{
  "@id": "urn:uuid:761fba51-555b-45c6-a3a0-f9ab6d282a7b",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 22,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-13T23:24:40.331841+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.7",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.7"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2020-7769 affects version 8.0.7 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2020-7769"
      },
      "action_statement": "Vulnerability CVE-2020-7769 affects version 8.0.7 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.7",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.7"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2021-23400 affects version 8.0.7 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2021-23400"
      },
      "action_statement": "Vulnerability CVE-2021-23400 affects version 8.0.7 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.7",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.7"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2025-13033 affects version 8.0.7 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2025-13033"
      },
      "action_statement": "Vulnerability CVE-2025-13033 affects version 8.0.7 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.7",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.7"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2025-14874 affects version 8.0.7 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2025-14874"
      },
      "action_statement": "Vulnerability CVE-2025-14874 affects version 8.0.7 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.7",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.7"
          }
        }
      ],
      "timestamp": "2026-10-15T15:49:00.133726+00:00",
      "status_notes": "Vulnerability CVE-2026-110869 affects version 8.0.7 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-110869"
      },
      "action_statement": "Vulnerability CVE-2026-110869 affects version 8.0.7 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.7",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.7"
          }
        }
      ],
      "timestamp": "2026-10-26T15:35:33.946658+00:00",
      "status_notes": "Vulnerability CVE-2026-110870 affects version 8.0.7 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-110870"
      },
      "action_statement": "Vulnerability CVE-2026-110870 affects version 8.0.7 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.7",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.7"
          }
        }
      ],
      "timestamp": "2026-10-20T02:46:00.084729+00:00",
      "status_notes": "Vulnerability CVE-2026-110871 affects version 8.0.7 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-110871"
      },
      "action_statement": "Vulnerability CVE-2026-110871 affects version 8.0.7 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.7",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.7"
          }
        }
      ],
      "timestamp": "2026-10-15T14:51:00.186658+00:00",
      "status_notes": "Vulnerability CVE-2026-110872 affects version 8.0.7 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-110872"
      },
      "action_statement": "Vulnerability CVE-2026-110872 affects version 8.0.7 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.7",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.7"
          }
        }
      ],
      "timestamp": "2026-11-03T14:36:48.497569+00:00",
      "status_notes": "Vulnerability CVE-2026-121424 affects version 8.0.7 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-121424"
      },
      "action_statement": "Vulnerability CVE-2026-121424 affects version 8.0.7 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.7",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.7"
          }
        }
      ],
      "timestamp": "2026-11-03T14:36:48.497569+00:00",
      "status_notes": "Vulnerability CVE-2026-121425 affects version 8.0.7 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-121425"
      },
      "action_statement": "Vulnerability CVE-2026-121425 affects version 8.0.7 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.7",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.7"
          }
        }
      ],
      "timestamp": "2026-11-03T14:36:48.497569+00:00",
      "status_notes": "Vulnerability CVE-2026-121426 affects version 8.0.7 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-121426"
      },
      "action_statement": "Vulnerability CVE-2026-121426 affects version 8.0.7 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.7",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.7"
          }
        }
      ],
      "timestamp": "2026-11-10T15:29:32.523739+00:00",
      "status_notes": "Vulnerability CVE-2026-125755 affects version 8.0.7 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-125755"
      },
      "action_statement": "Vulnerability CVE-2026-125755 affects version 8.0.7 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.7",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-82659 affects version 8.0.7 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-82659"
      },
      "action_statement": "Vulnerability CVE-2026-82659 affects version 8.0.7 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.7",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.7"
          }
        }
      ],
      "timestamp": "2026-10-05T22:59:00.101528+00:00",
      "status_notes": "Vulnerability CVE-2026-82662 affects version 8.0.7 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-82662"
      },
      "action_statement": "Vulnerability CVE-2026-82662 affects version 8.0.7 of nodemailer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.7",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.7"
          }
        }
      ],
      "timestamp": "2026-11-13T23:24:40.331841+00:00",
      "status_notes": "Vulnerability CVE-2026-82854 does not affect version 8.0.7 of nodemailer. not_affected \u2014 Nodemailer 8.0.7 already contains the upstream fix for CVE-2026-82854 (commit 2d7b971, first shipped in 8.0.4). envelope.size is coerced with Number() and appended to MAIL FROM only if positive, so CRLF cannot reach the SMTP command.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-82854"
