{ "@id": "urn:uuid:074535f9-bf7c-4ded-a6d2-883b0ec02255", "role": "Document Creator", "author": "https://tuxcare.com", "version": 27, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-14T00:16:31.927108+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.6" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2020-7769 affects version 10.0.6 of nodemailer.", "vulnerability": { "name": "CVE-2020-7769" }, "action_statement": "Vulnerability CVE-2020-7769 affects version 10.0.6 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.6" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2021-23400 affects version 10.0.6 of nodemailer.", "vulnerability": { "name": "CVE-2021-23400" }, "action_statement": "Vulnerability CVE-2021-23400 affects version 10.0.6 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.6" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2025-13033 affects version 10.0.6 of nodemailer.", "vulnerability": { "name": "CVE-2025-13033" }, "action_statement": "Vulnerability CVE-2025-13033 affects version 10.0.6 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.6" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2025-14874 affects version 10.0.6 of nodemailer.", "vulnerability": { "name": "CVE-2025-14874" }, "action_statement": "Vulnerability CVE-2025-14874 affects version 10.0.6 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.6" } } ], "timestamp": "2026-10-15T15:49:00.133726+00:00", "status_notes": "Vulnerability CVE-2026-110869 affects version 10.0.6 of nodemailer.", "vulnerability": { "name": "CVE-2026-110869" }, "action_statement": "Vulnerability CVE-2026-110869 affects version 10.0.6 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.6" } } ], "timestamp": "2026-10-26T15:35:33.946658+00:00", "status_notes": "Vulnerability CVE-2026-110870 affects version 10.0.6 of nodemailer.", "vulnerability": { "name": "CVE-2026-110870" }, "action_statement": "Vulnerability CVE-2026-110870 affects version 10.0.6 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.6" } } ], "timestamp": "2026-10-20T02:47:06.846725+00:00", "status_notes": "Vulnerability CVE-2026-110871 affects version 10.0.6 of nodemailer.", "vulnerability": { "name": "CVE-2026-110871" }, "action_statement": "Vulnerability CVE-2026-110871 affects version 10.0.6 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.6" } } ], "timestamp": "2026-10-15T14:52:00.136801+00:00", "status_notes": "Vulnerability CVE-2026-110872 affects version 10.0.6 of nodemailer.", "vulnerability": { "name": "CVE-2026-110872" }, "action_statement": "Vulnerability CVE-2026-110872 affects version 10.0.6 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.6" } } ], "timestamp": "2026-11-03T14:36:48.497569+00:00", "status_notes": "Vulnerability CVE-2026-121424 affects version 10.0.6 of nodemailer.", "vulnerability": { "name": "CVE-2026-121424" }, "action_statement": "Vulnerability CVE-2026-121424 affects version 10.0.6 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.6" } } ], "timestamp": "2026-11-03T14:36:48.497569+00:00", "status_notes": "Vulnerability CVE-2026-121425 affects version 10.0.6 of nodemailer.", "vulnerability": { "name": "CVE-2026-121425" }, "action_statement": "Vulnerability CVE-2026-121425 affects version 10.0.6 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.6" } } ], "timestamp": "2026-11-03T14:36:48.497569+00:00", "status_notes": "Vulnerability CVE-2026-121426 affects version 10.0.6 of nodemailer.", "vulnerability": { "name": "CVE-2026-121426" }, "action_statement": "Vulnerability CVE-2026-121426 affects version 10.0.6 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.6" } } ], "timestamp": "2026-11-10T15:30:00.075367+00:00", "status_notes": "Vulnerability CVE-2026-125755 affects version 10.0.6 of nodemailer.", "vulnerability": { "name": "CVE-2026-125755" }, "action_statement": "Vulnerability CVE-2026-125755 affects version 10.0.6 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.6" } } ], "timestamp": "2026-11-13T22:31:00.045181+00:00", "status_notes": "Vulnerability CVE-2026-82659 does not affect version 10.0.6 of nodemailer. not_affected \u2014 Target nodemailer 10.0.6 already contains the upstream fix (commit a82e060d, Andris Reinman). MailComposer.compile() passes disableUrlAccess/disableFileAccess to the raw root MimeNode, and MimeNode._getStream also checks the flags up the parent chain via _accessDisabled. The fix shipped in the upstream release onboarded by TuxCare, so it is not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-82659" }, "impact_statement": "not_affected \u2014 Target nodemailer 10.0.6 already contains the upstream fix (commit