{ "@id": "urn:uuid:a73228b6-d38e-4d16-8c6c-9ff83ad0ce9e", "role": "Document Creator", "author": "https://tuxcare.com", "version": 22, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-13T23:55:21.033446+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.11", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.11" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2020-7769 affects version 10.0.11 of nodemailer.", "vulnerability": { "name": "CVE-2020-7769" }, "action_statement": "Vulnerability CVE-2020-7769 affects version 10.0.11 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.11", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.11" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2021-23400 affects version 10.0.11 of nodemailer.", "vulnerability": { "name": "CVE-2021-23400" }, "action_statement": "Vulnerability CVE-2021-23400 affects version 10.0.11 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.11", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.11" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2025-13033 affects version 10.0.11 of nodemailer.", "vulnerability": { "name": "CVE-2025-13033" }, "action_statement": "Vulnerability CVE-2025-13033 affects version 10.0.11 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.11", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.11" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2025-14874 affects version 10.0.11 of nodemailer.", "vulnerability": { "name": "CVE-2025-14874" }, "action_statement": "Vulnerability CVE-2025-14874 affects version 10.0.11 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.11", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.11" } } ], "timestamp": "2026-10-15T15:49:00.133726+00:00", "status_notes": "Vulnerability CVE-2026-110869 affects version 10.0.11 of nodemailer.", "vulnerability": { "name": "CVE-2026-110869" }, "action_statement": "Vulnerability CVE-2026-110869 affects version 10.0.11 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.11", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.11" } } ], "timestamp": "2026-10-26T15:35:33.946658+00:00", "status_notes": "Vulnerability CVE-2026-110870 affects version 10.0.11 of nodemailer.", "vulnerability": { "name": "CVE-2026-110870" }, "action_statement": "Vulnerability CVE-2026-110870 affects version 10.0.11 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.11", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.11" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2026-110871 affects version 10.0.11 of nodemailer.", "vulnerability": { "name": "CVE-2026-110871" }, "action_statement": "Vulnerability CVE-2026-110871 affects version 10.0.11 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.11", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.11" } } ], "timestamp": "2026-11-03T14:36:48.497569+00:00", "status_notes": "Vulnerability CVE-2026-121424 affects version 10.0.11 of nodemailer.", "vulnerability": { "name": "CVE-2026-121424" }, "action_statement": "Vulnerability CVE-2026-121424 affects version 10.0.11 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.11", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.11" } } ], "timestamp": "2026-11-03T14:36:48.497569+00:00", "status_notes": "Vulnerability CVE-2026-121425 affects version 10.0.11 of nodemailer.", "vulnerability": { "name": "CVE-2026-121425" }, "action_statement": "Vulnerability CVE-2026-121425 affects version 10.0.11 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.11", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.11" } } ], "timestamp": "2026-11-03T14:36:48.497569+00:00", "status_notes": "Vulnerability CVE-2026-121426 affects version 10.0.11 of nodemailer.", "vulnerability": { "name": "CVE-2026-121426" }, "action_statement": "Vulnerability CVE-2026-121426 affects version 10.0.11 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.11", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.11" } } ], "timestamp": "2026-11-10T15:30:00.075367+00:00", "status_notes": "Vulnerability CVE-2026-125755 affects version 10.0.11 of nodemailer.", "vulnerability": { "name": "CVE-2026-125755" }, "action_statement": "Vulnerability CVE-2026-125755 affects version 10.0.11 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.11", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.11" } } ], "timestamp": "2026-11-13T22:31:00.045181+00:00", "status_notes": "Vulnerability CVE-2026-82659 does not affect version 10.0.11 of nodemailer. not_affected \u2014 Not affected. The upstream fix for CVE-2026-82659 (a82e060, \"enforce disableFileAccess/disableUrlAccess for raw message option\") is already in the shipped 10.0.11 release. MailComposer.compile() passes both flags to the raw root MimeNode, and _getStream rejects {path} and {href} content when either flag is set. The fix is upstream-authored, so the verdict is not_affected rather than already_fixed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-82659" }, "impact_statement": "not_affected \u2014 Not affected. The upstream fix for CVE-2026-82659 (a82e060, \"enforce disableFileAccess/disableUrlAccess for raw message option\") is already in the shipped 10.0.11 release. MailComposer.compile() passes both flags to the raw root MimeNode, and _getStream rejects {path} and {href} content when either flag is set. The fix is upstream-authored, so the verdict is not_affected rather than already_fixed." