{ "@id": "urn:uuid:496d0977-98a9-41cb-abb6-852ed2e8fb8e", "role": "Document Creator", "author": "https://tuxcare.com", "version": 28, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-14T00:16:55.667259+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.8", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.8" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2020-7769 affects version 10.0.8 of nodemailer.", "vulnerability": { "name": "CVE-2020-7769" }, "action_statement": "Vulnerability CVE-2020-7769 affects version 10.0.8 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.8", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.8" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2021-23400 affects version 10.0.8 of nodemailer.", "vulnerability": { "name": "CVE-2021-23400" }, "action_statement": "Vulnerability CVE-2021-23400 affects version 10.0.8 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.8", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.8" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2025-13033 affects version 10.0.8 of nodemailer.", "vulnerability": { "name": "CVE-2025-13033" }, "action_statement": "Vulnerability CVE-2025-13033 affects version 10.0.8 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.8", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.8" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2025-14874 affects version 10.0.8 of nodemailer.", "vulnerability": { "name": "CVE-2025-14874" }, "action_statement": "Vulnerability CVE-2025-14874 affects version 10.0.8 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.8", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.8" } } ], "timestamp": "2026-10-15T15:49:00.133726+00:00", "status_notes": "Vulnerability CVE-2026-110869 affects version 10.0.8 of nodemailer.", "vulnerability": { "name": "CVE-2026-110869" }, "action_statement": "Vulnerability CVE-2026-110869 affects version 10.0.8 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.8", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.8" } } ], "timestamp": "2026-10-26T15:35:33.946658+00:00", "status_notes": "Vulnerability CVE-2026-110870 affects version 10.0.8 of nodemailer.", "vulnerability": { "name": "CVE-2026-110870" }, "action_statement": "Vulnerability CVE-2026-110870 affects version 10.0.8 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.8", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.8" } } ], "timestamp": "2026-10-20T02:47:06.846725+00:00", "status_notes": "Vulnerability CVE-2026-110871 affects version 10.0.8 of nodemailer.", "vulnerability": { "name": "CVE-2026-110871" }, "action_statement": "Vulnerability CVE-2026-110871 affects version 10.0.8 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.8", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.8" } } ], "timestamp": "2026-10-15T14:52:00.136801+00:00", "status_notes": "Vulnerability CVE-2026-110872 affects version 10.0.8 of nodemailer.", "vulnerability": { "name": "CVE-2026-110872" }, "action_statement": "Vulnerability CVE-2026-110872 affects version 10.0.8 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.8", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.8" } } ], "timestamp": "2026-11-03T14:36:48.497569+00:00", "status_notes": "Vulnerability CVE-2026-121424 affects version 10.0.8 of nodemailer.", "vulnerability": { "name": "CVE-2026-121424" }, "action_statement": "Vulnerability CVE-2026-121424 affects version 10.0.8 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.8", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.8" } } ], "timestamp": "2026-11-03T14:36:48.497569+00:00", "status_notes": "Vulnerability CVE-2026-121425 affects version 10.0.8 of nodemailer.", "vulnerability": { "name": "CVE-2026-121425" }, "action_statement": "Vulnerability CVE-2026-121425 affects version 10.0.8 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.8", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.8" } } ], "timestamp": "2026-11-03T14:36:48.497569+00:00", "status_notes": "Vulnerability CVE-2026-121426 affects version 10.0.8 of nodemailer.", "vulnerability": { "name": "CVE-2026-121426" }, "action_statement": "Vulnerability CVE-2026-121426 affects version 10.0.8 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.8", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.8" } } ], "timestamp": "2026-11-10T15:30:00.075367+00:00", "status_notes": "Vulnerability