a82e060d, Andris Reinman). MailComposer.compile() passes disableUrlAccess/disableFileAccess to the raw root MimeNode, and MimeNode._getStream also checks the flags up the parent chain via _accessDisabled. The fix shipped in the upstream release onboarded by TuxCare, so it is not a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.6" } } ], "timestamp": "2026-11-13T23:13:04.466781+00:00", "status_notes": "Vulnerability CVE-2026-82662 does not affect version 10.0.6 of nodemailer. not_affected \u2014 Nodemailer 10.0.6 already contains the upstream fix. The internal fetch client sets rejectUnauthorized: true by default, and the OAuth2 token request pins strict validation. The fix shipped in the upstream release, so this is not_affected rather than already_fixed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-82662" }, "impact_statement": "not_affected \u2014 Nodemailer 10.0.6 already contains the upstream fix. The internal fetch client sets rejectUnauthorized: true by default, and the OAuth2 token request pins strict validation. The fix shipped in the upstream release, so this is not_affected rather than already_fixed." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.6" } } ], "timestamp": "2026-11-13T23:27:15.823474+00:00", "status_notes": "Vulnerability CVE-2026-82854 does not affect version 10.0.6 of nodemailer. not_affected \u2014 Nodemailer 10.0.6 already contains the upstream fix for CVE-2026-82854. src/smtp-connection/index.ts:1702-1707 coerces envelope.size with Number() and emits SIZE= only for a positive numeric value, so CRLF input cannot reach the MAIL FROM line. The fix is upstream commit 2d7b971 by Andris Reinman. It is an ancestor of HEAD, and HEAD has no TuxCare-domain commits, so it shipped in the upstream r...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-82854" }, "impact_statement": "not_affected \u2014 Nodemailer 10.0.6 already contains the upstream fix for CVE-2026-82854. src/smtp-connection/index.ts:1702-1707 coerces envelope.size with Number() and emits SIZE= only for a positive numeric value, so CRLF input cannot reach the MAIL FROM line. The fix is upstream commit 2d7b971 by Andris Reinman. It is an ancestor of HEAD, and HEAD has no TuxCare-domain commits, so it shipped in the upstream r..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.6" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2026-90776 affects version 10.0.6 of nodemailer.", "vulnerability": { "name": "CVE-2026-90776" }, "action_statement": "Vulnerability CVE-2026-90776 affects version 10.0.6 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.6" } } ], "timestamp": "2026-11-13T22:17:00.046957+00:00", "status_notes": "Vulnerability GHSA-268h-hp4c-crq3 does not affect version 10.0.6 of nodemailer. not_affected \u2014 nodemailer 10.0.6 is not affected. In src/mailer/mail-message.ts, _getListHeaders strips CR/LF from list.*.comment (replace(/\\r?\\n|\\r/g, ' ')) before building the prepared List-* header value. Non-plaintext comments are also encoded as RFC 2047 encoded words. The CRLF defense was shipped upstream in the TypeScript migration commit f7cbf83 (author andris@reinman.eu), before the first TuxCare com...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-268h-hp4c-crq3" }, "impact_statement": "not_affected \u2014 nodemailer 10.0.6 is not affected. In src/mailer/mail-message.ts, _getListHeaders strips CR/LF from list.*.comment (replace(/\\r?\\n|\\r/g, ' ')) before building the prepared List-* header value. Non-plaintext comments are also encoded as RFC 2047 encoded words. The CRLF defense was shipped upstream in the TypeScript migration commit f7cbf83 (author andris@reinman.eu), before the first TuxCare com..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.6" } } ], "timestamp": "2026-11-13T22:42:00.042020+00:00", "status_notes": "Vulnerability GHSA-2x7j-588g-ccc2 does not affect version 10.0.6 of nodemailer. not_affected \u2014 Nodemailer 10.0.6 already contains the upstream 9.1.0 fixes for GHSA-2x7j-588g-ccc2. The addressparser accumulator appends in place, the display-name merge is a single back-to-front pass with no splice, recipient dedup uses a Set, _parseAddresses flattens iteratively, and a maxRecipients backstop exists. The fix shipped in the upstream release, so the verdict is not_affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-2x7j-588g-ccc2" }, "impact_statement": "not_affected \u2014 Nodemailer 10.0.6 already contains the upstream 9.1.0 fixes for GHSA-2x7j-588g-ccc2. The addressparser accumulator appends in place, the display-name merge is a single back-to-front pass with no splice, recipient dedup uses