{"schema_version":1,"title":"Nodemailer vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 32 vulnerabilities in Nodemailer: 3 in the last 7 days and 21 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-100702, was published on 26 September 2026.","url":"https://junglewise.ai/threats/technologies/nodemailer","json_url":"https://junglewise.ai/threats/technologies/nodemailer.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/nodemailer","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":10,"all_time":32,"critical":1,"exploited":0,"last_7_days":3,"last_30_days":21,"last_90_days":21,"last_365_days":30},"latest":[{"cve":"CVE-2026-100702","cvss":5.9,"slug":"cve-2026-100702-nodemailer-before-10-0-2-fails-to-properly-flatten-deeply-nested","title":"Nodemailer stack exhaustion in recipient array flattening","severity":"medium","exploited":false,"published_at":"2026-09-26T14:16:55.28+00:00","url":"https://junglewise.ai/threats/cve-2026-100702-nodemailer-before-10-0-2-fails-to-properly-flatten-deeply-nested"},{"cve":"CVE-2026-100701","cvss":5.9,"slug":"cve-2026-100701-nodemailer-versions-5-0-0-through-10-0-1-use-a-process-global","title":"Nodemailer TLS servername cache confusion vulnerability","severity":"medium","exploited":false,"published_at":"2026-09-26T14:16:55.143+00:00","url":"https://junglewise.ai/threats/cve-2026-100701-nodemailer-versions-5-0-0-through-10-0-1-use-a-process-global"},{"cve":"CVE-2026-100700","cvss":7.5,"slug":"cve-2026-100700-nodemailer-before-10-0-6-contains-a-denial-of-service","title":"nodemailer addressparser regular expression denial of service","severity":"high","exploited":false,"published_at":"2026-09-26T14:16:55.007+00:00","url":"https://junglewise.ai/threats/cve-2026-100700-nodemailer-before-10-0-6-contains-a-denial-of-service"},{"cve":"CVE-2026-92598","cvss":6.5,"epss":0.004,"slug":"cve-2026-92598-nodemailer-idn-punycode-domain-allow-list-bypass","title":"Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute","severity":"medium","exploited":false,"published_at":"2026-09-16T22:18:30.84+00:00","url":"https://junglewise.ai/threats/cve-2026-92598-nodemailer-idn-punycode-domain-allow-list-bypass"},{"cve":"CVE-2026-92597","cvss":6.5,"epss":0.0038,"slug":"cve-2026-92597-nodemailer-recipient-domain-validation-bypass-via-rfc-5322","title":"Nodemailer versions >= 6.9.16 and < 9.1.0 mis-parse RFC 5322 comments in email addresses: in lib/addressparser, a comment closed immediately","severity":"medium","exploited":false,"published_at":"2026-09-16T22:18:30.7+00:00","url":"https://junglewise.ai/threats/cve-2026-92597-nodemailer-recipient-domain-validation-bypass-via-rfc-5322"},{"cve":"CVE-2026-92596","cvss":7.5,"epss":0.0082,"slug":"cve-2026-92596-nodemailer-quadratic-time-complexity-in-address-parser-denial-of","title":"Nodemailer before 9.1.0 contains a quadratic time complexity vulnerability in the addressparser component that allows remote attackers to ca","severity":"high","exploited":false,"published_at":"2026-09-16T22:18:30.557+00:00","url":"https://junglewise.ai/threats/cve-2026-92596-nodemailer-quadratic-time-complexity-in-address-parser-denial-of"},{"cve":"CVE-2026-92595","cvss":5.9,"epss":0.003,"slug":"cve-2026-92595-nodemailer-resolvecontent-legacy-signature-security-sandbox","title":"Nodemailer (npm package `nodemailer`) versions 9.1.0 and earlier do not honor the `disableFileAccess` and `disableUrlAccess` sandbox options","severity":"medium","exploited":false,"published_at":"2026-09-16T22:18:30.417+00:00","url":"https://junglewise.ai/threats/cve-2026-92595-nodemailer-resolvecontent-legacy-signature-security-sandbox"},{"cve":"CVE-2026-90776","cvss":7.5,"epss":0.0068,"slug":"cve-2026-90776-nodemailer-quadratic-time-complexity-in-address-parser","title":"Nodemailer quadratic time complexity in address