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.11", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.11" } } ], "timestamp": "2026-11-13T23:13:21.676667+00:00", "status_notes": "Vulnerability CVE-2026-82662 does not affect version 10.0.11 of nodemailer. not_affected \u2014 Target nodemailer 10.0.11 validates TLS certificates by default in its internal fetch client and in the OAuth2 token request. The upstream fix, commit 6a947ac (Andris Reinman, in the 9.0.0 release), is already in HEAD. HEAD's history has no TuxCare commits, so this is an upstream fix and the verdict is not_affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-82662" }, "impact_statement": "not_affected \u2014 Target nodemailer 10.0.11 validates TLS certificates by default in its internal fetch client and in the OAuth2 token request. The upstream fix, commit 6a947ac (Andris Reinman, in the 9.0.0 release), is already in HEAD. HEAD's history has no TuxCare commits, so this is an upstream fix and the verdict is not_affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.11", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.11" } } ], "timestamp": "2026-11-13T23:27:15.823474+00:00", "status_notes": "Vulnerability CVE-2026-82854 does not affect version 10.0.11 of nodemailer. not_affected \u2014 Not affected. The upstream fix (commit 2d7b9710, \"sanitize envelope size to prevent SMTP command injection\") is already an ancestor of HEAD (10.0.11). The SIZE parameter is coerced with Number() and appended only if the result is positive, so CRLF can no longer reach the MAIL FROM line.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-82854" }, "impact_statement": "not_affected \u2014 Not affected. The upstream fix (commit 2d7b9710, \"sanitize envelope size to prevent SMTP command injection\") is already an ancestor of HEAD (10.0.11). The SIZE parameter is coerced with Number() and appended only if the result is positive, so CRLF can no longer reach the MAIL FROM line." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.11", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.11" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2026-90776 affects version 10.0.11 of nodemailer.", "vulnerability": { "name": "CVE-2026-90776" }, "action_statement": "Vulnerability CVE-2026-90776 affects version 10.0.11 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.11", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.11" } } ], "timestamp": "2026-11-13T22:17:00.046957+00:00", "status_notes": "Vulnerability GHSA-268h-hp4c-crq3 does not affect version 10.0.11 of nodemailer. not_affected \u2014 Not affected. Target nodemailer 10.0.11 already strips CR/LF from list.*.comment before building the prepared List-* header values. The upstream fix commit 5f69497 (author andris@reinman.eu) is an ancestor of HEAD and shipped in the upstream release, so the CRLF header-injection pattern is absent.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-268h-hp4c-crq3" }, "impact_statement": "not_affected \u2014 Not affected. Target nodemailer 10.0.11 already strips CR/LF from list.*.comment before building the prepared List-* header values. The upstream fix commit 5f69497 (author andris@reinman.eu) is an ancestor of HEAD and shipped in the upstream release, so the CRLF header-injection pattern is absent." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.11", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.11" } } ], "timestamp": "2026-11-13T22:42:00.042020+00:00", "status_notes": "Vulnerability GHSA-2x7j-588g-ccc2 does not affect version 10.0.11 of nodemailer. not_affected \u2014 Target (nodemailer 10.0.11, TypeScript sources under src/) already contains all upstream fixes for GHSA-2x7j-588g-ccc2: linear address accumulation, a linear display-name merge, Set-based recipient dedupe, iterative flattening, and the maxRecipients cap. These shipped in the upstream release, so the target is not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-2x7j-588g-ccc2" }, "impact_statement": "not_affected \u2014 Target (nodemailer 10.0.11, TypeScript sources under src/) already contains all upstream fixes for GHSA-2x7j-588g-ccc2: linear address accumulation, a linear display-name merge, Set-based recipient