npm

nodemailer

18 Total advisories

18 Vulnerabilities

0 Malware

Dependency scanning

Check whether nodemailer is in your codebase

Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.

nodemailer

Vulnerabilities

Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address list

Nodemailer: Recipient-domain validation bypass via RFC 5322 comment mis-parsing leads to email delivery to an attacker-controlled domain

Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disableUrlAccess when called with the legacy signature

Nodemailer: IDN/Punycode domain allow-list bypass leads to email delivery to an attacker-controlled domain

Duplicate Advisory: Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered message

Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered message

Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message header injection

Nodemailer Vulnerable to SMTP Command Injection via CRLF in Transport name Option (EHLO/HELO)

Nodemailer’s addressparser is vulnerable to DoS caused by recursive calls

Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess during message normalization

Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interception

Nodemailer has SMTP command injection due to unsanitized `envelope.size` parameter

Duplicate Advisory: Nodemailer is vulnerable to DoS through Uncontrolled Recursion

Nodemailer: Email to an unintended domain can occur due to Interpretation Conflict

nodemailer ReDoS when trying to send a specially crafted email

Duplicate Advisory: Nodemailer: Email to an unintended domain can occur due to Interpretation Conflict

Header injection in nodemailer

Command injection in nodemailer

Browse more npm advisories

Start Securing