parser","severity":"high","exploited":false,"published_at":"2026-09-13T12:17:16.547+00:00","url":"https://junglewise.ai/threats/cve-2026-90776-nodemailer-quadratic-time-complexity-in-address-parser"},{"cvss":6.5,"slug":"nodemailer-idn-domain-allow-list-bypass-in-address-normalization-234ce721","title":"Nodemailer IDN domain allow-list bypass in address normalization","severity":"medium","exploited":false,"published_at":"2026-09-08T21:33:32+00:00","url":"https://junglewise.ai/threats/nodemailer-idn-domain-allow-list-bypass-in-address-normalization-234ce721"},{"cvss":7.5,"slug":"nodemailer-quadratic-time-complexity-in-address-parser-f6132e7e","title":"Nodemailer quadratic time complexity in address parser","severity":"high","exploited":false,"published_at":"2026-09-08T21:33:17+00:00","url":"https://junglewise.ai/threats/nodemailer-quadratic-time-complexity-in-address-parser-f6132e7e"},{"cvss":6.5,"slug":"nodemailer-email-address-validation-bypass-in-rfc-5322-comment-parsing-c1300f22","title":"Nodemailer email address validation bypass in RFC 5322 comment parsing","severity":"medium","exploited":false,"published_at":"2026-09-08T21:32:51+00:00","url":"https://junglewise.ai/threats/nodemailer-email-address-validation-bypass-in-rfc-5322-comment-parsing-c1300f22"},{"cvss":5.9,"slug":"nodemailer-resolvecontent-sandbox-bypass-in-legacy-signature-09738384","title":"Nodemailer resolveContent sandbox bypass in legacy signature","severity":"medium","exploited":false,"published_at":"2026-09-08T21:16:00+00:00","url":"https://junglewise.ai/threats/nodemailer-resolvecontent-sandbox-bypass-in-legacy-signature-09738384"},{"cvss":7.1,"slug":"nodemailer-raw-message-option-bypasses-disablefileaccess-fb6da12e","title":"Nodemailer raw message option bypasses disableFileAccess/disableUrlAccess","severity":"high","exploited":false,"published_at":"2026-08-31T09:30:29+00:00","url":"https://junglewise.ai/threats/nodemailer-raw-message-option-bypasses-disablefileaccess-fb6da12e"},{"cvss":3.1,"slug":"nodemailer-message-level-raw-option-ssrf-and-file-read-af1f28b4","title":"Nodemailer message-level raw option SSRF and file read","severity":"low","exploited":false,"published_at":"2026-08-31T09:30:29+00:00","url":"https://junglewise.ai/threats/nodemailer-message-level-raw-option-ssrf-and-file-read-af1f28b4"},{"cve":"CVE-2026-82854","cvss":9.8,"epss":0.0198,"slug":"cve-2026-82854-nodemailer-smtp-command-injection-via-envelope-size-parameter","title":"Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.size parameter. When an application passes","severity":"critical","exploited":false,"published_at":"2026-08-31T09:17:05.463+00:00","url":"https://junglewise.ai/threats/cve-2026-82854-nodemailer-smtp-command-injection-via-envelope-size-parameter"},{"cve":"CVE-2026-82853","cvss":4.9,"epss":0.0103,"slug":"cve-2026-82853-nodemailer-smtp-command-injection-via-crlf-in-transport-name","title":"Nodemailer versions before 8.0.5 contain an SMTP command injection vulnerability in the transport name option used in EHLO/HELO commands. Th","severity":"medium","exploited":false,"published_at":"2026-08-31T09:17:05.32+00:00","url":"https://junglewise.ai/threats/cve-2026-82853-nodemailer-smtp-command-injection-via-crlf-in-transport-name"},{"cve":"CVE-2026-82662","cvss":6.5,"epss":0.0019,"slug":"cve-2026-82662-nodemailer-improper-tls-certificate-validation-in-oauth2-token","title":"Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false, allowing attackers to","severity":"medium","exploited":false,"published_at":"2026-08-31T09:17:04.093+00:00","url":"https://junglewise.ai/threats/cve-2026-82662-nodemailer-improper-tls-certificate-validation-in-oauth2-token"},{"cve":"CVE-2026-82661","cvss":5.4,"epss":0.0026,"slug":"cve-2026-82661-nodemailer-crlf-injection-in-list-header-comments","title":"Nodemailer before 8.0.9 fails to sanitize carriage