npm

nodemailer

33 Total advisories

33 Vulnerabilities

0 Malware

Dependency scanning

Check whether nodemailer is in your codebase

Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.

nodemailer

Vulnerabilities

Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient

Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name

Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient

Nodemailer: Quadratic (O(n^2)) SMTP client reply parsing lets a malicious server or MITM cause a pre-auth remote denial of service

Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service

Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped

Duplicate Advisory: Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signing

Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signing

Nodemailer addressparser: O(n^2) on comment-joined addresses enables a remote DoS (reachable via mailparser)

Duplicate Advisory: Nodemailer addressparser: O(n^2) on comment-joined addresses enables a remote DoS (reachable via mailparser)

Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interception

Duplicate Advisory: Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interception

Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing

Nodemailer: Quadratic backtracking in the addressparser free-text fallback allows remote denial of service

Nodemailer: Nested structured recipient arrays bypass the parser depth limit and cause stack exhaustion DoS

Nodemailer: Process-global DNS cache reuses TLS `servername` across transports, enabling cross-tenant SMTP credential disclosure

Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address list

Nodemailer: Recipient-domain validation bypass via RFC 5322 comment mis-parsing leads to email delivery to an attacker-controlled domain

Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disableUrlAccess when called with the legacy signature

Nodemailer: IDN/Punycode domain allow-list bypass leads to email delivery to an attacker-controlled domain

Duplicate Advisory: Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered message

Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered message

Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message header injection

Nodemailer Vulnerable to SMTP Command Injection via CRLF in Transport name Option (EHLO/HELO)

Nodemailer’s addressparser is vulnerable to DoS caused by recursive calls

Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess during message normalization

Nodemailer has SMTP command injection due to unsanitized `envelope.size` parameter

Duplicate Advisory: Nodemailer is vulnerable to DoS through Uncontrolled Recursion

Nodemailer: Email to an unintended domain can occur due to Interpretation Conflict

nodemailer ReDoS when trying to send a specially crafted email

Duplicate Advisory: Nodemailer: Email to an unintended domain can occur due to Interpretation Conflict

Header injection in nodemailer

Command injection in nodemailer

Browse more npm advisories

Start Securing