{ "@id": "urn:uuid:2a58e0c3-76fe-4916-b56a-8afaa18bf751", "role": "Document Creator", "author": "https://tuxcare.com", "version": 22, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-13T23:24:48.843097+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.5" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2020-7769 affects version 8.0.5 of nodemailer.", "vulnerability": { "name": "CVE-2020-7769" }, "action_statement": "Vulnerability CVE-2020-7769 affects version 8.0.5 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.5" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2021-23400 affects version 8.0.5 of nodemailer.", "vulnerability": { "name": "CVE-2021-23400" }, "action_statement": "Vulnerability CVE-2021-23400 affects version 8.0.5 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.5" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2025-13033 affects version 8.0.5 of nodemailer.", "vulnerability": { "name": "CVE-2025-13033" }, "action_statement": "Vulnerability CVE-2025-13033 affects version 8.0.5 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.5" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2025-14874 affects version 8.0.5 of nodemailer.", "vulnerability": { "name": "CVE-2025-14874" }, "action_statement": "Vulnerability CVE-2025-14874 affects version 8.0.5 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.5" } } ], "timestamp": "2026-10-15T15:49:00.133726+00:00", "status_notes": "Vulnerability CVE-2026-110869 affects version 8.0.5 of nodemailer.", "vulnerability": { "name": "CVE-2026-110869" }, "action_statement": "Vulnerability CVE-2026-110869 affects version 8.0.5 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.5" } } ], "timestamp": "2026-10-26T15:35:33.946658+00:00", "status_notes": "Vulnerability CVE-2026-110870 affects version 8.0.5 of nodemailer.", "vulnerability": { "name": "CVE-2026-110870" }, "action_statement": "Vulnerability CVE-2026-110870 affects version 8.0.5 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.5" } } ], "timestamp": "2026-10-20T02:46:00.084729+00:00", "status_notes": "Vulnerability CVE-2026-110871 affects version 8.0.5 of nodemailer.", "vulnerability": { "name": "CVE-2026-110871" }, "action_statement": "Vulnerability CVE-2026-110871 affects version 8.0.5 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.5" } } ], "timestamp": "2026-10-15T14:51:00.186658+00:00", "status_notes": "Vulnerability CVE-2026-110872 affects version 8.0.5 of nodemailer.", "vulnerability": { "name": "CVE-2026-110872" }, "action_statement": "Vulnerability CVE-2026-110872 affects version 8.0.5 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.5" } } ], "timestamp": "2026-11-03T14:36:48.497569+00:00", "status_notes": "Vulnerability CVE-2026-121424 affects version 8.0.5 of nodemailer.", "vulnerability": { "name": "CVE-2026-121424" }, "action_statement": "Vulnerability CVE-2026-121424 affects version 8.0.5 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.5" } } ], "timestamp": "2026-11-03T14:36:48.497569+00:00", "status_notes": "Vulnerability CVE-2026-121425 affects version 8.0.5 of nodemailer.", "vulnerability": { "name": "CVE-2026-121425" }, "action_statement": "Vulnerability CVE-2026-121425 affects version 8.0.5 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.5" } } ], "timestamp": "2026-11-03T14:36:48.497569+00:00", "status_notes": "Vulnerability CVE-2026-121426 affects version 8.0.5 of nodemailer.", "vulnerability": { "name": "CVE-2026-121426" }, "action_statement": "Vulnerability CVE-2026-121426 affects version 8.0.5 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.5" } } ], "timestamp": "2026-11-10T15:29:32.523739+00:00", "status_notes": "Vulnerability CVE-2026-125755 affects version 8.0.5 of nodemailer.", "vulnerability": { "name": "CVE-2026-125755" }, "action_statement": "Vulnerability CVE-2026-125755 affects version 8.0.5 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-82659 affects version 8.0.5 of nodemailer.", "vulnerability": { "name": "CVE-2026-82659" }, "action_statement": "Vulnerability CVE-2026-82659 affects version 8.0.5 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.5" } } ], "timestamp": "2026-10-05T22:59:00.101528+00:00", "status_notes": "Vulnerability CVE-2026-82662 affects version 8.0.5 of nodemailer.", "vulnerability": { "name": "CVE-2026-82662" }, "action_statement": "Vulnerability CVE-2026-82662 affects version 8.0.5 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.5" } } ], "timestamp": "2026-11-13T23:24:48.843097+00:00", "status_notes": "Vulnerability CVE-2026-82854 does not affect version 8.0.5 of nodemailer. not_affected \u2014 Nodemailer 8.0.5 already contains the upstream fix for CVE-2026-82854. The envelope.size value is coerced with Number() and only emitted as SIZE= if it is positive. CRLF payloads become NaN, then 0, and are dropped. The fix commit 2d7b971 is by upstream author Andris Reinman and is an ancestor of HEAD. It is in the upstream 8.0.4 release, before any TuxCare commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-82854" }, "impact_statement": "not_affected \u2014 Nodemailer 8.0.5 already contains the upstream fix for CVE-2026-82854. The envelope.size value is coerced with Number() and only emitted as SIZE= if it is positive. CRLF payloads become NaN, then 0, and are dropped. The fix commit 2d7b971 is by upstream author Andris Reinman and is an ancestor of HEAD. It is in the upstream 8.0.4 release, before any TuxCare commit." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.5" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2026-90776 affects version 8.0.5 of nodemailer.", "vulnerability": { "name": "CVE-2026-90776" }, "action_statement": "Vulnerability CVE-2026-90776 affects version 8.0.5 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-268h-hp4c-crq3 affects version 8.0.5 of nodemailer.", "vulnerability": { "name": "GHSA-268h-hp4c-crq3" }, "action_statement": "Vulnerability GHSA-268h-hp4c-crq3 affects version 8.0.5 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-2x7j-588g-ccc2 affects version 8.0.5 of nodemailer.", "vulnerability": { "name": "GHSA-2x7j-588g-ccc2" }, "action_statement": "Vulnerability GHSA-2x7j-588g-ccc2 affects version 8.0.5 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.5" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-46j5-6fg5-4gv3 is a false positive for nodemailer 8.0.5.", "vulnerability": { "name": "GHSA-46j5-6fg5-4gv3" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.5" } } ], "timestamp": "2026-10-27T15:13:32.414812+00:00", "status_notes": "Vulnerability GHSA-4ffr-jq9g-5ffx affects version 8.0.5 of nodemailer.", "vulnerability": { "name": "GHSA-4ffr-jq9g-5ffx" }, "action_statement": "Vulnerability GHSA-4ffr-jq9g-5ffx affects version 8.0.5 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.5" } } ], "timestamp": "2026-10-27T15:13:32.414812+00:00", "status_notes": "Vulnerability GHSA-4g23-2xm8-66gc affects version 8.0.5 of nodemailer.", "vulnerability": { "name": "GHSA-4g23-2xm8-66gc" }, "action_statement": "Vulnerability GHSA-4g23-2xm8-66gc affects version 8.0.5 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.5" } } ], "timestamp": "2026-10-15T12:59:10.273238+00:00", "status_notes": "Vulnerability GHSA-6vj9-mwq6-2f5v affects version 8.0.5 of nodemailer.", "vulnerability": { "name": "GHSA-6vj9-mwq6-2f5v" }, "action_statement": "Vulnerability GHSA-6vj9-mwq6-2f5v affects version 8.0.5 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.5" } } ], "timestamp": "2026-10-23T22:01:00.144162+00:00", "status_notes": "Vulnerability GHSA-85x2-q946-cp5h affects version 8.0.5 of nodemailer.", "vulnerability": { "name": "GHSA-85x2-q946-cp5h" }, "action_statement": "Vulnerability GHSA-85x2-q946-cp5h affects version 8.0.5 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.5" } } ], "timestamp": "2026-10-23T22:01:00.144162+00:00", "status_notes": "Vulnerability GHSA-8c8m-p3m8-cjg8 affects version 8.0.5 of nodemailer.", "vulnerability": { "name": "GHSA-8c8m-p3m8-cjg8" }, "action_statement": "Vulnerability GHSA-8c8m-p3m8-cjg8 affects version 8.0.5 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-8m3c-c648-2xjj affects version 8.0.5 of nodemailer.", "vulnerability": { "name": "GHSA-8m3c-c648-2xjj" }, "action_statement": "Vulnerability GHSA-8m3c-c648-2xjj affects version 8.0.5 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.5" } } ], "timestamp": "2026-09-29T18:46:58.638266+00:00", "status_notes": "Vulnerability GHSA-8vvx-rff5-p5rq affects version 8.0.5 of nodemailer.", "vulnerability": { "name": "GHSA-8vvx-rff5-p5rq" }, "action_statement": "Vulnerability GHSA-8vvx-rff5-p5rq affects version 8.0.5 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.5" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-9h6g-pr28-7cqp affects version 8.0.5 of nodemailer.", "vulnerability": { "name": "GHSA-9h6g-pr28-7cqp" }, "action_statement": "Vulnerability GHSA-9h6g-pr28-7cqp affects version 8.0.5 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.5" } } ], "timestamp": "2026-11-13T22:04:09.216033+00:00", "status_notes": "Vulnerability GHSA-c7w3-x93f-qmm8 does not affect version 8.0.5 of nodemailer. not_affected \u2014 Target nodemailer 8.0.5 already contains the upstream fix for GHSA-c7w3-x93f-qmm8 (upstream commit 2d7b971, \"sanitize envelope size to prevent SMTP command injection\"). In lib/smtp-connection/index.js the envelope.size value is coerced with Number() and appended only if positive, so CR/LF cannot reach the MAIL FROM command line. The fix is upstream-authored and shipped in the upstream 8.0.4+ re...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-c7w3-x93f-qmm8" }, "impact_statement": "not_affected \u2014 Target nodemailer 8.0.5 already contains the upstream fix for GHSA-c7w3-x93f-qmm8 (upstream commit 2d7b971, \"sanitize envelope size to prevent SMTP command injection\"). In lib/smtp-connection/index.js the envelope.size value is coerced with Number() and appended only if positive, so CR/LF cannot reach the MAIL FROM command line. The fix is upstream-authored and shipped in the upstream 8.0.4+ re..