{
  "@id": "urn:uuid:dcfc6a3d-6204-4f85-9c2a-50edd90b5aa1",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 23,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-13T23:27:00.042596+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.9",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.9"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2020-7769 affects version 8.0.9 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2020-7769"
      },
      "action_statement": "Vulnerability CVE-2020-7769 affects version 8.0.9 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.9",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.9"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2021-23400 affects version 8.0.9 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2021-23400"
      },
      "action_statement": "Vulnerability CVE-2021-23400 affects version 8.0.9 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.9",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.9"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2025-13033 affects version 8.0.9 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2025-13033"
      },
      "action_statement": "Vulnerability CVE-2025-13033 affects version 8.0.9 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.9",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.9"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2025-14874 affects version 8.0.9 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2025-14874"
      },
      "action_statement": "Vulnerability CVE-2025-14874 affects version 8.0.9 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.9",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.9"
          }
        }
      ],
      "timestamp": "2026-10-15T15:49:00.133726+00:00",
      "status_notes": "Vulnerability CVE-2026-110869 affects version 8.0.9 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-110869"
      },
      "action_statement": "Vulnerability CVE-2026-110869 affects version 8.0.9 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.9",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.9"
          }
        }
      ],
      "timestamp": "2026-10-26T15:35:33.946658+00:00",
      "status_notes": "Vulnerability CVE-2026-110870 affects version 8.0.9 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-110870"
      },
      "action_statement": "Vulnerability CVE-2026-110870 affects version 8.0.9 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.9",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.9"
          }
        }
      ],
      "timestamp": "2026-10-20T02:46:00.084729+00:00",
      "status_notes": "Vulnerability CVE-2026-110871 affects version 8.0.9 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-110871"
      },
      "action_statement": "Vulnerability CVE-2026-110871 affects version 8.0.9 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.9",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.9"
          }
        }
      ],
      "timestamp": "2026-10-15T14:51:00.186658+00:00",
      "status_notes": "Vulnerability CVE-2026-110872 affects version 8.0.9 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-110872"
      },
      "action_statement": "Vulnerability CVE-2026-110872 affects version 8.0.9 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.9",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.9"
          }
        }
      ],
      "timestamp": "2026-11-03T14:36:48.497569+00:00",
      "status_notes": "Vulnerability CVE-2026-121424 affects version 8.0.9 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-121424"
      },
      "action_statement": "Vulnerability CVE-2026-121424 affects version 8.0.9 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.9",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.9"
          }
        }
      ],
      "timestamp": "2026-11-03T14:36:48.497569+00:00",
      "status_notes": "Vulnerability CVE-2026-121425 affects version 8.0.9 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-121425"
      },
      "action_statement": "Vulnerability CVE-2026-121425 affects version 8.0.9 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.9",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.9"
          }
        }
      ],
      "timestamp": "2026-11-03T14:36:48.497569+00:00",
      "status_notes": "Vulnerability CVE-2026-121426 affects version 8.0.9 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-121426"
      },
      "action_statement": "Vulnerability CVE-2026-121426 affects version 8.0.9 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.9",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.9"
          }
        }
      ],
      "timestamp": "2026-11-10T15:29:32.523739+00:00",
      "status_notes": "Vulnerability CVE-2026-125755 affects version 8.0.9 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-125755"
      },
      "action_statement": "Vulnerability CVE-2026-125755 affects version 8.0.9 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.9",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-82659 affects version 8.0.9 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-82659"
      },