return and line feed characters in list comment fields, allowing attackers to inject arbi","severity":"medium","exploited":false,"published_at":"2026-08-31T09:17:03.94+00:00","url":"https://junglewise.ai/threats/cve-2026-82661-nodemailer-crlf-injection-in-list-header-comments"},{"cve":"CVE-2026-82660","cvss":5.4,"epss":0.0026,"slug":"cve-2026-82660-nodemailer-jsontransport-security-control-bypass-in-content","title":"Nodemailer before 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during message normalization in jsonTransport. Attac","severity":"medium","exploited":false,"published_at":"2026-08-31T09:17:03.79+00:00","url":"https://junglewise.ai/threats/cve-2026-82660-nodemailer-jsontransport-security-control-bypass-in-content"},{"cve":"CVE-2026-82659","cvss":7.1,"epss":0.0035,"slug":"cve-2026-82659-nodemailer-message-level-raw-option-bypasses-access-controls","title":"nodemailer before 9.0.1 fails to apply disableFileAccess and disableUrlAccess flags to message-level raw option, allowing authenticated atta","severity":"high","exploited":false,"published_at":"2026-08-31T09:17:03.633+00:00","url":"https://junglewise.ai/threats/cve-2026-82659-nodemailer-message-level-raw-option-bypasses-access-controls"},{"cve":"CVE-2024-58379","cvss":5.3,"epss":0.003,"slug":"cve-2024-58379-nodemailer-redos-vulnerability-in-email-parsing","title":"nodemailer before 6.9.9 contains a regular expression denial of service vulnerability in email parsing when attachDataUrls parameter is set","severity":"medium","exploited":false,"published_at":"2026-08-31T09:16:59.387+00:00","url":"https://junglewise.ai/threats/cve-2024-58379-nodemailer-redos-vulnerability-in-email-parsing"},{"cvss":7.1,"slug":"nodemailer-sandbox-bypass-via-raw-message-option-f56f0be5","title":"Nodemailer sandbox bypass via raw message option","severity":"high","exploited":false,"published_at":"2026-06-18T14:28:05+00:00","url":"https://junglewise.ai/threats/nodemailer-sandbox-bypass-via-raw-message-option-f56f0be5"},{"cvss":5.4,"slug":"nodemailer-crlf-injection-in-list-header-comments-6a16ccf8","title":"Nodemailer CRLF injection in List-* header comments","severity":"medium","exploited":false,"published_at":"2026-06-15T17:36:06+00:00","url":"https://junglewise.ai/threats/nodemailer-crlf-injection-in-list-header-comments-6a16ccf8"},{"cvss":5.4,"slug":"nodemailer-access-control-bypass-in-jsontransport-e0c3e11e","title":"Nodemailer access control bypass in jsonTransport","severity":"medium","exploited":false,"published_at":"2026-06-15T17:35:10+00:00","url":"https://junglewise.ai/threats/nodemailer-access-control-bypass-in-jsontransport-e0c3e11e"},{"cvss":6.5,"slug":"nodemailer-improper-tls-certificate-validation-in-oauth2-fetch-c5558ca0","title":"Nodemailer improper TLS certificate validation in OAuth2 fetch","severity":"medium","exploited":false,"published_at":"2026-06-15T17:34:48+00:00","url":"https://junglewise.ai/threats/nodemailer-improper-tls-certificate-validation-in-oauth2-fetch-c5558ca0"}],"weekly":[{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":1,"exploited":0,"vulnerabilities":9},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":5},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":4},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":3},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0}],"related":[],"technology":{"hub":true,"name":"Nodemailer","slug":"nodemailer","vendor":{"name":"Nodemailer","slug":"nodemailer","url":"https://junglewise.ai/threats/vendors/nodemailer"},"aliases":[],"category":"library","url":"https://junglewise.ai/threats/technologies/nodemailer"},"most_severe":[{"cve":"CVE-2026-82854","cvss":9.8,"epss":0.0198,"slug":"cve-2026-82854-nodemailer-smtp-command-injection-via-envelope-size-parameter","title":"Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.size