dedupe, iterative flattening, and the maxRecipients cap. These shipped in the upstream release, so the target is not affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.11", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.11" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-46j5-6fg5-4gv3 is a false positive for nodemailer 10.0.11.", "vulnerability": { "name": "GHSA-46j5-6fg5-4gv3" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.11", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.11" } } ], "timestamp": "2026-10-27T15:13:32.414812+00:00", "status_notes": "Vulnerability GHSA-4ffr-jq9g-5ffx affects version 10.0.11 of nodemailer.", "vulnerability": { "name": "GHSA-4ffr-jq9g-5ffx" }, "action_statement": "Vulnerability GHSA-4ffr-jq9g-5ffx affects version 10.0.11 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.11", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.11" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-4g23-2xm8-66gc affects version 10.0.11 of nodemailer.", "vulnerability": { "name": "GHSA-4g23-2xm8-66gc" }, "action_statement": "Vulnerability GHSA-4g23-2xm8-66gc affects version 10.0.11 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.11", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.11" } } ], "timestamp": "2026-11-13T23:50:50.921752+00:00", "status_notes": "Vulnerability GHSA-6vj9-mwq6-2f5v does not affect version 10.0.11 of nodemailer. not_affected \u2014 Target 10.0.11 already contains the upstream fix a6512db (\"fix(shared): keep the TLS server name out of the DNS cache\"). The DNS cache now stores addresses only. The servername is computed per call from the current options, so a second transport's explicit tls.servername is no longer replaced by a cached one. The fix is an upstream commit (author andris@reinman.eu) shipped in the upstream relea...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6vj9-mwq6-2f5v" }, "impact_statement": "not_affected \u2014 Target 10.0.11 already contains the upstream fix a6512db (\"fix(shared): keep the TLS server name out of the DNS cache\"). The DNS cache now stores addresses only. The servername is computed per call from the current options, so a second transport's explicit tls.servername is no longer replaced by a cached one. The fix is an upstream commit (author andris@reinman.eu) shipped in the upstream relea..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.11", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.11" } } ], "timestamp": "2026-10-23T22:01:00.144162+00:00", "status_notes": "Vulnerability GHSA-85x2-q946-cp5h affects version 10.0.11 of nodemailer.", "vulnerability": { "name": "GHSA-85x2-q946-cp5h" }, "action_statement": "Vulnerability GHSA-85x2-q946-cp5h affects version 10.0.11 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.11", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.11" } } ], "timestamp": "2026-10-23T22:01:00.144162+00:00", "status_notes": "Vulnerability GHSA-8c8m-p3m8-cjg8 affects version 10.0.11 of nodemailer.", "vulnerability": { "name": "GHSA-8c8m-p3m8-cjg8" }, "action_statement": "Vulnerability GHSA-8c8m-p3m8-cjg8 affects version 10.0.11 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.11", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.11" } } ], "timestamp": "2026-11-13T22:32:00.034202+00:00", "status_notes": "Vulnerability GHSA-8m3c-c648-2xjj does not affect version 10.0.11 of nodemailer. not_affected \u2014 Not affected. The target (nodemailer 10.0.11) already contains the upstream fix. MailMessage.resolveContent in src/mailer/mail-message.ts now builds an access policy from the message's own disableFileAccess/disableUrlAccess flags and passes it to shared.resolveContent, so the legacy (data, key, callback) signature no longer drops the sandbox. The fix is upstream commit dc48ed3 (\"apply the messa...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-8m3c-c648-2xjj" }, "impact_statement": "not_affected \u2014 Not affected. The target (nodemailer 10.0.11) already contains the upstream fix. MailMessage.resolveContent in src/mailer/mail-message.ts now builds an access policy from the message's own disableFileAccess/disableUrlAccess flags and passes it to shared.resolveContent, so the legacy (data, key, callback) signature no longer drops the sandbox. The fix is upstream commit dc48ed3 (\"apply the messa..