      "action_statement": "Vulnerability CVE-2026-82659 affects version 8.0.9 of nodemailer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.9",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.9"
          }
        }
      ],
      "timestamp": "2026-11-13T23:12:50.176480+00:00",
      "status_notes": "Vulnerability CVE-2026-82662 does not affect version 8.0.9 of nodemailer. not_affected \u2014 The upstream fix, commit 833d6e58 \"enforce strict TLS for OAuth2 and Ethereal credential requests (#1818)\", is already in HEAD. XOAuth2 token requests and Ethereal account-creation requests now pass tls.rejectUnauthorized=true, so they validate certificates. The fix is by Andris Reinman (upstream, andris@reinman.eu) and is in the upstream release, so the verdict is not_affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-82662"
      },
      "impact_statement": "not_affected \u2014 The upstream fix, commit 833d6e58 \"enforce strict TLS for OAuth2 and Ethereal credential requests (#1818)\", is already in HEAD. XOAuth2 token requests and Ethereal account-creation requests now pass tls.rejectUnauthorized=true, so they validate certificates. The fix is by Andris Reinman (upstream, andris@reinman.eu) and is in the upstream release, so the verdict is not_affected."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.9",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.9"
          }
        }
      ],
      "timestamp": "2026-11-13T23:27:00.042596+00:00",
      "status_notes": "Vulnerability CVE-2026-82854 does not affect version 8.0.9 of nodemailer. not_affected \u2014 Not affected. The upstream fix for the envelope.size SMTP command injection (nodemailer commit 2d7b971) is already in HEAD. lib/smtp-connection/index.js:1210-1215 coerces envelope.size with Number() and emits SIZE= only for a positive number, so CRLF cannot reach the MAIL FROM command. The fix was authored by upstream (andris@reinman.eu) and shipped in the upstream release. HEAD has no TuxCare ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-82854"
      },
      "impact_statement": "not_affected \u2014 Not affected. The upstream fix for the envelope.size SMTP command injection (nodemailer commit 2d7b971) is already in HEAD. lib/smtp-connection/index.js:1210-1215 coerces envelope.size with Number() and emits SIZE= only for a positive number, so CRLF cannot reach the MAIL FROM command. The fix was authored by upstream (andris@reinman.eu) and shipped in the upstream release. HEAD has no TuxCare ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.9",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.9"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2026-90776 affects version 8.0.9 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-90776"
      },
      "action_statement": "Vulnerability CVE-2026-90776 affects version 8.0.9 of nodemailer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.9",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.9"
          }
        }
      ],
      "timestamp": "2026-11-13T22:16:24.742318+00:00",
      "status_notes": "Vulnerability GHSA-268h-hp4c-crq3 does not affect version 8.0.9 of nodemailer. not_affected \u2014 Nodemailer 8.0.9 already contains the upstream fix (commit 5f69497, by Andris Reinman). It strips CR/LF from list.*.comment before the prepared List-* header values are built. The fix shipped in the upstream release that TuxCare onboarded, so the target is not affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-268h-hp4c-crq3"
      },
      "impact_statement": "not_affected \u2014 Nodemailer 8.0.9 already contains the upstream fix (commit 5f69497, by Andris Reinman). It strips CR/LF from list.*.comment before the prepared List-* header values are built. The fix shipped in the upstream release that TuxCare onboarded, so the target is not affected."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.9",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-2x7j-588g-ccc2 affects version 8.0.9 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-2x7j-588g-ccc2"
      },
      "action_statement": "Vulnerability GHSA-2x7j-588g-ccc2 affects version 8.0.9 of nodemailer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.9",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.9"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-46j5-6fg5-4gv3 is a false positive for nodemailer 8.0.9.",
      "vulnerability": {
        "name": "GHSA-46j5-6fg5-4gv3"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.9",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.9"
          }
        }
      ],
      "timestamp": "2026-10-27T15:13:32.414812+00:00",
      "status_notes": "Vulnerability GHSA-4ffr-jq9g-5ffx affects version 8.0.9 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-4ffr-jq9g-5ffx"
      },
      "action_statement": "Vulnerability GHSA-4ffr-jq9g-5ffx affects version 8.0.9 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.9",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.9"
          }
        }
      ],
      "timestamp": "2026-10-27T15:13:32.414812+00:00",
      "status_notes": "Vulnerability GHSA-4g23-2xm8-66gc affects version 8.0.9 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-4g23-2xm8-66gc"
      },
