{ "@id": "urn:uuid:d4bf44c1-79cc-41ef-935d-8e6f539397fe", "role": "Document Creator", "author": "https://tuxcare.com", "version": 23, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-13T23:53:00.038549+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.10", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.10" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2020-7769 affects version 10.0.10 of nodemailer.", "vulnerability": { "name": "CVE-2020-7769" }, "action_statement": "Vulnerability CVE-2020-7769 affects version 10.0.10 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.10", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.10" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2021-23400 affects version 10.0.10 of nodemailer.", "vulnerability": { "name": "CVE-2021-23400" }, "action_statement": "Vulnerability CVE-2021-23400 affects version 10.0.10 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.10", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.10" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2025-13033 affects version 10.0.10 of nodemailer.", "vulnerability": { "name": "CVE-2025-13033" }, "action_statement": "Vulnerability CVE-2025-13033 affects version 10.0.10 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.10", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.10" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2025-14874 affects version 10.0.10 of nodemailer.", "vulnerability": { "name": "CVE-2025-14874" }, "action_statement": "Vulnerability CVE-2025-14874 affects version 10.0.10 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.10", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.10" } } ], "timestamp": "2026-10-15T15:49:00.133726+00:00", "status_notes": "Vulnerability CVE-2026-110869 affects version 10.0.10 of nodemailer.", "vulnerability": { "name": "CVE-2026-110869" }, "action_statement": "Vulnerability CVE-2026-110869 affects version 10.0.10 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.10", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.10" } } ], "timestamp": "2026-10-26T15:35:33.946658+00:00", "status_notes": "Vulnerability CVE-2026-110870 affects version 10.0.10 of nodemailer.", "vulnerability": { "name": "CVE-2026-110870" }, "action_statement": "Vulnerability CVE-2026-110870 affects version 10.0.10 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.10", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.10" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2026-110871 affects version 10.0.10 of nodemailer.", "vulnerability": { "name": "CVE-2026-110871" }, "action_statement": "Vulnerability CVE-2026-110871 affects version 10.0.10 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.10", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.10" } } ], "timestamp": "2026-11-03T14:36:48.497569+00:00", "status_notes": "Vulnerability CVE-2026-121424 affects version 10.0.10 of nodemailer.", "vulnerability": { "name": "CVE-2026-121424" }, "action_statement": "Vulnerability CVE-2026-121424 affects version 10.0.10 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.10", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.10" } } ], "timestamp": "2026-11-03T14:36:48.497569+00:00", "status_notes": "Vulnerability CVE-2026-121425 affects version 10.0.10 of nodemailer.", "vulnerability": { "name": "CVE-2026-121425" }, "action_statement": "Vulnerability CVE-2026-121425 affects version 10.0.10 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.10", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.10" } } ], "timestamp": "2026-11-03T14:36:48.497569+00:00", "status_notes": "Vulnerability CVE-2026-121426 affects version 10.0.10 of nodemailer.", "vulnerability": { "name": "CVE-2026-121426" }, "action_statement": "Vulnerability CVE-2026-121426 affects version 10.0.10 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.10", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.10" } } ], "timestamp": "2026-11-10T15:30:00.075367+00:00", "status_notes": "Vulnerability CVE-2026-125755 affects version 10.0.10 of nodemailer.", "vulnerability": { "name": "CVE-2026-125755" }, "action_statement": "Vulnerability CVE-2026-125755 affects version 10.0.10 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.10", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.10" } } ], "timestamp": "2026-11-13T22:31:00.045181+00:00", "status_notes": "Vulnerability CVE-2026-82659 does not affect version 10.0.10 of nodemailer. not_affected \u2014 Target nodemailer 10.0.10 already contains the upstream fix. MailComposer.compile() builds the raw root MimeNode with disableUrlAccess and disableFileAccess (src/mail-composer/index.ts:210-215). The fix came from upstream commit a82e060d (Andris Reinman), which is in the upstream release; HEAD has no TuxCare-domain commits. So the verdict is not_affected (upstream fix), not already_fixed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-82659" }, "impact_statement": "not_affected \u2014 Target nodemailer 10.0.10 already contains the upstream fix. MailComposer.compile() builds the raw root MimeNode with disableUrlAccess and disableFileAccess (src/mail-composer/index.ts:210-215). The fix came from upstream commit a82e060d (Andris Reinman), which is in the upstream release; HEAD has no TuxCare-domain commits. So the verdict is not_affected (upstream fix), not already_fixed." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.10", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.10" } } ], "timestamp": "2026-11-13T23:12:50.176480+00:00", "status_notes": "Vulnerability CVE-2026-82662 does not affect version 10.0.10 of nodemailer. not_affected \u2014 Nodemailer 10.0.10 already contains the upstream fix. src/fetch/index.ts sets rejectUnauthorized: true by default, and the OAuth2 token request and Ethereal request pin strict TLS. The fix, upstream commit 833d6e5 plus 6a947ac, is in the upstream release. No code in the target disables certificate verification.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-82662" }, "impact_statement": "not_affected \u2014 Nodemailer 10.0.10 already contains the upstream fix. src/fetch/index.ts sets rejectUnauthorized: true by default, and the OAuth2 token request and Ethereal request pin strict TLS. The fix, upstream commit 833d6e5 plus 6a947ac, is in the upstream release. No code in the target disables certificate verification." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.10", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.10" } } ], "timestamp": "2026-11-13T23:28:00.053366+00:00", "status_notes": "Vulnerability CVE-2026-82854 does not affect version 10.0.10 of nodemailer. not_affected \u2014 Nodemailer 10.0.10 is not affected by CVE-2026-82854. The upstream fix, commit 2d7b971 by Andris Reinman, is an ancestor of HEAD and is part of the upstream release. In src/smtp-connection/index.ts, the envelope size is coerced with Number() and only appended as SIZE= when the result is greater than 0. A string containing CRLF becomes NaN, so it is dropped and nothing can be injected in...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-82854" }, "impact_statement": "not_affected \u2014 Nodemailer 10.0.10 is not affected by CVE-2026-82854. The upstream fix, commit 2d7b971 by Andris Reinman, is an ancestor of HEAD and is part of the upstream release. In src/smtp-connection/index.ts, the envelope size is coerced with Number() and only appended as SIZE= when the result is greater than 0. A string containing CRLF becomes NaN, so it is dropped and nothing can be injected in..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.10", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.10" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2026-90776 affects version 10.0.10 of nodemailer.", "vulnerability": { "name": "CVE-2026-90776" }, "action_statement": "Vulnerability CVE-2026-90776 affects version 10.0.10 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.10", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.10" } } ], "timestamp": "2026-11-13T22:18:00.036497+00:00", "status_notes": "Vulnerability GHSA-268h-hp4c-crq3 does not affect version 10.0.10 of nodemailer. not_affected \u2014 nodemailer 10.0.10 already contains the upstream fix for GHSA-268h-hp4c-crq3. In src/mailer/mail-message.ts, _getListHeaders replaces CR/LF in list.*.comment with a space before the prepared List-* header value is built. The fix is upstream commit 5f69497 (author andris@reinman.eu), which is part of the upstream release that TuxCare onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-268h-hp4c-crq3" }, "impact_statement": "not_affected \u2014 nodemailer 10.0.10 already contains the upstream fix for GHSA-268h-hp4c-crq3. In src/mailer/mail-message.ts, _getListHeaders replaces CR/LF in list.*.comment with a space before the prepared List-* header value is built. The fix is upstream commit 5f69497 (author andris@reinman.eu), which is part of the upstream release that TuxCare onboarded." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.10", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.10" } } ], "timestamp": "2026-11-13T22:42:00.042020+00:00", "status_notes": "Vulnerability GHSA-2x7j-588g-ccc2 does not affect version 10.0.10 of nodemailer. not_affected \u2014 Target nodemailer 10.0.10 already contains the upstream fixes for all three quadratic paths: in-place accumulation and a linear display-name merge in addressparser, Set-based recipient dedupe in MimeNode._convertAddresses, and a default maxRecipients cap. The fixes were authored upstream (andris@reinman.eu) and shipped in the upstream release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-2x7j-588g-ccc2" }, "impact_statement": "not_affected \u2014 Target nodemailer 10.0.10 already contains the upstream fixes for all three quadratic paths: in-place accumulation and a linear display-name merge in addressparser, Set-based recipient dedupe in MimeNode._convertAddresses, and a default maxRecipients cap. The fixes were authored upstream (andris@reinman.eu) and shipped in the upstream release." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.10", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.10" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-46j5-6fg5-4gv3 is a false positive for nodemailer 10.0.10.", "vulnerability": { "name": "GHSA-46j5-6fg5-4gv3" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.10", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.10" } } ], "timestamp": "2026-10-27T15:13:32.414812+00:00", "status_notes": "Vulnerability GHSA-4ffr-jq9g-5ffx affects version 10.0.10 of nodemailer.", "vulnerability": { "name": "GHSA-4ffr-jq9g-5ffx" }, "action_statement": "Vulnerability GHSA-4ffr-jq9g-5ffx affects version 10.0.10 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.10", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.10" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-4g23-2xm8-66gc affects version 10.0.10 of nodemailer.", "vulnerability": { "name": "GHSA-4g23-2xm8-66gc" }, "action_statement": "Vulnerability GHSA-4g23-2xm8-66gc affects version 10.0.10 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.10", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.10" } } ], "timestamp": "2026-11-13T23:48:43.538332+00:00", "status_notes": "Vulnerability GHSA-6vj9-mwq6-2f5v does not affect version 10.0.10 of nodemailer. not_affected \u2014 Target nodemailer 10.0.10 already contains the upstream fix (a6512db, \"keep the TLS server name out of the DNS cache\"). The DNS cache now stores only addresses, and servername is derived from the current caller's options on every return path. The fix is an upstream release commit; HEAD has no TuxCare-domain commit. The only non-upstream commit is a build-config commit by an ELS automation bot.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6vj9-mwq6-2f5v" }, "impact_statement": "not_affected \u2014 Target nodemailer 10.0.10 already contains the upstream fix (a6512db, \"keep the TLS server name out of the DNS cache\"). The DNS cache now stores only addresses, and servername is derived from the current caller's options on every return path. The fix is an upstream release commit; HEAD has no TuxCare-domain commit. The only non-upstream commit is a build-config commit by an ELS automation bot." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.10", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.10" } } ], "timestamp": "2026-10-23T22:01:00.144162+00:00", "status_notes": "Vulnerability GHSA-85x2-q946-cp5h affects version 10.0.10 of nodemailer.", "vulnerability": { "name": "GHSA-85x2-q946-cp5h" }, "action_statement": "Vulnerability GHSA-85x2-q946-cp5h affects version 10.0.10 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.10", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.10" } } ], "timestamp": "2026-10-23T22:01:00.144162+00:00", "status_notes": "Vulnerability GHSA-8c8m-p3m8-cjg8 affects version 10.0.10 of nodemailer.", "vulnerability": { "name": "GHSA-8c8m-p3m8-cjg8" }, "action_statement": "Vulnerability GHSA-8c8m-p3m8-cjg8 affects version 10.0.10 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.10", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.10" } } ], "timestamp": "2026-11-13T22:32:00.034202+00:00", "status_notes": "Vulnerability GHSA-8m3c-c648-2xjj does not affect version 10.0.10 of nodemailer. not_affected \u2014 Nodemailer 10.0.10 is not affected. MailMessage.resolveContent in src/mailer/mail-message.ts (lines 143-172) already normalizes the legacy (data, key, callback) signature and merges the message-level disableFileAccess/disableUrlAccess flags (this.data.*) into the policy passed to shared.resolveContent. Explicit options can only tighten the policy. The fix is upstream-authored (commit f7cbf83, a...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-8m3c-c648-2xjj" }, "impact_statement": "not_affected \u2014 Nodemailer 10.0.10 is not affected. MailMessage.resolveContent in src/mailer/mail-message.ts (lines 143-172) already normalizes the legacy (data, key, callback) signature and merges the message-level disableFileAccess/disableUrlAccess flags (this.data.*) into the policy passed to shared.resolveContent. Explicit options can only tighten the policy. The fix is upstream-authored (commit f7cbf83, a..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.10", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.10" } } ], "timestamp": "2026-11-13T23:53:00.038549+00:00", "status_notes": "Vulnerability GHSA-8vvx-rff5-p5rq does not affect version 10.0.10 of nodemailer. not_affected \u2014 Target nodemailer 10.0.10 already contains the upstream fix (ebe0849, \"flatten nested recipient arrays without recursion\"). MimeNode._parseAddresses now flattens nested arrays with an explicit stack and a WeakSet, so arrays never reach addressparser's Tokenizer .toString(). The fix was shipped in the upstream release and is authored by upstream (andris@reinman.eu), not TuxCare.