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-cc9r-2j5m-2m83 affects version 8.0.5 of nodemailer.", "vulnerability": { "name": "GHSA-cc9r-2j5m-2m83" }, "action_statement": "Vulnerability GHSA-cc9r-2j5m-2m83 affects version 8.0.5 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.5" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-frj6-5rhh-vwfw is a false positive for nodemailer 8.0.5.", "vulnerability": { "name": "GHSA-frj6-5rhh-vwfw" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.5" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-g57g-f23g-4646 affects version 8.0.5 of nodemailer.", "vulnerability": { "name": "GHSA-g57g-f23g-4646" }, "action_statement": "Vulnerability GHSA-g57g-f23g-4646 affects version 8.0.5 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.5" } } ], "timestamp": "2026-10-27T15:13:32.414812+00:00", "status_notes": "Vulnerability GHSA-g73g-hqqh-jr95 affects version 8.0.5 of nodemailer.", "vulnerability": { "name": "GHSA-g73g-hqqh-jr95" }, "action_statement": "Vulnerability GHSA-g73g-hqqh-jr95 affects version 8.0.5 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.5" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability GHSA-h3hj-cmcx-xc66 is a false positive for nodemailer 8.0.5.", "vulnerability": { "name": "GHSA-h3hj-cmcx-xc66" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.5" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-jj37-3377-m6vv is a false positive for nodemailer 8.0.5.", "vulnerability": { "name": "GHSA-jj37-3377-m6vv" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.5" } } ], "timestamp": "2026-10-23T22:01:16.677614+00:00", "status_notes": "Vulnerability GHSA-m943-m63m-w62w affects version 8.0.5 of nodemailer.", "vulnerability": { "name": "GHSA-m943-m63m-w62w" }, "action_statement": "Vulnerability GHSA-m943-m63m-w62w affects version 8.0.5 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-p6gq-j5cr-w38f affects version 8.0.5 of nodemailer.", "vulnerability": { "name": "GHSA-p6gq-j5cr-w38f" }, "action_statement": "Vulnerability GHSA-p6gq-j5cr-w38f affects version 8.0.5 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-r7g4-qg5f-qqm2 affects version 8.0.5 of nodemailer.", "vulnerability": { "name": "GHSA-r7g4-qg5f-qqm2" }, "action_statement": "Vulnerability GHSA-r7g4-qg5f-qqm2 affects version 8.0.5 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.5" } } ], "timestamp": "2026-09-29T23:59:00.245334+00:00", "status_notes": "Vulnerability GHSA-v53p-9fqp-m79j affects version 8.0.5 of nodemailer.", "vulnerability": { "name": "GHSA-v53p-9fqp-m79j" }, "action_statement": "Vulnerability GHSA-v53p-9fqp-m79j affects version 8.0.5 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.5" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-vm5r-23w9-m8hx is a false positive for nodemailer 8.0.5.", "vulnerability": { "name": "GHSA-vm5r-23w9-m8hx" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.5" } } ], "timestamp": "2026-11-13T22:09:00.042716+00:00", "status_notes": "Vulnerability GHSA-vvjj-xcjg-gr5g does not affect version 8.0.5 of nodemailer. not_affected \u2014 Nodemailer 8.0.5 already contains the upstream fix for GHSA-vvjj-xcjg-gr5g. lib/smtp-connection/index.js:93 strips CR/LF from the transport `name` option before it is used in LHLO/EHLO/HELO. The fix is upstream commit 0a43876 (author andris@reinman.eu), which shipped in the release HEAD is built from, so the verdict is not_affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-vvjj-xcjg-gr5g" }, "impact_statement": "not_affected \u2014 Nodemailer 8.0.5 already contains the upstream fix for GHSA-vvjj-xcjg-gr5g. lib/smtp-connection/index.js:93 strips CR/LF from the transport `name` option before it is used in LHLO/EHLO/HELO. The fix is upstream commit 0a43876 (author andris@reinman.eu), which shipped in the release HEAD is built from, so the verdict is not_affected." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wmmp-3585-3rmp affects version 8.0.5 of nodemailer.", "vulnerability": { "name": "GHSA-wmmp-3585-3rmp" }, "action_statement": "Vulnerability GHSA-wmmp-3585-3rmp affects version 8.0.5 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wqvq-jvpq-h66f affects version 8.0.5 of nodemailer.", "vulnerability": { "name": "GHSA-wqvq-jvpq-h66f" }, "action_statement": "Vulnerability GHSA-wqvq-jvpq-h66f affects version 8.0.5 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.5" } } ], "timestamp": "2026-10-22T17:05:00.556684+00:00", "status_notes": "Vulnerability GHSA-wxxx-r42m-9rp8 is a false positive for nodemailer 8.0.5.", "vulnerability": { "name": "GHSA-wxxx-r42m-9rp8" }, "impact_statement": "The vulnerability has been withdrawn." } ] }