      "action_statement": "Vulnerability GHSA-4g23-2xm8-66gc affects version 8.0.9 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.9",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.9"
          }
        }
      ],
      "timestamp": "2026-10-15T12:59:10.273238+00:00",
      "status_notes": "Vulnerability GHSA-6vj9-mwq6-2f5v affects version 8.0.9 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-6vj9-mwq6-2f5v"
      },
      "action_statement": "Vulnerability GHSA-6vj9-mwq6-2f5v affects version 8.0.9 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.9",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.9"
          }
        }
      ],
      "timestamp": "2026-10-23T22:01:00.144162+00:00",
      "status_notes": "Vulnerability GHSA-85x2-q946-cp5h affects version 8.0.9 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-85x2-q946-cp5h"
      },
      "action_statement": "Vulnerability GHSA-85x2-q946-cp5h affects version 8.0.9 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.9",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.9"
          }
        }
      ],
      "timestamp": "2026-10-23T22:01:00.144162+00:00",
      "status_notes": "Vulnerability GHSA-8c8m-p3m8-cjg8 affects version 8.0.9 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-8c8m-p3m8-cjg8"
      },
      "action_statement": "Vulnerability GHSA-8c8m-p3m8-cjg8 affects version 8.0.9 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.9",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-8m3c-c648-2xjj affects version 8.0.9 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-8m3c-c648-2xjj"
      },
      "action_statement": "Vulnerability GHSA-8m3c-c648-2xjj affects version 8.0.9 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.9",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.9"
          }
        }
      ],
      "timestamp": "2026-09-29T18:46:58.638266+00:00",
      "status_notes": "Vulnerability GHSA-8vvx-rff5-p5rq affects version 8.0.9 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-8vvx-rff5-p5rq"
      },
      "action_statement": "Vulnerability GHSA-8vvx-rff5-p5rq affects version 8.0.9 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.9",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.9"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-9h6g-pr28-7cqp affects version 8.0.9 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-9h6g-pr28-7cqp"
      },
      "action_statement": "Vulnerability GHSA-9h6g-pr28-7cqp affects version 8.0.9 of nodemailer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.9",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.9"
          }
        }
      ],
      "timestamp": "2026-11-13T22:06:56.306734+00:00",
      "status_notes": "Vulnerability GHSA-c7w3-x93f-qmm8 does not affect version 8.0.9 of nodemailer. not_affected \u2014 The target (nodemailer 8.0.9) already has the upstream fix. lib/smtp-connection/index.js:1210-1215 coerces envelope.size with Number() and only appends SIZE=<number> when the result is positive, so CR/LF cannot reach the MAIL FROM command. The fix commit 2d7b971 (author andris@reinman.eu) is an ancestor of HEAD, and HEAD's history has no TuxCare commits, so this is an upstream fix.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-c7w3-x93f-qmm8"
      },
      "impact_statement": "not_affected \u2014 The target (nodemailer 8.0.9) already has the upstream fix. lib/smtp-connection/index.js:1210-1215 coerces envelope.size with Number() and only appends SIZE=<number> when the result is positive, so CR/LF cannot reach the MAIL FROM command. The fix commit 2d7b971 (author andris@reinman.eu) is an ancestor of HEAD, and HEAD's history has no TuxCare commits, so this is an upstream fix."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.9",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-cc9r-2j5m-2m83 affects version 8.0.9 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-cc9r-2j5m-2m83"
      },
      "action_statement": "Vulnerability GHSA-cc9r-2j5m-2m83 affects version 8.0.9 of nodemailer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.9",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.9"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-frj6-5rhh-vwfw is a false positive for nodemailer 8.0.9.",
      "vulnerability": {
        "name": "GHSA-frj6-5rhh-vwfw"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.9",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.9"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-g57g-f23g-4646 affects version 8.0.9 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-g57g-f23g-4646"
      },
      "action_statement": "Vulnerability GHSA-g57g-f23g-4646 affects version 8.0.9 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.9",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.9"
          }
        }
      ],
      "timestamp": "2026-10-27T15:13:32.414812+00:00",
      "status_notes": "Vulnerability GHSA-g73g-hqqh-jr95 affects version 8.0.9 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-g73g-hqqh-jr95"
      },
      "action_statement": "Vulnerability GHSA-g73g-hqqh-jr95 affects version 8.0.9 of nodemailer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.9",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.9"