CVE-2026-125755 affects version 10.0.8 of nodemailer.", "vulnerability": { "name": "CVE-2026-125755" }, "action_statement": "Vulnerability CVE-2026-125755 affects version 10.0.8 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.8", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.8" } } ], "timestamp": "2026-11-13T22:31:00.045181+00:00", "status_notes": "Vulnerability CVE-2026-82659 does not affect version 10.0.8 of nodemailer. not_affected \u2014 Not affected. The target (nodemailer 10.0.8, TypeScript layout under src/) already contains the upstream fix. MailComposer.compile() passes disableUrlAccess and disableFileAccess to the root MimeNode built for the message-level raw option, and MimeNode._getStream() also checks the node and all its ancestors via _accessDisabled(). The fix is upstream commit a82e060 by Andris Reinman. It is an an...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-82659" }, "impact_statement": "not_affected \u2014 Not affected. The target (nodemailer 10.0.8, TypeScript layout under src/) already contains the upstream fix. MailComposer.compile() passes disableUrlAccess and disableFileAccess to the root MimeNode built for the message-level raw option, and MimeNode._getStream() also checks the node and all its ancestors via _accessDisabled(). The fix is upstream commit a82e060 by Andris Reinman. It is an an..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.8", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.8" } } ], "timestamp": "2026-11-13T23:13:04.466781+00:00", "status_notes": "Vulnerability CVE-2026-82662 does not affect version 10.0.8 of nodemailer. not_affected \u2014 Nodemailer 10.0.8 is not affected. The internal fetch client (src/fetch/index.ts) sets rejectUnauthorized: true by default, and the OAuth2 token request pins it to true again. The upstream author installed this in the TypeScript migration commit f7cbf83, which is part of the upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-82662" }, "impact_statement": "not_affected \u2014 Nodemailer 10.0.8 is not affected. The internal fetch client (src/fetch/index.ts) sets rejectUnauthorized: true by default, and the OAuth2 token request pins it to true again. The upstream author installed this in the TypeScript migration commit f7cbf83, which is part of the upstream release." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.8", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.8" } } ], "timestamp": "2026-11-13T23:28:00.053366+00:00", "status_notes": "Vulnerability CVE-2026-82854 does not affect version 10.0.8 of nodemailer. not_affected \u2014 Not affected. The upstream fix for CVE-2026-82854 (commit 2d7b971, author andris@reinman.eu) is already in HEAD. In src/smtp-connection/index.ts the envelope.size value is coerced with Number(...) || 0 and only a positive number is appended as SIZE=. A CRLF-bearing string becomes NaN, then 0, and is dropped, so no CRLF reaches the MAIL FROM command.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-82854" }, "impact_statement": "not_affected \u2014 Not affected. The upstream fix for CVE-2026-82854 (commit 2d7b971, author andris@reinman.eu) is already in HEAD. In src/smtp-connection/index.ts the envelope.size value is coerced with Number(...) || 0 and only a positive number is appended as SIZE=. A CRLF-bearing string becomes NaN, then 0, and is dropped, so no CRLF reaches the MAIL FROM command." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.8", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.8" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2026-90776 affects version 10.0.8 of nodemailer.", "vulnerability": { "name": "CVE-2026-90776" }, "action_statement": "Vulnerability CVE-2026-90776 affects version 10.0.8 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.8", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.8" } } ], "timestamp": "2026-11-13T22:17:00.046957+00:00", "status_notes": "Vulnerability GHSA-268h-hp4c-crq3 does not affect version 10.0.8 of nodemailer. not_affected \u2014 Not affected. The upstream fix for GHSA-268h-hp4c-crq3 (nodemailer commit 5f69497, \"List-* CRLF injection\") is already in the 10.0.8 source. `_getListHeaders` in src/mailer/mail-message.ts replaces CR/LF in `list.