parameter. When an application passes","severity":"critical","exploited":false,"published_at":"2026-08-31T09:17:05.463+00:00","url":"https://junglewise.ai/threats/cve-2026-82854-nodemailer-smtp-command-injection-via-envelope-size-parameter"},{"cve":"CVE-2026-92596","cvss":7.5,"epss":0.0082,"slug":"cve-2026-92596-nodemailer-quadratic-time-complexity-in-address-parser-denial-of","title":"Nodemailer before 9.1.0 contains a quadratic time complexity vulnerability in the addressparser component that allows remote attackers to ca","severity":"high","exploited":false,"published_at":"2026-09-16T22:18:30.557+00:00","url":"https://junglewise.ai/threats/cve-2026-92596-nodemailer-quadratic-time-complexity-in-address-parser-denial-of"},{"cve":"CVE-2026-90776","cvss":7.5,"epss":0.0068,"slug":"cve-2026-90776-nodemailer-quadratic-time-complexity-in-address-parser","title":"Nodemailer quadratic time complexity in address parser","severity":"high","exploited":false,"published_at":"2026-09-13T12:17:16.547+00:00","url":"https://junglewise.ai/threats/cve-2026-90776-nodemailer-quadratic-time-complexity-in-address-parser"},{"cve":"CVE-2025-14874","cvss":7.5,"epss":0.0056,"slug":"cve-2025-14874-nodemailer-addressparser-denial-of-service-via-recursive-calls","title":"Nodemailer addressparser denial of service via recursive calls","severity":"high","exploited":false,"published_at":"2025-12-01T20:44:25+00:00","url":"https://junglewise.ai/threats/cve-2025-14874-nodemailer-addressparser-denial-of-service-via-recursive-calls"},{"cve":"CVE-2025-13033","cvss":7.5,"epss":0.0054,"slug":"cve-2025-13033-nodemailer-improper-email-parsing-in-addressparser","title":"Nodemailer improper email parsing in addressparser","severity":"high","exploited":false,"published_at":"2025-11-14T20:15:45.957+00:00","url":"https://junglewise.ai/threats/cve-2025-13033-nodemailer-improper-email-parsing-in-addressparser"},{"cve":"CVE-2026-100700","cvss":7.5,"slug":"cve-2026-100700-nodemailer-before-10-0-6-contains-a-denial-of-service","title":"nodemailer addressparser regular expression denial of service","severity":"high","exploited":false,"published_at":"2026-09-26T14:16:55.007+00:00","url":"https://junglewise.ai/threats/cve-2026-100700-nodemailer-before-10-0-6-contains-a-denial-of-service"},{"cvss":7.5,"slug":"nodemailer-quadratic-time-complexity-in-address-parser-f6132e7e","title":"Nodemailer quadratic time complexity in address parser","severity":"high","exploited":false,"published_at":"2026-09-08T21:33:17+00:00","url":"https://junglewise.ai/threats/nodemailer-quadratic-time-complexity-in-address-parser-f6132e7e"},{"cvss":7.5,"slug":"nodemailer-interpretation-conflict-in-email-address-parsing-f348ebe8","title":"Nodemailer interpretation conflict in email address parsing","severity":"high","exploited":false,"published_at":"2025-11-14T21:30:29+00:00","url":"https://junglewise.ai/threats/nodemailer-interpretation-conflict-in-email-address-parsing-f348ebe8"},{"cve":"CVE-2026-82659","cvss":7.1,"epss":0.0035,"slug":"cve-2026-82659-nodemailer-message-level-raw-option-bypasses-access-controls","title":"nodemailer before 9.0.1 fails to apply disableFileAccess and disableUrlAccess flags to message-level raw option, allowing authenticated atta","severity":"high","exploited":false,"published_at":"2026-08-31T09:17:03.633+00:00","url":"https://junglewise.ai/threats/cve-2026-82659-nodemailer-message-level-raw-option-bypasses-access-controls"},{"cvss":7.1,"slug":"nodemailer-raw-message-option-bypasses-disablefileaccess-fb6da12e","title":"Nodemailer raw message option bypasses disableFileAccess/disableUrlAccess","severity":"high","exploited":false,"published_at":"2026-08-31T09:30:29+00:00","url":"https://junglewise.ai/threats/nodemailer-raw-message-option-bypasses-disablefileaccess-fb6da12e"}],"generated_at":"2026-09-28T03:07:00.154823+00:00"}