.4) is not affected: the message-level raw root node in MailComposer.compile() is built with disableUrlAccess and disableFileAccess, and MimeNode._getStream enforces them (also through the parent chain). The fix came from the upstream TypeScript migration commit f7cbf83, already in the 10.0.4 release." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.4" } } ], "timestamp": "2026-11-13T23:13:04.466781+00:00", "status_notes": "Vulnerability CVE-2026-82662 does not affect version 10.0.4 of nodemailer. not_affected \u2014 Target nodemailer 10.0.4 already validates TLS certificates by default in the internal fetch client and in the OAuth2 token request path. The hardcoded rejectUnauthorized:false is gone. The fix is upstream commit 6a947ac, authored by the upstream maintainer. It shipped in the v9.0.0 release, which this tree is built on.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-82662" }, "impact_statement": "not_affected \u2014 Target nodemailer 10.0.4 already validates TLS certificates by default in the internal fetch client and in the OAuth2 token request path. The hardcoded rejectUnauthorized:false is gone. The fix is upstream commit 6a947ac, authored by the upstream maintainer. It shipped in the v9.0.0 release, which this tree is built on." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.4" } } ], "timestamp": "2026-11-13T23:28:00.053366+00:00", "status_notes": "Vulnerability CVE-2026-82854 does not affect version 10.0.4 of nodemailer. not_affected \u2014 Target (nodemailer 10.0.4) already contains the upstream fix for CVE-2026-82854. In src/smtp-connection/index.ts the envelope size is coerced with Number(...) || 0 and only appended as SIZE= when it is greater than 0. A CRLF-bearing string becomes NaN, then 0, and is dropped. The fix is upstream commit 2d7b9710 (author andris@reinman.eu). It is an ancestor of HEAD and shipped in the ups...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-82854" }, "impact_statement": "not_affected \u2014 Target (nodemailer 10.0.4) already contains the upstream fix for CVE-2026-82854. In src/smtp-connection/index.ts the envelope size is coerced with Number(...) || 0 and only appended as SIZE= when it is greater than 0. A CRLF-bearing string becomes NaN, then 0, and is dropped. The fix is upstream commit 2d7b9710 (author andris@reinman.eu). It is an ancestor of HEAD and shipped in the ups..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.4" } } ], "timestamp": "2026-10-06T09:18:00.239158+00:00", "status_notes": "Vulnerability CVE-2026-90776 affects version 10.0.4 of nodemailer.", "vulnerability": { "name": "CVE-2026-90776" }, "action_statement": "Vulnerability CVE-2026-90776 affects version 10.0.4 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.4" } } ], "timestamp": "2026-11-13T22:17:00.046957+00:00", "status_notes": "Vulnerability GHSA-268h-hp4c-crq3 does not affect version 10.0.4 of nodemailer. not_affected \u2014 Nodemailer 10.0.4 is not affected by GHSA-268h-hp4c-crq3. The upstream fix (5f69497, \"List-* CRLF injection\") and a follow-up (cf69430) are already in the tree. src/mailer/mail-message.ts:414 replaces CR/LF in list comments with a space before the prepared List-* header value is built. The vendor fix is upstream-authored and shipped in the release, so there is no TuxCare attribution.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-268h-hp4c-crq3" }, "impact_statement": "not_affected \u2014 Nodemailer 10.0.4 is not affected by GHSA-268h-hp4c-crq3. The upstream fix (5f69497, \"List-* CRLF injection\") and a follow-up (cf69430) are already in the tree. src/mailer/mail-message.ts:414 replaces CR/LF in list comments with a space before the prepared List-* header value is built. The vendor fix is upstream-authored and shipped in the release, so there is no TuxCare attribution." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.4" } } ], "timestamp": "2026-11-13T22:45:11.501462+00:00", "status_notes": "Vulnerability GHSA-2x7j-588g-ccc2 does not affect version 10.0.4 of nodemailer. not_affected \u2014 Target (nodemailer 10.0.4, TypeScript source under src/) already contains all upstream 9.1.0 quadratic-time fixes for GHSA-2x7j-588g-ccc2. The fix commits (9116da9, 7cc38af, 34da642, 83b8c48, 7279ac8) are ancestors of HEAD. They were authored by upstream (andris@reinman.eu) and shipped in the upstream release. The first TuxCare commit is the HEAD tip, which only adds tuxcare.yaml.