*.comment` with a space before the value goes into the prepared header. Comments that are not plain text are RFC 2047-encoded, and quotes and parentheses are escaped. The fix shipped i...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-268h-hp4c-crq3" }, "impact_statement": "not_affected \u2014 Not affected. The upstream fix for GHSA-268h-hp4c-crq3 (nodemailer commit 5f69497, \"List-* CRLF injection\") is already in the 10.0.8 source. `_getListHeaders` in src/mailer/mail-message.ts replaces CR/LF in `list.*.comment` with a space before the value goes into the prepared header. Comments that are not plain text are RFC 2047-encoded, and quotes and parentheses are escaped. The fix shipped i..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.8", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.8" } } ], "timestamp": "2026-11-13T22:49:00.060071+00:00", "status_notes": "Vulnerability GHSA-2x7j-588g-ccc2 does not affect version 10.0.8 of nodemailer. not_affected \u2014 Target is nodemailer 10.0.8 (TypeScript port, src/). All three quadratic paths from GHSA-2x7j-588g-ccc2 (addressparser concat accumulator, display-name merge splice, _convertAddresses linear uniqueness scan), plus the _parseAddresses concat.apply issue, are already fixed in the upstream release. A maxRecipients backstop (default 100000) is present. The fix shipped upstream, authored by andris@r...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-2x7j-588g-ccc2" }, "impact_statement": "not_affected \u2014 Target is nodemailer 10.0.8 (TypeScript port, src/). All three quadratic paths from GHSA-2x7j-588g-ccc2 (addressparser concat accumulator, display-name merge splice, _convertAddresses linear uniqueness scan), plus the _parseAddresses concat.apply issue, are already fixed in the upstream release. A maxRecipients backstop (default 100000) is present. The fix shipped upstream, authored by andris@r..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.8", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.8" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-46j5-6fg5-4gv3 is a false positive for nodemailer 10.0.8.", "vulnerability": { "name": "GHSA-46j5-6fg5-4gv3" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.8", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.8" } } ], "timestamp": "2026-10-27T15:13:32.414812+00:00", "status_notes": "Vulnerability GHSA-4ffr-jq9g-5ffx affects version 10.0.8 of nodemailer.", "vulnerability": { "name": "GHSA-4ffr-jq9g-5ffx" }, "action_statement": "Vulnerability GHSA-4ffr-jq9g-5ffx affects version 10.0.8 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.8", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.8" } } ], "timestamp": "2026-10-27T15:13:32.414812+00:00", "status_notes": "Vulnerability GHSA-4g23-2xm8-66gc affects version 10.0.8 of nodemailer.", "vulnerability": { "name": "GHSA-4g23-2xm8-66gc" }, "action_statement": "Vulnerability GHSA-4g23-2xm8-66gc affects version 10.0.8 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.8", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.8" } } ], "timestamp": "2026-11-13T23:48:43.538332+00:00", "status_notes": "Vulnerability GHSA-6vj9-mwq6-2f5v does not affect version 10.0.8 of nodemailer. not_affected \u2014 Target nodemailer 10.0.8 already contains the upstream fix (a6512dbc \"fix(shared): keep the TLS server name out of the DNS cache\"). The DNS cache stores only addresses, and the returned servername is derived per call from options.servername || host. The fix was authored upstream by andris@reinman.eu and shipped in the upstream release before any TuxCare commit, so the verdict is not_affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6vj9-mwq6-2f5v" }, "impact_statement": "not_affected \u2014 Target nodemailer 10.0.8 already contains the upstream fix (a6512dbc \"fix(shared): keep the TLS server name out of the DNS cache\"). The DNS cache stores only addresses, and the returned servername is derived per call from options.servername || host. The fix was authored upstream by andris@reinman.eu and shipped in the upstream release before any TuxCare commit, so the verdict is not_affected." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.8", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.8" } } ], "timestamp": "2026-10-23T22:01:00.144162+00:00", "status_notes": "Vulnerability GHSA-85x2-q946-cp5h affects version 10.0.8 of nodemailer.", "vulnerability": { "name": "GHSA-85x2-q946-cp5h" }, "action_statement": "Vulnerability GHSA-85x2-q946-cp5h affects version 10.0.8 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.8", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.8" } } ], "timestamp": "2026-10-23T22:01:00.144162+00:00", "status_notes": "Vulnerability GHSA-8c8m-p3m8-cjg8 affects version 10.0.8 of nodemailer.", "vulnerability": { "name": "GHSA-8c8m-p3m8-cjg8" }, "action_statement": "Vulnerability GHSA-8c8m-p3m8-cjg8 affects version 10.0.8 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.8", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.8" } } ], "timestamp": "2026-11-13T22:32:00.034202+00:00", "status_notes": "Vulnerability GHSA-8m3c-c648-2xjj does not affect version 10.0.8 of nodemailer. not_affected \u2014 Target nodemailer 10.0.8 already contains the upstream fix for GHSA-8m3c-c648-2xjj. MailMessage.resolveContent() now merges the message-level disableFileAccess/disableUrlAccess flags into the policy passed to shared.resolveContent, so the legacy (data, key, callback) signature no longer drops the sandbox. The fix commits are upstream-authored (Andris Reinman) and shipped in the upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-8m3c-c648-2xjj" }, "impact_statement": "not_affected \u2014 Target nodemailer 10.0.8 already contains the upstream fix for GHSA-8m3c-c648-2xjj. MailMessage.resolveContent() now merges the message-level disableFileAccess/disableUrlAccess flags into the policy passed to shared.resolveContent, so the legacy (data, key, callback) signature no longer drops the sandbox. The fix commits are upstream-authored (Andris Reinman) and shipped in the upstream release." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.8", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.8" } } ], "timestamp": "2026-11-13T23:52:34.370227+00:00", "status_notes": "Vulnerability GHSA-8vvx-rff5-p5rq does not affect version 10.0.8 of nodemailer. not_affected \u2014 The target (nodemailer 10.0.8) already contains the upstream fix for GHSA-8vvx-rff5-p5rq. MimeNode._parseAddresses() now flattens nested recipient arrays iteratively with an explicit stack and a WeakSet, so a nested array never reaches addressparser()/Tokenizer.toString(). The fix is upstream commit ebe0849 (author andris@reinman.eu), which is in the upstream release before any TuxCare-domain c...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-8vvx-rff5-p5rq" }, "impact_statement": "not_affected \u2014 The target (nodemailer 10.0.8) already contains the upstream fix for GHSA-8vvx-rff5-p5rq. MimeNode._parseAddresses() now flattens nested recipient arrays iteratively with an explicit stack and a WeakSet, so a nested array never reaches addressparser()/Tokenizer.toString(). The fix is upstream commit ebe0849 (author andris@reinman.eu), which is in the upstream release before any TuxCare-domain c..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.8", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.8" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-9h6g-pr28-7cqp affects version 10.0.8 of nodemailer.", "vulnerability": { "name": "GHSA-9h6g-pr28-7cqp" }, "action_statement": "Vulnerability GHSA-9h6g-pr28-7cqp affects version 10.0.8 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.8", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.8" } } ], "timestamp": "2026-11-13T22:08:24.214185+00:00", "status_notes": "Vulnerability GHSA-c7w3-x93f-qmm8 does not affect version 10.0.8 of nodemailer. not_affected \u2014 Nodemailer 10.0.8 (TypeScript source) is not affected by GHSA-c7w3-x93f-qmm8. src/smtp-connection/index.ts:1702-1707 coerces envelope.size with Number(...) || 0 and only appends SIZE= when the value is > 0, so CR/LF cannot reach the MAIL FROM command. The same code has been present since the upstream TypeScript migration (f7cbf83, author andris@reinman.eu), which HEAD contains. HEAD has...