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-8vvx-rff5-p5rq" }, "impact_statement": "not_affected \u2014 Target nodemailer 10.0.10 already contains the upstream fix (ebe0849, \"flatten nested recipient arrays without recursion\"). MimeNode._parseAddresses now flattens nested arrays with an explicit stack and a WeakSet, so arrays never reach addressparser's Tokenizer .toString(). The fix was shipped in the upstream release and is authored by upstream (andris@reinman.eu), not TuxCare." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.10", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.10" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-9h6g-pr28-7cqp affects version 10.0.10 of nodemailer.", "vulnerability": { "name": "GHSA-9h6g-pr28-7cqp" }, "action_statement": "Vulnerability GHSA-9h6g-pr28-7cqp affects version 10.0.10 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.10", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.10" } } ], "timestamp": "2026-11-13T22:08:24.214185+00:00", "status_notes": "Vulnerability GHSA-c7w3-x93f-qmm8 does not affect version 10.0.10 of nodemailer. not_affected \u2014 Nodemailer 10.0.10 already contains the upstream fix for GHSA-c7w3-x93f-qmm8. In src/smtp-connection/index.ts the envelope.size value is coerced with Number() and only appended as SIZE= if it is greater than 0. A CRLF-bearing string becomes NaN, then 0, and is dropped, so it never reaches the MAIL FROM command. The fix is upstream commit 2d7b9710 by andris@reinman.eu. It is an ancestor ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-c7w3-x93f-qmm8" }, "impact_statement": "not_affected \u2014 Nodemailer 10.0.10 already contains the upstream fix for GHSA-c7w3-x93f-qmm8. In src/smtp-connection/index.ts the envelope.size value is coerced with Number() and only appended as SIZE= if it is greater than 0. A CRLF-bearing string becomes NaN, then 0, and is dropped, so it never reaches the MAIL FROM command. The fix is upstream commit 2d7b9710 by andris@reinman.eu. It is an ancestor ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.10", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.10" } } ], "timestamp": "2026-11-13T22:57:00.061178+00:00", "status_notes": "Vulnerability GHSA-cc9r-2j5m-2m83 does not affect version 10.0.10 of nodemailer. not_affected \u2014 Target nodemailer 10.0.10 already contains the upstream fix for GHSA-cc9r-2j5m-2m83 (upstream commit 902b63e, \"terminate the domain at an RFC 5322 comment\", by andris@reinman.eu). src/addressparser/index.ts no longer concatenates tokens across a comment-closing ')' unless one side carries the '@'. The fix shipped in the upstream release, so it is not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-cc9r-2j5m-2m83" }, "impact_statement": "not_affected \u2014 Target nodemailer 10.0.10 already contains the upstream fix for GHSA-cc9r-2j5m-2m83 (upstream commit 902b63e, \"terminate the domain at an RFC 5322 comment\", by andris@reinman.eu). src/addressparser/index.ts no longer concatenates tokens across a comment-closing ')' unless one side carries the '@'. The fix shipped in the upstream release, so it is not a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.10", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.10" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-frj6-5rhh-vwfw is a false positive for nodemailer 10.0.10.", "vulnerability": { "name": "GHSA-frj6-5rhh-vwfw" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.10", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.10" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-g57g-f23g-4646 affects version 10.0.10 of nodemailer.", "vulnerability": { "name": "GHSA-g57g-f23g-4646" }, "action_statement": "Vulnerability GHSA-g57g-f23g-4646 affects version 10.0.10 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.10", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.10" } } ], "timestamp": "2026-10-27T15:13:36.008785+00:00", "status_notes": "Vulnerability GHSA-g73g-hqqh-jr95 affects version 10.0.10 of nodemailer.", "vulnerability": { "name": "GHSA-g73g-hqqh-jr95" }, "action_statement": "Vulnerability GHSA-g73g-hqqh-jr95 affects version 10.0.10 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.10", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.10" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-h3hj-cmcx-xc66 is a false positive for nodemailer 10.0.10.", "vulnerability": { "name": "GHSA-h3hj-cmcx-xc66" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.10", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.10" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-jj37-3377-m6vv