a Set, _parseAddresses flattens iteratively, and a maxRecipients backstop exists. The fix shipped in the upstream release, so the verdict is not_affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.6" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-46j5-6fg5-4gv3 is a false positive for nodemailer 10.0.6.", "vulnerability": { "name": "GHSA-46j5-6fg5-4gv3" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.6" } } ], "timestamp": "2026-10-27T15:13:32.414812+00:00", "status_notes": "Vulnerability GHSA-4ffr-jq9g-5ffx affects version 10.0.6 of nodemailer.", "vulnerability": { "name": "GHSA-4ffr-jq9g-5ffx" }, "action_statement": "Vulnerability GHSA-4ffr-jq9g-5ffx affects version 10.0.6 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.6" } } ], "timestamp": "2026-10-27T15:13:32.414812+00:00", "status_notes": "Vulnerability GHSA-4g23-2xm8-66gc affects version 10.0.6 of nodemailer.", "vulnerability": { "name": "GHSA-4g23-2xm8-66gc" }, "action_statement": "Vulnerability GHSA-4g23-2xm8-66gc affects version 10.0.6 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.6" } } ], "timestamp": "2026-11-13T23:50:46.957981+00:00", "status_notes": "Vulnerability GHSA-6vj9-mwq6-2f5v does not affect version 10.0.6 of nodemailer. not_affected \u2014 Target (nodemailer 10.0.6) already contains the upstream fix a6512db (\"keep the TLS server name out of the DNS cache\"). The DNS cache stores only addresses; the servername is derived from the current call's options.servername (or host) on every path, including cache hits. The fix is an upstream release commit by the maintainer, not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6vj9-mwq6-2f5v" }, "impact_statement": "not_affected \u2014 Target (nodemailer 10.0.6) already contains the upstream fix a6512db (\"keep the TLS server name out of the DNS cache\"). The DNS cache stores only addresses; the servername is derived from the current call's options.servername (or host) on every path, including cache hits. The fix is an upstream release commit by the maintainer, not a TuxCare backport." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.6" } } ], "timestamp": "2026-10-23T22:01:00.144162+00:00", "status_notes": "Vulnerability GHSA-85x2-q946-cp5h affects version 10.0.6 of nodemailer.", "vulnerability": { "name": "GHSA-85x2-q946-cp5h" }, "action_statement": "Vulnerability GHSA-85x2-q946-cp5h affects version 10.0.6 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.6" } } ], "timestamp": "2026-10-23T22:01:00.144162+00:00", "status_notes": "Vulnerability GHSA-8c8m-p3m8-cjg8 affects version 10.0.6 of nodemailer.", "vulnerability": { "name": "GHSA-8c8m-p3m8-cjg8" }, "action_statement": "Vulnerability GHSA-8c8m-p3m8-cjg8 affects version 10.0.6 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.6" } } ], "timestamp": "2026-11-13T22:32:00.034202+00:00", "status_notes": "Vulnerability GHSA-8m3c-c648-2xjj does not affect version 10.0.6 of nodemailer. not_affected \u2014 Target nodemailer 10.0.6 already contains the upstream fix for GHSA-8m3c-c648-2xjj. MailMessage.resolveContent (src/mailer/mail-message.ts:143-172) is no longer a raw passthrough. It normalizes the legacy (data, key, callback) signature and builds a policy from the message-level disableFileAccess/disableUrlAccess flags. Explicit options can only tighten that policy. The fix is upstream commit d...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-8m3c-c648-2xjj" }, "impact_statement": "not_affected \u2014 Target nodemailer 10.0.6 already contains the upstream fix for GHSA-8m3c-c648-2xjj. MailMessage.resolveContent (src/mailer/mail-message.ts:143-172) is no longer a raw passthrough. It normalizes the legacy (data, key, callback) signature and builds a policy from the message-level disableFileAccess/disableUrlAccess flags. Explicit options can only tighten that policy. The fix is upstream commit d..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.6" } } ], "timestamp": "2026-11-13T23:52:21.958941+00:00", "status_notes": "Vulnerability GHSA-8vvx-rff5-p5rq does not affect version 10.0.6 of nodemailer. not_affected \u2014 Target is nodemailer 10.0.6. The upstream fix for GHSA-8vvx-rff5-p5rq (ebe0849, \"flatten nested recipient arrays without recursion\", shipped in 10.0.2) is already in HEAD. MimeNode._parseAddresses now flattens nested arrays with an explicit stack and a WeakSet, so addressparser only receives scalars or objects and no array is ever stringified.