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-c7w3-x93f-qmm8" }, "impact_statement": "not_affected \u2014 Nodemailer 10.0.8 (TypeScript source) is not affected by GHSA-c7w3-x93f-qmm8. src/smtp-connection/index.ts:1702-1707 coerces envelope.size with Number(...) || 0 and only appends SIZE= when the value is > 0, so CR/LF cannot reach the MAIL FROM command. The same code has been present since the upstream TypeScript migration (f7cbf83, author andris@reinman.eu), which HEAD contains. HEAD has..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.8", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.8" } } ], "timestamp": "2026-11-13T22:56:00.055317+00:00", "status_notes": "Vulnerability GHSA-cc9r-2j5m-2m83 does not affect version 10.0.8 of nodemailer. not_affected \u2014 Target nodemailer 10.0.8 already contains the upstream fix for GHSA-cc9r-2j5m-2m83 (upstream commit 902b63e, \"terminate the domain at an RFC 5322 comment\"). In src/addressparser/index.ts, a token following a comment-closing ')' is now glued to the previous token only when one side carries '@'. So 'user@good-corp.com(x)evil.com' terminates at good-corp.com. The fix was authored and committed by ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-cc9r-2j5m-2m83" }, "impact_statement": "not_affected \u2014 Target nodemailer 10.0.8 already contains the upstream fix for GHSA-cc9r-2j5m-2m83 (upstream commit 902b63e, \"terminate the domain at an RFC 5322 comment\"). In src/addressparser/index.ts, a token following a comment-closing ')' is now glued to the previous token only when one side carries '@'. So 'user@good-corp.com(x)evil.com' terminates at good-corp.com. The fix was authored and committed by ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.8", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.8" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-frj6-5rhh-vwfw is a false positive for nodemailer 10.0.8.", "vulnerability": { "name": "GHSA-frj6-5rhh-vwfw" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.8", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.8" } } ], "timestamp": "2026-09-29T23:56:00.225781+00:00", "status_notes": "Vulnerability GHSA-g57g-f23g-4646 affects version 10.0.8 of nodemailer.", "vulnerability": { "name": "GHSA-g57g-f23g-4646" }, "action_statement": "Vulnerability GHSA-g57g-f23g-4646 affects version 10.0.8 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.8", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.8" } } ], "timestamp": "2026-10-27T15:13:36.008785+00:00", "status_notes": "Vulnerability GHSA-g73g-hqqh-jr95 affects version 10.0.8 of nodemailer.", "vulnerability": { "name": "GHSA-g73g-hqqh-jr95" }, "action_statement": "Vulnerability GHSA-g73g-hqqh-jr95 affects version 10.0.8 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.8", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.8" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-h3hj-cmcx-xc66 is a false positive for nodemailer 10.0.8.", "vulnerability": { "name": "GHSA-h3hj-cmcx-xc66" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.8", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.8" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-jj37-3377-m6vv is a false positive for nodemailer 10.0.8.", "vulnerability": { "name": "GHSA-jj37-3377-m6vv" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.8", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.8" } } ], "timestamp": "2026-10-23T22:01:49.029239+00:00", "status_notes": "Vulnerability GHSA-m943-m63m-w62w affects version 10.0.8 of nodemailer.", "vulnerability": { "name": "GHSA-m943-m63m-w62w" }, "action_statement": "Vulnerability GHSA-m943-m63m-w62w affects version 10.0.8 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.8", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.8" } } ], "timestamp": "2026-11-14T00:16:55.667259+00:00", "status_notes": "Vulnerability GHSA-v53p-9fqp-m79j does not affect version 10.0.8 of nodemailer. not_affected \u2014 Not affected. The target (nodemailer 10.0.8) already contains the upstream fix for GHSA-v53p-9fqp-m79j. The upstream commit 437d7fc, \"fix(addressparser): scan free text for an address in linear time\", is an ancestor of HEAD. The quadratic free-text search is replaced by the _looseAddressStart linear scan plus a sticky regex (LOOSE_TEXT_ADDR, /y) run at a single offset.