      },
      "impact_statement": "not_affected \u2014 Nodemailer 8.0.7 already contains the upstream fix for CVE-2026-82854 (commit 2d7b971, first shipped in 8.0.4). envelope.size is coerced with Number() and appended to MAIL FROM only if positive, so CRLF cannot reach the SMTP command."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.7",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.7"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2026-90776 affects version 8.0.7 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-90776"
      },
      "action_statement": "Vulnerability CVE-2026-90776 affects version 8.0.7 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.7",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-268h-hp4c-crq3 affects version 8.0.7 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-268h-hp4c-crq3"
      },
      "action_statement": "Vulnerability GHSA-268h-hp4c-crq3 affects version 8.0.7 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.7",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-2x7j-588g-ccc2 affects version 8.0.7 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-2x7j-588g-ccc2"
      },
      "action_statement": "Vulnerability GHSA-2x7j-588g-ccc2 affects version 8.0.7 of nodemailer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.7",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.7"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-46j5-6fg5-4gv3 is a false positive for nodemailer 8.0.7.",
      "vulnerability": {
        "name": "GHSA-46j5-6fg5-4gv3"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.7",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.7"
          }
        }
      ],
      "timestamp": "2026-10-27T15:13:32.414812+00:00",
      "status_notes": "Vulnerability GHSA-4ffr-jq9g-5ffx affects version 8.0.7 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-4ffr-jq9g-5ffx"
      },
      "action_statement": "Vulnerability GHSA-4ffr-jq9g-5ffx affects version 8.0.7 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.7",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.7"
          }
        }
      ],
      "timestamp": "2026-10-27T15:13:32.414812+00:00",
      "status_notes": "Vulnerability GHSA-4g23-2xm8-66gc affects version 8.0.7 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-4g23-2xm8-66gc"
      },
      "action_statement": "Vulnerability GHSA-4g23-2xm8-66gc affects version 8.0.7 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.7",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.7"
          }
        }
      ],
      "timestamp": "2026-10-15T12:59:10.273238+00:00",
      "status_notes": "Vulnerability GHSA-6vj9-mwq6-2f5v affects version 8.0.7 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-6vj9-mwq6-2f5v"
      },
      "action_statement": "Vulnerability GHSA-6vj9-mwq6-2f5v affects version 8.0.7 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.7",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.7"
          }
        }
      ],
      "timestamp": "2026-10-23T22:01:00.144162+00:00",
      "status_notes": "Vulnerability GHSA-85x2-q946-cp5h affects version 8.0.7 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-85x2-q946-cp5h"
      },
      "action_statement": "Vulnerability GHSA-85x2-q946-cp5h affects version 8.0.7 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.7",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.7"
          }
        }
      ],
      "timestamp": "2026-10-23T22:01:00.144162+00:00",
      "status_notes": "Vulnerability GHSA-8c8m-p3m8-cjg8 affects version 8.0.7 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-8c8m-p3m8-cjg8"
      },
      "action_statement": "Vulnerability GHSA-8c8m-p3m8-cjg8 affects version 8.0.7 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.7",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-8m3c-c648-2xjj affects version 8.0.7 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-8m3c-c648-2xjj"
      },
      "action_statement": "Vulnerability GHSA-8m3c-c648-2xjj affects version 8.0.7 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.7",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.7"
          }
        }
      ],
      "timestamp": "2026-09-29T18:46:58.638266+00:00",
      "status_notes": "Vulnerability GHSA-8vvx-rff5-p5rq affects version 8.0.7 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-8vvx-rff5-p5rq"
      },
      "action_statement": "Vulnerability GHSA-8vvx-rff5-p5rq affects version 8.0.7 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.7",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.7"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-9h6g-pr28-7cqp affects version 8.0.7 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-9h6g-pr28-7cqp"
      },
      "action_statement": "Vulnerability GHSA-9h6g-pr28-7cqp affects version 8.0.7 of nodemailer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.7",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.7"
          }
        }
      ],
      "timestamp": "2026-11-13T22:05:00.053359+00:00",
      "status_notes": "Vulnerability GHSA-c7w3-x93f-qmm8 does not affect version 8.0.7 of nodemailer. not_affected \u2014 Target (nodemailer 8.0.7) already contains the upstream fix for GHSA-c7w3-x93f-qmm8. lib/smtp-connection/index.js now coerces envelope.size with Number() and emits SIZE= only for a positive numeric value, so CRLF cannot reach the MAIL FROM command line. The fix commit 2d7b971 is by Andris Reinman (upstream), is an ancestor of HEAD, and shipped in the upstream 8.0.4+ release.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-c7w3-x93f-qmm8"
      },
      "impact_statement": "not_affected \u2014 Target (nodemailer 8.0.7) already contains the upstream fix for GHSA-c7w3-x93f-qmm8. lib/smtp-connection/index.js now coerces envelope.size with Number() and emits SIZE= only for a positive numeric value, so CRLF cannot reach the MAIL FROM command line. The fix commit 2d7b971 is by Andris Reinman (upstream), is an ancestor of HEAD, and shipped in the upstream 8.0.4+ release."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.7",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-cc9r-2j5m-2m83 affects version 8.0.7 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-cc9r-2j5m-2m83"