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-8vvx-rff5-p5rq" }, "impact_statement": "not_affected \u2014 Target is nodemailer 10.0.6. The upstream fix for GHSA-8vvx-rff5-p5rq (ebe0849, \"flatten nested recipient arrays without recursion\", shipped in 10.0.2) is already in HEAD. MimeNode._parseAddresses now flattens nested arrays with an explicit stack and a WeakSet, so addressparser only receives scalars or objects and no array is ever stringified." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.6" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-9h6g-pr28-7cqp affects version 10.0.6 of nodemailer.", "vulnerability": { "name": "GHSA-9h6g-pr28-7cqp" }, "action_statement": "Vulnerability GHSA-9h6g-pr28-7cqp affects version 10.0.6 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.6" } } ], "timestamp": "2026-11-13T22:08:24.214185+00:00", "status_notes": "Vulnerability GHSA-c7w3-x93f-qmm8 does not affect version 10.0.6 of nodemailer. not_affected \u2014 Nodemailer 10.0.6 already contains the upstream fix for GHSA-c7w3-x93f-qmm8. envelope.size is coerced with Number() and only a positive numeric value is appended to MAIL FROM, so CRLF cannot reach the SMTP command line. The fix is upstream commit 2d7b971 (andris@reinman.eu). It is an ancestor of HEAD and part of the upstream release that precedes the first TuxCare commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-c7w3-x93f-qmm8" }, "impact_statement": "not_affected \u2014 Nodemailer 10.0.6 already contains the upstream fix for GHSA-c7w3-x93f-qmm8. envelope.size is coerced with Number() and only a positive numeric value is appended to MAIL FROM, so CRLF cannot reach the SMTP command line. The fix is upstream commit 2d7b971 (andris@reinman.eu). It is an ancestor of HEAD and part of the upstream release that precedes the first TuxCare commit." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.6" } } ], "timestamp": "2026-11-13T22:57:00.061178+00:00", "status_notes": "Vulnerability GHSA-cc9r-2j5m-2m83 does not affect version 10.0.6 of nodemailer. not_affected \u2014 Nodemailer 10.0.6 already contains the upstream fix for GHSA-cc9r-2j5m-2m83. The fix is upstream commit 902b63e (released in 9.1.0) and is in HEAD through the plain upstream release. In src/addressparser/index.ts, _handleAddress no longer concatenates the token after a comment-closing ')' onto the previous token unless the previous run ends in '@' or the next token starts with '@'. 'user@good-c...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-cc9r-2j5m-2m83" }, "impact_statement": "not_affected \u2014 Nodemailer 10.0.6 already contains the upstream fix for GHSA-cc9r-2j5m-2m83. The fix is upstream commit 902b63e (released in 9.1.0) and is in HEAD through the plain upstream release. In src/addressparser/index.ts, _handleAddress no longer concatenates the token after a comment-closing ')' onto the previous token unless the previous run ends in '@' or the next token starts with '@'. 'user@good-c..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.6" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-frj6-5rhh-vwfw is a false positive for nodemailer 10.0.6.", "vulnerability": { "name": "GHSA-frj6-5rhh-vwfw" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.6" } } ], "timestamp": "2026-09-29T23:56:00.225781+00:00", "status_notes": "Vulnerability GHSA-g57g-f23g-4646 affects version 10.0.6 of nodemailer.", "vulnerability": { "name": "GHSA-g57g-f23g-4646" }, "action_statement": "Vulnerability GHSA-g57g-f23g-4646 affects version 10.0.6 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.6" } } ], "timestamp": "2026-10-27T15:13:32.414812+00:00", "status_notes": "Vulnerability GHSA-g73g-hqqh-jr95 affects version 10.0.6 of nodemailer.", "vulnerability": { "name": "GHSA-g73g-hqqh-jr95" }, "action_statement": "Vulnerability GHSA-g73g-hqqh-jr95 affects version 10.0.6 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.6" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-h3hj-cmcx-xc66 is a false positive for nodemailer 10.0.6.", "vulnerability": { "name": "GHSA-h3hj-cmcx-xc66" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.6" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-jj37-3377-m6vv is a false positive for nodemailer 10.0.6.", "vulnerability": { "name": "GHSA-jj37-3377-m6vv" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.6" } } ], "timestamp": "2026-10-23T22:01:49.029239+00:00", "status_notes": "Vulnerability GHSA-m943-m63m-w62w affects version 10.0.6 of nodemailer.", "vulnerability": { "name": "GHSA-m943-m63m-w62w" }, "action_statement": "Vulnerability GHSA-m943-m63m-w62w affects version 10.0.6 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.6" } } ], "timestamp": "2026-11-14T00:16:31.927108+00:00", "status_notes": "Vulnerability GHSA-v53p-9fqp-m79j does not