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-2x7j-588g-ccc2" }, "impact_statement": "not_affected \u2014 Target (nodemailer 10.0.4, TypeScript source under src/) already contains all upstream 9.1.0 quadratic-time fixes for GHSA-2x7j-588g-ccc2. The fix commits (9116da9, 7cc38af, 34da642, 83b8c48, 7279ac8) are ancestors of HEAD. They were authored by upstream (andris@reinman.eu) and shipped in the upstream release. The first TuxCare commit is the HEAD tip, which only adds tuxcare.yaml." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.4" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-46j5-6fg5-4gv3 is a false positive for nodemailer 10.0.4.", "vulnerability": { "name": "GHSA-46j5-6fg5-4gv3" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.4" } } ], "timestamp": "2026-10-27T15:13:32.414812+00:00", "status_notes": "Vulnerability GHSA-4ffr-jq9g-5ffx affects version 10.0.4 of nodemailer.", "vulnerability": { "name": "GHSA-4ffr-jq9g-5ffx" }, "action_statement": "Vulnerability GHSA-4ffr-jq9g-5ffx affects version 10.0.4 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.4" } } ], "timestamp": "2026-10-27T15:13:32.414812+00:00", "status_notes": "Vulnerability GHSA-4g23-2xm8-66gc affects version 10.0.4 of nodemailer.", "vulnerability": { "name": "GHSA-4g23-2xm8-66gc" }, "action_statement": "Vulnerability GHSA-4g23-2xm8-66gc affects version 10.0.4 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.4" } } ], "timestamp": "2026-11-13T23:45:00.162248+00:00", "status_notes": "Vulnerability GHSA-6vj9-mwq6-2f5v does not affect version 10.0.4 of nodemailer. not_affected \u2014 Target (nodemailer 10.0.4) already contains the upstream fix a6512dbc \"fix(shared): keep the TLS server name out of the DNS cache\". The DNS cache stores addresses only, and servername is computed per call from the current options. The fix shipped in the upstream release; HEAD has no TuxCare-authored commits.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6vj9-mwq6-2f5v" }, "impact_statement": "not_affected \u2014 Target (nodemailer 10.0.4) already contains the upstream fix a6512dbc \"fix(shared): keep the TLS server name out of the DNS cache\". The DNS cache stores addresses only, and servername is computed per call from the current options. The fix shipped in the upstream release; HEAD has no TuxCare-authored commits." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.4" } } ], "timestamp": "2026-10-23T22:01:00.144162+00:00", "status_notes": "Vulnerability GHSA-85x2-q946-cp5h affects version 10.0.4 of nodemailer.", "vulnerability": { "name": "GHSA-85x2-q946-cp5h" }, "action_statement": "Vulnerability GHSA-85x2-q946-cp5h affects version 10.0.4 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.4" } } ], "timestamp": "2026-10-23T22:01:00.144162+00:00", "status_notes": "Vulnerability GHSA-8c8m-p3m8-cjg8 affects version 10.0.4 of nodemailer.", "vulnerability": { "name": "GHSA-8c8m-p3m8-cjg8" }, "action_statement": "Vulnerability GHSA-8c8m-p3m8-cjg8 affects version 10.0.4 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.4" } } ], "timestamp": "2026-11-13T22:32:00.034202+00:00", "status_notes": "Vulnerability GHSA-8m3c-c648-2xjj does not affect version 10.0.4 of nodemailer. not_affected \u2014 Target (nodemailer 10.0.4) already contains the upstream fix. MailMessage.resolveContent merges this.data.disableFileAccess/disableUrlAccess into the policy passed to shared.resolveContent, so the legacy 3-arg signature no longer drops the sandbox flags. The fix, upstream commit dc48ed3 by andris@reinman.eu, shipped in the upstream release. HEAD has no TuxCare-domain commits.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-8m3c-c648-2xjj" }, "impact_statement": "not_affected \u2014 Target (nodemailer 10.0.4) already contains the upstream fix. MailMessage.resolveContent merges this.data.disableFileAccess/disableUrlAccess into the policy passed to shared.resolveContent, so the legacy 3-arg signature no longer drops the sandbox flags. The fix, upstream commit dc48ed3 by andris@reinman.eu, shipped in the upstream release. HEAD has no TuxCare-domain commits." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.4" } } ], "timestamp": "2026-11-13T23:51:32.466694+00:00", "status_notes": "Vulnerability GHSA-8vvx-rff5-p5rq does not affect version 10.0.4 of nodemailer. not_affected \u2014 Target nodemailer 10.0.4 already contains the upstream fix for GHSA-8vvx-rff5-p5rq (commit ebe0849, Andris Reinman). MimeNode._parseAddresses now flattens nested recipient arrays iteratively with a WeakSet, so arrays are never stringified. Mail.sendMail also wraps the compile and getEnvelope step in try/catch and routes errors to the callback. The fix shipped in the upstream release before the ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-8vvx-rff5-p5rq" }, "impact_statement": "not_affected \u2014 Target nodemailer 10.0.4 already contains the upstream fix for GHSA-8vvx-rff5-p5rq (commit ebe0849, Andris Reinman). MimeNode._parseAddresses now flattens nested recipient arrays iteratively with a WeakSet, so arrays are never stringified. Mail.sendMail also wraps the compile and getEnvelope step in try/catch and routes errors to the callback. The fix shipped in the upstream release before the ..