      },
      "action_statement": "Vulnerability GHSA-cc9r-2j5m-2m83 affects version 8.0.7 of nodemailer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.7",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.7"
          }
        }
      ],
      "timestamp": "2026-10-20T12:46:51.138394+00:00",
      "status_notes": "Vulnerability GHSA-frj6-5rhh-vwfw is a false positive for nodemailer 8.0.7.",
      "vulnerability": {
        "name": "GHSA-frj6-5rhh-vwfw"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.7",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.7"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-g57g-f23g-4646 affects version 8.0.7 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-g57g-f23g-4646"
      },
      "action_statement": "Vulnerability GHSA-g57g-f23g-4646 affects version 8.0.7 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.7",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.7"
          }
        }
      ],
      "timestamp": "2026-10-27T15:13:32.414812+00:00",
      "status_notes": "Vulnerability GHSA-g73g-hqqh-jr95 affects version 8.0.7 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-g73g-hqqh-jr95"
      },
      "action_statement": "Vulnerability GHSA-g73g-hqqh-jr95 affects version 8.0.7 of nodemailer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.7",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.7"
          }
        }
      ],
      "timestamp": "2026-10-26T11:12:01.434845+00:00",
      "status_notes": "Vulnerability GHSA-h3hj-cmcx-xc66 is a false positive for nodemailer 8.0.7.",
      "vulnerability": {
        "name": "GHSA-h3hj-cmcx-xc66"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.7",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.7"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-jj37-3377-m6vv is a false positive for nodemailer 8.0.7.",
      "vulnerability": {
        "name": "GHSA-jj37-3377-m6vv"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.7",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.7"
          }
        }
      ],
      "timestamp": "2026-10-23T22:01:49.029239+00:00",
      "status_notes": "Vulnerability GHSA-m943-m63m-w62w affects version 8.0.7 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-m943-m63m-w62w"
      },
      "action_statement": "Vulnerability GHSA-m943-m63m-w62w affects version 8.0.7 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.7",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-p6gq-j5cr-w38f affects version 8.0.7 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-p6gq-j5cr-w38f"
      },
      "action_statement": "Vulnerability GHSA-p6gq-j5cr-w38f affects version 8.0.7 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.7",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-r7g4-qg5f-qqm2 affects version 8.0.7 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-r7g4-qg5f-qqm2"
      },
      "action_statement": "Vulnerability GHSA-r7g4-qg5f-qqm2 affects version 8.0.7 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.7",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.7"
          }
        }
      ],
      "timestamp": "2026-09-29T23:59:00.245334+00:00",
      "status_notes": "Vulnerability GHSA-v53p-9fqp-m79j affects version 8.0.7 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-v53p-9fqp-m79j"
      },
      "action_statement": "Vulnerability GHSA-v53p-9fqp-m79j affects version 8.0.7 of nodemailer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.7",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.7"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-vm5r-23w9-m8hx is a false positive for nodemailer 8.0.7.",
      "vulnerability": {
        "name": "GHSA-vm5r-23w9-m8hx"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.7",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.7"
          }
        }
      ],
      "timestamp": "2026-11-13T22:09:00.042716+00:00",
      "status_notes": "Vulnerability GHSA-vvjj-xcjg-gr5g does not affect version 8.0.7 of nodemailer. not_affected \u2014 Nodemailer 8.0.7 already contains the upstream fix for GHSA-vvjj-xcjg-gr5g. lib/smtp-connection/index.js:93 strips CR/LF from the transport `name` option before it reaches the LHLO/EHLO/HELO commands. The fix is upstream commit 0a43876 by andris@reinman.eu, which is part of the upstream 8.0.7 release.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-vvjj-xcjg-gr5g"
      },
      "impact_statement": "not_affected \u2014 Nodemailer 8.0.7 already contains the upstream fix for GHSA-vvjj-xcjg-gr5g. lib/smtp-connection/index.js:93 strips CR/LF from the transport `name` option before it reaches the LHLO/EHLO/HELO commands. The fix is upstream commit 0a43876 by andris@reinman.eu, which is part of the upstream 8.0.7 release."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.7",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-wmmp-3585-3rmp affects version 8.0.7 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-wmmp-3585-3rmp"
      },
      "action_statement": "Vulnerability GHSA-wmmp-3585-3rmp affects version 8.0.7 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.7",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-wqvq-jvpq-h66f affects version 8.0.7 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-wqvq-jvpq-h66f"
      },
      "action_statement": "Vulnerability GHSA-wqvq-jvpq-h66f affects version 8.0.7 of nodemailer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.7",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.7"
          }
        }
      ],
      "timestamp": "2026-10-22T17:05:00.556684+00:00",
      "status_notes": "Vulnerability GHSA-wxxx-r42m-9rp8 is a false positive for nodemailer 8.0.7.",
      "vulnerability": {
        "name": "GHSA-wxxx-r42m-9rp8"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}