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.11", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.11" } } ], "timestamp": "2026-11-13T23:55:21.033446+00:00", "status_notes": "Vulnerability GHSA-8vvx-rff5-p5rq does not affect version 10.0.11 of nodemailer. not_affected \u2014 Target is nodemailer 10.0.11, which already contains the upstream fix (ebe0849, \"flatten nested recipient arrays without recursion\"). MimeNode._parseAddresses now flattens nested arrays with an explicit stack and a WeakSet for cycle handling. Arrays therefore never reach addressparser()/Tokenizer.toString(). The only non-upstream commit on HEAD is an automation-authored tuxcare.yaml commit, whi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-8vvx-rff5-p5rq" }, "impact_statement": "not_affected \u2014 Target is nodemailer 10.0.11, which already contains the upstream fix (ebe0849, \"flatten nested recipient arrays without recursion\"). MimeNode._parseAddresses now flattens nested arrays with an explicit stack and a WeakSet for cycle handling. Arrays therefore never reach addressparser()/Tokenizer.toString(). The only non-upstream commit on HEAD is an automation-authored tuxcare.yaml commit, whi..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.11", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.11" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-9h6g-pr28-7cqp affects version 10.0.11 of nodemailer.", "vulnerability": { "name": "GHSA-9h6g-pr28-7cqp" }, "action_statement": "Vulnerability GHSA-9h6g-pr28-7cqp affects version 10.0.11 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.11", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.11" } } ], "timestamp": "2026-11-13T22:09:23.418068+00:00", "status_notes": "Vulnerability GHSA-c7w3-x93f-qmm8 does not affect version 10.0.11 of nodemailer. not_affected \u2014 The target (nodemailer 10.0.11, TypeScript source) already contains the upstream fix for GHSA-c7w3-x93f-qmm8. src/smtp-connection/index.ts:1814-1819 casts envelope.size with Number() and emits SIZE= only for a positive numeric value, so CRLF cannot reach the MAIL FROM command. The fix is upstream commit 2d7b971 by andris@reinman.eu, which is an ancestor of HEAD. HEAD has no commit from a TuxCar...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-c7w3-x93f-qmm8" }, "impact_statement": "not_affected \u2014 The target (nodemailer 10.0.11, TypeScript source) already contains the upstream fix for GHSA-c7w3-x93f-qmm8. src/smtp-connection/index.ts:1814-1819 casts envelope.size with Number() and emits SIZE= only for a positive numeric value, so CRLF cannot reach the MAIL FROM command. The fix is upstream commit 2d7b971 by andris@reinman.eu, which is an ancestor of HEAD. HEAD has no commit from a TuxCar..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.11", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.11" } } ], "timestamp": "2026-11-13T22:57:00.061178+00:00", "status_notes": "Vulnerability GHSA-cc9r-2j5m-2m83 does not affect version 10.0.11 of nodemailer. not_affected \u2014 Target nodemailer 10.0.11 already contains the upstream fix (commit 902b63e, \"terminate the domain at an RFC 5322 comment\", by Andris Reinman). _handleAddress in src/addressparser/index.ts no longer concatenates text across a comment-closing ')' unless one side carries '@'. So user@good-corp.com(x)evil.com is no longer merged into good-corp.comevil.com. The fix is an ancestor of HEAD, and no Tu...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-cc9r-2j5m-2m83" }, "impact_statement": "not_affected \u2014 Target nodemailer 10.0.11 already contains the upstream fix (commit 902b63e, \"terminate the domain at an RFC 5322 comment\", by Andris Reinman). _handleAddress in src/addressparser/index.ts no longer concatenates text across a comment-closing ')' unless one side carries '@'. So user@good-corp.com(x)evil.com is no longer merged into good-corp.comevil.com. The fix is an ancestor of HEAD, and no Tu..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.11", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.11" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-frj6-5rhh-vwfw is a false positive for nodemailer 10.0.11.", "vulnerability": { "name": "GHSA-frj6-5rhh-vwfw" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.11", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.11" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-g57g-f23g-4646 affects version 10.0.11 of nodemailer.", "vulnerability": { "name": "GHSA-g57g-f23g-4646" }, "action_statement": "Vulnerability GHSA-g57g-f23g-4646 affects version 10.0.11 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.11", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.11" } } ], "timestamp": "2026-10-27T15:13:36.008785+00:00", "status_notes": "Vulnerability GHSA-g73g-hqqh-jr95 affects version 10.0.11 of nodemailer.", "vulnerability": { "name": "GHSA-g73g-hqqh-jr95" }, "action_statement": "Vulnerability GHSA-g73g-hqqh-jr95 affects version 10.0.11 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.11", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.11" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-h3hj-cmcx-xc66 is a false positive for nodemailer 