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.4" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-9h6g-pr28-7cqp affects version 10.0.4 of nodemailer.", "vulnerability": { "name": "GHSA-9h6g-pr28-7cqp" }, "action_statement": "Vulnerability GHSA-9h6g-pr28-7cqp affects version 10.0.4 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.4" } } ], "timestamp": "2026-11-13T22:06:40.895438+00:00", "status_notes": "Vulnerability GHSA-c7w3-x93f-qmm8 does not affect version 10.0.4 of nodemailer. not_affected \u2014 The upstream fix (2d7b971, 'sanitize envelope size to prevent SMTP command injection') is already in the 10.0.4 release this target is built from. src/smtp-connection/index.ts now coerces envelope.size with Number() and only emits SIZE= when the value is positive, so CRLF cannot reach the MAIL FROM line.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-c7w3-x93f-qmm8" }, "impact_statement": "not_affected \u2014 The upstream fix (2d7b971, 'sanitize envelope size to prevent SMTP command injection') is already in the 10.0.4 release this target is built from. src/smtp-connection/index.ts now coerces envelope.size with Number() and only emits SIZE= when the value is positive, so CRLF cannot reach the MAIL FROM line." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.4" } } ], "timestamp": "2026-11-13T22:57:00.061178+00:00", "status_notes": "Vulnerability GHSA-cc9r-2j5m-2m83 does not affect version 10.0.4 of nodemailer. not_affected \u2014 Not affected. The target (nodemailer 10.0.4, TypeScript source in src/addressparser/index.ts) already carries the upstream fix for GHSA-cc9r-2j5m-2m83. A token that follows a comment-closing ')' is no longer concatenated onto the preceding token unless one side carries the '@'. So user@good-corp.com(x)evil.com yields address user@good-corp.com, not good-corp.comevil.com. The fix shipped with th...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-cc9r-2j5m-2m83" }, "impact_statement": "not_affected \u2014 Not affected. The target (nodemailer 10.0.4, TypeScript source in src/addressparser/index.ts) already carries the upstream fix for GHSA-cc9r-2j5m-2m83. A token that follows a comment-closing ')' is no longer concatenated onto the preceding token unless one side carries the '@'. So user@good-corp.com(x)evil.com yields address user@good-corp.com, not good-corp.comevil.com. The fix shipped with th..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.4" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-frj6-5rhh-vwfw is a false positive for nodemailer 10.0.4.", "vulnerability": { "name": "GHSA-frj6-5rhh-vwfw" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.4" } } ], "timestamp": "2026-09-29T23:56:00.225781+00:00", "status_notes": "Vulnerability GHSA-g57g-f23g-4646 affects version 10.0.4 of nodemailer.", "vulnerability": { "name": "GHSA-g57g-f23g-4646" }, "action_statement": "Vulnerability GHSA-g57g-f23g-4646 affects version 10.0.4 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.4" } } ], "timestamp": "2026-10-27T15:13:32.414812+00:00", "status_notes": "Vulnerability GHSA-g73g-hqqh-jr95 affects version 10.0.4 of nodemailer.", "vulnerability": { "name": "GHSA-g73g-hqqh-jr95" }, "action_statement": "Vulnerability GHSA-g73g-hqqh-jr95 affects version 10.0.4 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.4" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-h3hj-cmcx-xc66 is a false positive for nodemailer 10.0.4.", "vulnerability": { "name": "GHSA-h3hj-cmcx-xc66" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.4" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-jj37-3377-m6vv is a false positive for nodemailer 10.0.4.", "vulnerability": { "name": "GHSA-jj37-3377-m6vv" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.4" } } ], "timestamp": "2026-10-23T22:01:49.029239+00:00", "status_notes": "Vulnerability GHSA-m943-m63m-w62w affects version 10.0.4 of nodemailer.", "vulnerability": { "name": "GHSA-m943-m63m-w62w" }, "action_statement": "Vulnerability GHSA-m943-m63m-w62w affects version 10.0.4 