          }
        }
      ],
      "timestamp": "2026-10-26T11:12:01.434845+00:00",
      "status_notes": "Vulnerability GHSA-h3hj-cmcx-xc66 is a false positive for nodemailer 8.0.9.",
      "vulnerability": {
        "name": "GHSA-h3hj-cmcx-xc66"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.9",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.9"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-jj37-3377-m6vv is a false positive for nodemailer 8.0.9.",
      "vulnerability": {
        "name": "GHSA-jj37-3377-m6vv"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.9",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.9"
          }
        }
      ],
      "timestamp": "2026-10-23T22:01:49.029239+00:00",
      "status_notes": "Vulnerability GHSA-m943-m63m-w62w affects version 8.0.9 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-m943-m63m-w62w"
      },
      "action_statement": "Vulnerability GHSA-m943-m63m-w62w affects version 8.0.9 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.9",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-p6gq-j5cr-w38f affects version 8.0.9 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-p6gq-j5cr-w38f"
      },
      "action_statement": "Vulnerability GHSA-p6gq-j5cr-w38f affects version 8.0.9 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.9",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.9"
          }
        }
      ],
      "timestamp": "2026-09-29T23:59:00.245334+00:00",
      "status_notes": "Vulnerability GHSA-v53p-9fqp-m79j affects version 8.0.9 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-v53p-9fqp-m79j"
      },
      "action_statement": "Vulnerability GHSA-v53p-9fqp-m79j affects version 8.0.9 of nodemailer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.9",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.9"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-vm5r-23w9-m8hx is a false positive for nodemailer 8.0.9.",
      "vulnerability": {
        "name": "GHSA-vm5r-23w9-m8hx"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.9",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.9"
          }
        }
      ],
      "timestamp": "2026-11-13T22:09:00.042716+00:00",
      "status_notes": "Vulnerability GHSA-vvjj-xcjg-gr5g does not affect version 8.0.9 of nodemailer. not_affected \u2014 Not affected. The target (nodemailer 8.0.9) already contains the upstream fix for GHSA-vvjj-xcjg-gr5g. lib/smtp-connection/index.js:93 strips CR/LF from the transport `name` option before it is used in EHLO, HELO or LHLO. The fix is upstream commit 0a43876, which shipped in the upstream release. HEAD has no TuxCare-domain commit.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-vvjj-xcjg-gr5g"
      },
      "impact_statement": "not_affected \u2014 Not affected. The target (nodemailer 8.0.9) already contains the upstream fix for GHSA-vvjj-xcjg-gr5g. lib/smtp-connection/index.js:93 strips CR/LF from the transport `name` option before it is used in EHLO, HELO or LHLO. The fix is upstream commit 0a43876, which shipped in the upstream release. HEAD has no TuxCare-domain commit."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.9",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.9"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-wmmp-3585-3rmp affects version 8.0.9 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-wmmp-3585-3rmp"
      },
      "action_statement": "Vulnerability GHSA-wmmp-3585-3rmp affects version 8.0.9 of nodemailer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.9",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.9"
          }
        }
      ],
      "timestamp": "2026-11-13T22:14:00.030327+00:00",
      "status_notes": "Vulnerability GHSA-wqvq-jvpq-h66f does not affect version 8.0.9 of nodemailer. not_affected \u2014 The target (nodemailer 8.0.9) already contains the upstream fix for GHSA-wqvq-jvpq-h66f. shared.resolveContent() accepts an access-policy options argument and rejects URLs and files with EURLACCESS / EFILEACCESS. Both pre-resolution callers pass the flags: MailMessage.resolveAll() (used by jsonTransport) and the attachDataUrls path in Mailer._convertDataImages(). The fix is upstream commit 5f69...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-wqvq-jvpq-h66f"
      },
      "impact_statement": "not_affected \u2014 The target (nodemailer 8.0.9) already contains the upstream fix for GHSA-wqvq-jvpq-h66f. shared.resolveContent() accepts an access-policy options argument and rejects URLs and files with EURLACCESS / EFILEACCESS. Both pre-resolution callers pass the flags: MailMessage.resolveAll() (used by jsonTransport) and the attachDataUrls path in Mailer._convertDataImages(). The fix is upstream commit 5f69..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.9",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.9"
          }
        }
      ],
      "timestamp": "2026-10-22T17:05:00.556684+00:00",
      "status_notes": "Vulnerability GHSA-wxxx-r42m-9rp8 is a false positive for nodemailer 8.0.9.",
      "vulnerability": {
        "name": "GHSA-wxxx-r42m-9rp8"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}