10.0.11.", "vulnerability": { "name": "GHSA-h3hj-cmcx-xc66" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.11", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.11" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-jj37-3377-m6vv is a false positive for nodemailer 10.0.11.", "vulnerability": { "name": "GHSA-jj37-3377-m6vv" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.11", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.11" } } ], "timestamp": "2026-10-23T22:01:49.029239+00:00", "status_notes": "Vulnerability GHSA-m943-m63m-w62w affects version 10.0.11 of nodemailer.", "vulnerability": { "name": "GHSA-m943-m63m-w62w" }, "action_statement": "Vulnerability GHSA-m943-m63m-w62w affects version 10.0.11 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.11", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.11" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-v53p-9fqp-m79j affects version 10.0.11 of nodemailer.", "vulnerability": { "name": "GHSA-v53p-9fqp-m79j" }, "action_statement": "Vulnerability GHSA-v53p-9fqp-m79j affects version 10.0.11 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.11", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.11" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-vm5r-23w9-m8hx is a false positive for nodemailer 10.0.11.", "vulnerability": { "name": "GHSA-vm5r-23w9-m8hx" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.11", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.11" } } ], "timestamp": "2026-11-13T22:09:23.418068+00:00", "status_notes": "Vulnerability GHSA-vvjj-xcjg-gr5g does not affect version 10.0.11 of nodemailer. not_affected \u2014 Nodemailer 10.0.11 already strips CR/LF from the SMTP client `name` option at src/smtp-connection/index.ts:621 before it is used in EHLO/HELO/LHLO. The fix shipped in the upstream release (introduced by the upstream TypeScript migration commit), so the vulnerable pattern is not present.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-vvjj-xcjg-gr5g" }, "impact_statement": "not_affected \u2014 Nodemailer 10.0.11 already strips CR/LF from the SMTP client `name` option at src/smtp-connection/index.ts:621 before it is used in EHLO/HELO/LHLO. The fix shipped in the upstream release (introduced by the upstream TypeScript migration commit), so the vulnerable pattern is not present." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.11", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.11" } } ], "timestamp": "2026-11-13T22:58:00.049762+00:00", "status_notes": "Vulnerability GHSA-wmmp-3585-3rmp does not affect version 10.0.11 of nodemailer. not_affected \u2014 Target (nodemailer 10.0.11) already contains the upstream fixes for GHSA-wmmp-3585-3rmp. Domain encoding in _normalizeAddress now goes through normalizeDomain(), which applies UTS-46 mapping via url.domainToASCII/domainToUnicode. It guards against URL-parser delimiter characters. Both upstream fix commits (259c32d, b212ac4) are ancestors of HEAD and were authored by the upstream maintainer. HEA...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wmmp-3585-3rmp" }, "impact_statement": "not_affected \u2014 Target (nodemailer 10.0.11) already contains the upstream fixes for GHSA-wmmp-3585-3rmp. Domain encoding in _normalizeAddress now goes through normalizeDomain(), which applies UTS-46 mapping via url.domainToASCII/domainToUnicode. It guards against URL-parser delimiter characters. Both upstream fix commits (259c32d, b212ac4) are ancestors of HEAD and were authored by the upstream maintainer. HEA..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.11", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.11" } } ], "timestamp": "2026-11-13T22:15:08.551507+00:00", "status_notes": "Vulnerability GHSA-wqvq-jvpq-h66f does not affect version 10.0.11 of nodemailer. not_affected \u2014 nodemailer 10.0.11 already enforces disableFileAccess/disableUrlAccess in the pre-resolution path used by jsonTransport and attachDataUrls. The upstream fix commit 5f694977 (andris@reinman.eu) is an ancestor of HEAD, and HEAD has no TuxCare-domain commits, so this is an upstream fix shipped in the release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wqvq-jvpq-h66f" }, "impact_statement": "not_affected \u2014 nodemailer 10.0.11 already enforces disableFileAccess/disableUrlAccess in the pre-resolution path used by jsonTransport and attachDataUrls. The upstream fix commit 5f694977 (andris@reinman.eu) is an ancestor of HEAD, and HEAD has no TuxCare-domain commits, so this is an upstream fix shipped in the release." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.11", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.11" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-wxxx-r42m-9rp8 is a false positive for nodemailer 10.0.11.", "vulnerability": { "name": "GHSA-wxxx-r42m-9rp8" }, "impact_statement": "The vulnerability has been withdrawn." } ] }