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.4" } } ], "timestamp": "2026-09-30T14:56:54.506693+00:00", "status_notes": "Vulnerability GHSA-prgh-xp8r-p3m5 affects version 10.0.4 of nodemailer.", "vulnerability": { "name": "GHSA-prgh-xp8r-p3m5" }, "action_statement": "Vulnerability GHSA-prgh-xp8r-p3m5 affects version 10.0.4 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.4" } } ], "timestamp": "2026-09-29T23:56:00.225781+00:00", "status_notes": "Vulnerability GHSA-v53p-9fqp-m79j affects version 10.0.4 of nodemailer.", "vulnerability": { "name": "GHSA-v53p-9fqp-m79j" }, "action_statement": "Vulnerability GHSA-v53p-9fqp-m79j affects version 10.0.4 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.4" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-vm5r-23w9-m8hx is a false positive for nodemailer 10.0.4.", "vulnerability": { "name": "GHSA-vm5r-23w9-m8hx" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.4" } } ], "timestamp": "2026-11-13T22:09:40.579854+00:00", "status_notes": "Vulnerability GHSA-vvjj-xcjg-gr5g does not affect version 10.0.4 of nodemailer. not_affected \u2014 Nodemailer 10.0.4 is not affected by GHSA-vvjj-xcjg-gr5g. SmtpConnection strips CR/LF from the `name` option when it is assigned (src/smtp-connection/index.ts:567), before the value is used in any LHLO, EHLO or HELO command. That sanitization shipped in the upstream code base (commit f7cbf83, the TypeScript migration, by andris@reinman.eu). It is an ancestor of HEAD and predates the only TuxCar...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-vvjj-xcjg-gr5g" }, "impact_statement": "not_affected \u2014 Nodemailer 10.0.4 is not affected by GHSA-vvjj-xcjg-gr5g. SmtpConnection strips CR/LF from the `name` option when it is assigned (src/smtp-connection/index.ts:567), before the value is used in any LHLO, EHLO or HELO command. That sanitization shipped in the upstream code base (commit f7cbf83, the TypeScript migration, by andris@reinman.eu). It is an ancestor of HEAD and predates the only TuxCar..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.4" } } ], "timestamp": "2026-11-13T22:58:00.049762+00:00", "status_notes": "Vulnerability GHSA-wmmp-3585-3rmp does not affect version 10.0.4 of nodemailer. not_affected \u2014 Target nodemailer 10.0.4 already contains both upstream fixes for GHSA-wmmp-3585-3rmp. _normalizeAddress calls normalizeDomain(), which applies UTS-46 mapping through url.domainToASCII/domainToUnicode. URL-host delimiters and control characters are kept away from the mapper by the URL_PARSER_UNSAFE guard. Both fix commits (259c32d, b212ac4) are by upstream author andris@reinman.eu and predate t...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wmmp-3585-3rmp" }, "impact_statement": "not_affected \u2014 Target nodemailer 10.0.4 already contains both upstream fixes for GHSA-wmmp-3585-3rmp. _normalizeAddress calls normalizeDomain(), which applies UTS-46 mapping through url.domainToASCII/domainToUnicode. URL-host delimiters and control characters are kept away from the mapper by the URL_PARSER_UNSAFE guard. Both fix commits (259c32d, b212ac4) are by upstream author andris@reinman.eu and predate t..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.4" } } ], "timestamp": "2026-11-13T22:14:00.030327+00:00", "status_notes": "Vulnerability GHSA-wqvq-jvpq-h66f does not affect version 10.0.4 of nodemailer. not_affected \u2014 Nodemailer 10.0.4 already contains the upstream fix. shared.resolveContent() takes an access-policy argument and rejects URL and file references with EURLACCESS / EFILEACCESS when the matching flag is set. The jsonTransport normalize/resolveAll path and the attachDataUrls pre-plugin both pass the policy in. The fix commit (dc48ed3, by andris@reinman.eu) is upstream-authored and part of the 10.0...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wqvq-jvpq-h66f" }, "impact_statement": "not_affected \u2014 Nodemailer 10.0.4 already contains the upstream fix. shared.resolveContent() takes an access-policy argument and rejects URL and file references with EURLACCESS / EFILEACCESS when the matching flag is set. The jsonTransport normalize/resolveAll path and the attachDataUrls pre-plugin both pass the policy in. The fix commit (dc48ed3, by andris@reinman.eu) is upstream-authored and part of the 10.0..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.4" } } ], "timestamp": "2026-10-22T17:05:00.556684+00:00", "status_notes": "Vulnerability GHSA-wxxx-r42m-9rp8 is a false positive for nodemailer 10.0.4.", "vulnerability": { "name": "GHSA-wxxx-r42m-9rp8" }, "impact_statement": "The vulnerability has been withdrawn." } ] }