affect version 10.0.6 of nodemailer. not_affected \u2014 nodemailer 10.0.6 already contains the upstream fix for GHSA-v53p-9fqp-m79j. Commit 437d7fc (Andris Reinman, \"fix(addressparser): scan free text for an address in linear time\") is an ancestor of HEAD and ships in the upstream 10.0.6 release. The quadratic unanchored regex search is gone. src/addressparser/index.ts now finds the one possible match offset in a linear pass and runs a sticky regex ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-v53p-9fqp-m79j" }, "impact_statement": "not_affected \u2014 nodemailer 10.0.6 already contains the upstream fix for GHSA-v53p-9fqp-m79j. Commit 437d7fc (Andris Reinman, \"fix(addressparser): scan free text for an address in linear time\") is an ancestor of HEAD and ships in the upstream 10.0.6 release. The quadratic unanchored regex search is gone. src/addressparser/index.ts now finds the one possible match offset in a linear pass and runs a sticky regex ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.6" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-vm5r-23w9-m8hx is a false positive for nodemailer 10.0.6.", "vulnerability": { "name": "GHSA-vm5r-23w9-m8hx" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.6" } } ], "timestamp": "2026-11-13T22:09:23.418068+00:00", "status_notes": "Vulnerability GHSA-vvjj-xcjg-gr5g does not affect version 10.0.6 of nodemailer. not_affected \u2014 Not affected. Target nodemailer 10.0.6 already includes the upstream fix for GHSA-vvjj-xcjg-gr5g. src/smtp-connection/index.ts:567 strips CR/LF from the transport `name` option before it is used in the LHLO/EHLO/HELO commands. The fix is upstream commit 0a43876 (andris@reinman.eu), which is an ancestor of HEAD. HEAD's history contains no TuxCare commits, so this is an upstream fix shipped in th...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-vvjj-xcjg-gr5g" }, "impact_statement": "not_affected \u2014 Not affected. Target nodemailer 10.0.6 already includes the upstream fix for GHSA-vvjj-xcjg-gr5g. src/smtp-connection/index.ts:567 strips CR/LF from the transport `name` option before it is used in the LHLO/EHLO/HELO commands. The fix is upstream commit 0a43876 (andris@reinman.eu), which is an ancestor of HEAD. HEAD's history contains no TuxCare commits, so this is an upstream fix shipped in th..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.6" } } ], "timestamp": "2026-11-13T23:05:15.656839+00:00", "status_notes": "Vulnerability GHSA-wmmp-3585-3rmp does not affect version 10.0.6 of nodemailer. not_affected \u2014 nodemailer 10.0.6 already contains the upstream fixes for GHSA-wmmp-3585-3rmp. Commit 259c32d applies UTS-46 mapping when a domain is encoded. Commit b212ac4 keeps URL delimiters away from the mapper. Both were authored by upstream (andris@reinman.eu) and are inside the 10.0.6 release tag. HEAD has no @cloudlinux.com or @tuxcare.com commits, so this is an upstream fix and not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wmmp-3585-3rmp" }, "impact_statement": "not_affected \u2014 nodemailer 10.0.6 already contains the upstream fixes for GHSA-wmmp-3585-3rmp. Commit 259c32d applies UTS-46 mapping when a domain is encoded. Commit b212ac4 keeps URL delimiters away from the mapper. Both were authored by upstream (andris@reinman.eu) and are inside the 10.0.6 release tag. HEAD has no @cloudlinux.com or @tuxcare.com commits, so this is an upstream fix and not a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.6" } } ], "timestamp": "2026-11-13T22:14:17.313956+00:00", "status_notes": "Vulnerability GHSA-wqvq-jvpq-h66f does not affect version 10.0.6 of nodemailer. not_affected \u2014 nodemailer 10.0.6 already enforces disableFileAccess/disableUrlAccess in the shared pre-resolution helper (resolveContent), which is what jsonTransport normalization and the attachDataUrls path call. The fix shipped in the upstream release; there is no TuxCare fix commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wqvq-jvpq-h66f" }, "impact_statement": "not_affected \u2014 nodemailer 10.0.6 already enforces disableFileAccess/disableUrlAccess in the shared pre-resolution helper (resolveContent), which is what jsonTransport normalization and the attachDataUrls path call. The fix shipped in the upstream release; there is no TuxCare fix commit." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.6" } } ], "timestamp": "2026-10-22T17:05:00.556684+00:00", "status_notes": "Vulnerability GHSA-wxxx-r42m-9rp8 is a false positive for nodemailer 10.0.6.", "vulnerability": { "name": "GHSA-wxxx-r42m-9rp8" }, "impact_statement": "The vulnerability has been withdrawn." } ] }