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-v53p-9fqp-m79j" }, "impact_statement": "not_affected \u2014 Not affected. The target (nodemailer 10.0.8) already contains the upstream fix for GHSA-v53p-9fqp-m79j. The upstream commit 437d7fc, \"fix(addressparser): scan free text for an address in linear time\", is an ancestor of HEAD. The quadratic free-text search is replaced by the _looseAddressStart linear scan plus a sticky regex (LOOSE_TEXT_ADDR, /y) run at a single offset." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.8", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.8" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-vm5r-23w9-m8hx is a false positive for nodemailer 10.0.8.", "vulnerability": { "name": "GHSA-vm5r-23w9-m8hx" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.8", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.8" } } ], "timestamp": "2026-11-13T22:09:32.764375+00:00", "status_notes": "Vulnerability GHSA-vvjj-xcjg-gr5g does not affect version 10.0.8 of nodemailer. not_affected \u2014 Target (nodemailer 10.0.8) already contains the upstream fix for GHSA-vvjj-xcjg-gr5g. src/smtp-connection/index.ts:567 strips CR/LF from the transport `name` option before it is used in the LHLO/EHLO/HELO commands. The fix commit 0a43876 is by the upstream author and shipped in the upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-vvjj-xcjg-gr5g" }, "impact_statement": "not_affected \u2014 Target (nodemailer 10.0.8) already contains the upstream fix for GHSA-vvjj-xcjg-gr5g. src/smtp-connection/index.ts:567 strips CR/LF from the transport `name` option before it is used in the LHLO/EHLO/HELO commands. The fix commit 0a43876 is by the upstream author and shipped in the upstream release." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.8", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.8" } } ], "timestamp": "2026-11-13T22:58:00.049762+00:00", "status_notes": "Vulnerability GHSA-wmmp-3585-3rmp does not affect version 10.0.8 of nodemailer. not_affected \u2014 Nodemailer 10.0.8 already contains both upstream fixes for GHSA-wmmp-3585-3rmp: 259c32d (UTS-46 mapping when encoding a domain) and b212ac4 (keep URL delimiters away from the domain mapper). They were authored by upstream (andris@reinman.eu) and are included in the upstream 10.0.8 release. No TuxCare-domain commits exist in history, so this is an upstream fix and the verdict is not_affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wmmp-3585-3rmp" }, "impact_statement": "not_affected \u2014 Nodemailer 10.0.8 already contains both upstream fixes for GHSA-wmmp-3585-3rmp: 259c32d (UTS-46 mapping when encoding a domain) and b212ac4 (keep URL delimiters away from the domain mapper). They were authored by upstream (andris@reinman.eu) and are included in the upstream 10.0.8 release. No TuxCare-domain commits exist in history, so this is an upstream fix and the verdict is not_affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.8", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.8" } } ], "timestamp": "2026-11-13T22:14:17.313956+00:00", "status_notes": "Vulnerability GHSA-wqvq-jvpq-h66f does not affect version 10.0.8 of nodemailer. not_affected \u2014 Nodemailer 10.0.8 already contains the upstream fix. shared.resolveContent now takes an access policy and rejects URL and file content with EURLACCESS or EFILEACCESS. jsonTransport (via normalize/resolveAll), MailMessage.resolveContent and the attachDataUrls path all pass the policy. The fix is upstream commit dc48ed3 by andris@reinman.eu, which is in the release the TuxCare branch was built on.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wqvq-jvpq-h66f" }, "impact_statement": "not_affected \u2014 Nodemailer 10.0.8 already contains the upstream fix. shared.resolveContent now takes an access policy and rejects URL and file content with EURLACCESS or EFILEACCESS. jsonTransport (via normalize/resolveAll), MailMessage.resolveContent and the attachDataUrls path all pass the policy. The fix is upstream commit dc48ed3 by andris@reinman.eu, which is in the release the TuxCare branch was built on." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.8", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.8" } } ], "timestamp": "2026-10-22T17:05:00.556684+00:00", "status_notes": "Vulnerability GHSA-wxxx-r42m-9rp8 is a false positive for nodemailer 10.0.8.", "vulnerability": { "name": "GHSA-wxxx-r42m-9rp8" }, "impact_statement": "The vulnerability has been withdrawn." } ] }