is a false positive for nodemailer 10.0.10.", "vulnerability": { "name": "GHSA-jj37-3377-m6vv" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.10", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.10" } } ], "timestamp": "2026-10-23T22:01:49.029239+00:00", "status_notes": "Vulnerability GHSA-m943-m63m-w62w affects version 10.0.10 of nodemailer.", "vulnerability": { "name": "GHSA-m943-m63m-w62w" }, "action_statement": "Vulnerability GHSA-m943-m63m-w62w affects version 10.0.10 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.10", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.10" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-v53p-9fqp-m79j affects version 10.0.10 of nodemailer.", "vulnerability": { "name": "GHSA-v53p-9fqp-m79j" }, "action_statement": "Vulnerability GHSA-v53p-9fqp-m79j affects version 10.0.10 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.10", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.10" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-vm5r-23w9-m8hx is a false positive for nodemailer 10.0.10.", "vulnerability": { "name": "GHSA-vm5r-23w9-m8hx" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.10", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.10" } } ], "timestamp": "2026-11-13T22:09:53.923267+00:00", "status_notes": "Vulnerability GHSA-vvjj-xcjg-gr5g does not affect version 10.0.10 of nodemailer. not_affected \u2014 Target nodemailer 10.0.10 (TypeScript layout, src/smtp-connection/index.ts) already strips CR/LF from the transport `name` option before it is used in LHLO/EHLO/HELO. The fix shipped in the upstream release, in commit f7cbf83 by andris@reinman.eu. HEAD has no TuxCare-allowlisted commit, so this is an upstream fix and not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-vvjj-xcjg-gr5g" }, "impact_statement": "not_affected \u2014 Target nodemailer 10.0.10 (TypeScript layout, src/smtp-connection/index.ts) already strips CR/LF from the transport `name` option before it is used in LHLO/EHLO/HELO. The fix shipped in the upstream release, in commit f7cbf83 by andris@reinman.eu. HEAD has no TuxCare-allowlisted commit, so this is an upstream fix and not a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.10", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.10" } } ], "timestamp": "2026-11-13T23:05:15.656839+00:00", "status_notes": "Vulnerability GHSA-wmmp-3585-3rmp does not affect version 10.0.10 of nodemailer. not_affected \u2014 Nodemailer 10.0.10 already contains the upstream fix for GHSA-wmmp-3585-3rmp. _normalizeAddress now encodes the recipient domain through normalizeDomain(), which uses url.domainToASCII (UTS-46) and keeps '/', '\\\\', '?', '#', '%' and control characters away from that mapper. The upstream author introduced it, and it was already in the upstream release TuxCare onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wmmp-3585-3rmp" }, "impact_statement": "not_affected \u2014 Nodemailer 10.0.10 already contains the upstream fix for GHSA-wmmp-3585-3rmp. _normalizeAddress now encodes the recipient domain through normalizeDomain(), which uses url.domainToASCII (UTS-46) and keeps '/', '\\\\', '?', '#', '%' and control characters away from that mapper. The upstream author introduced it, and it was already in the upstream release TuxCare onboarded." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.10", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.10" } } ], "timestamp": "2026-11-13T22:14:17.313956+00:00", "status_notes": "Vulnerability GHSA-wqvq-jvpq-h66f does not affect version 10.0.10 of nodemailer. not_affected \u2014 nodemailer 10.0.10 already enforces disableFileAccess/disableUrlAccess inside shared.resolveContent() and passes the policy from both jsonTransport normalization (resolveAll) and the attachDataUrls path (_convertDataImages). The fix was authored upstream (andris@reinman.eu, commit f7cbf83, TypeScript migration) and is in the upstream release that TuxCare onboarded, so the target does not carry ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wqvq-jvpq-h66f" }, "impact_statement": "not_affected \u2014 nodemailer 10.0.10 already enforces disableFileAccess/disableUrlAccess inside shared.resolveContent() and passes the policy from both jsonTransport normalization (resolveAll) and the attachDataUrls path (_convertDataImages). The fix was authored upstream (andris@reinman.eu, commit f7cbf83, TypeScript migration) and is in the upstream release that TuxCare onboarded, so the target does not carry ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.10", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.10" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-wxxx-r42m-9rp8 is a false positive for nodemailer 10.0.10.", "vulnerability": { "name": "GHSA-wxxx-r42m-9rp8" }, "impact_statement": "The vulnerability has been withdrawn." } ] }