{
  "@id": "urn:uuid:2d5cebe8-00d9-4c09-858d-0e2bfd4c7985",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 19,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-13T23:53:00.038549+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.14",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.14"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2020-7769 affects version 10.0.14 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2020-7769"
      },
      "action_statement": "Vulnerability CVE-2020-7769 affects version 10.0.14 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.14",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.14"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2021-23400 affects version 10.0.14 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2021-23400"
      },
      "action_statement": "Vulnerability CVE-2021-23400 affects version 10.0.14 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.14",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.14"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2025-13033 affects version 10.0.14 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2025-13033"
      },
      "action_statement": "Vulnerability CVE-2025-13033 affects version 10.0.14 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.14",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.14"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2025-14874 affects version 10.0.14 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2025-14874"
      },
      "action_statement": "Vulnerability CVE-2025-14874 affects version 10.0.14 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.14",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.14"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2026-110871 affects version 10.0.14 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-110871"
      },
      "action_statement": "Vulnerability CVE-2026-110871 affects version 10.0.14 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.14",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.14"
          }
        }
      ],
      "timestamp": "2026-11-03T14:36:48.497569+00:00",
      "status_notes": "Vulnerability CVE-2026-121424 affects version 10.0.14 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-121424"
      },
      "action_statement": "Vulnerability CVE-2026-121424 affects version 10.0.14 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.14",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.14"
          }
        }
      ],
      "timestamp": "2026-11-03T14:36:48.497569+00:00",
      "status_notes": "Vulnerability CVE-2026-121425 affects version 10.0.14 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-121425"
      },
      "action_statement": "Vulnerability CVE-2026-121425 affects version 10.0.14 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.14",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.14"
          }
        }
      ],
      "timestamp": "2026-11-03T14:36:48.497569+00:00",
      "status_notes": "Vulnerability CVE-2026-121426 affects version 10.0.14 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-121426"
      },
      "action_statement": "Vulnerability CVE-2026-121426 affects version 10.0.14 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.14",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.14"
          }
        }
      ],
      "timestamp": "2026-11-10T15:30:00.075367+00:00",
      "status_notes": "Vulnerability CVE-2026-125755 affects version 10.0.14 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-125755"
      },
      "action_statement": "Vulnerability CVE-2026-125755 affects version 10.0.14 of nodemailer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.14",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.14"
          }
        }
      ],
      "timestamp": "2026-11-13T22:31:00.045181+00:00",
      "status_notes": "Vulnerability CVE-2026-82659 does not affect version 10.0.14 of nodemailer. not_affected \u2014 The target (nodemailer 10.0.14) already contains the upstream fix a82e060 by Andris Reinman. MailComposer.compile() passes disableUrlAccess and disableFileAccess to the raw root MimeNode, and MimeNode._getStream enforces them. The fix shipped in the upstream release, before the first TuxCare commit.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-82659"
      },
      "impact_statement": "not_affected \u2014 The target (nodemailer 10.0.14) already contains the upstream fix a82e060 by Andris Reinman. MailComposer.compile() passes disableUrlAccess and disableFileAccess to the raw root MimeNode, and MimeNode._getStream enforces them. The fix shipped in the upstream release, before the first TuxCare commit."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.14",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.14"
          }
        }
      ],
      "timestamp": "2026-11-13T23:13:21.676667+00:00",
      "status_notes": "Vulnerability CVE-2026-82662 does not affect version 10.0.14 of nodemailer. not_affected \u2014 Nodemailer 10.0.14 is not affected. The internal fetch client (src/fetch/index.ts) sets rejectUnauthorized: true by default. Upstream commit 6a947ac (\"fix!: validate TLS certificates by default when fetching remote content\", Andris Reinman) is an ancestor of HEAD. The OAuth2 token path pins rejectUnauthorized: true as well. HEAD has no TuxCare commits, so this is an upstream fix shipped in the ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-82662"
      },
      "impact_statement": "not_affected \u2014 Nodemailer 10.0.14 is not affected. The internal fetch client (src/fetch/index.ts) sets rejectUnauthorized: true by default. Upstream commit 6a947ac (\"fix!: validate TLS certificates by default when fetching remote content\", Andris Reinman) is an ancestor of HEAD. The OAuth2 token path pins rejectUnauthorized: true as well. HEAD has no TuxCare commits, so this is an upstream fix shipped in the ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.14",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.14"
          }
        }
      ],
      "timestamp": "2026-11-13T23:28:00.053366+00:00",
      "status_notes": "Vulnerability CVE-2026-82854 does not affect version 10.0.14 of nodemailer. not_affected \u2014 Target (nodemailer 10.0.14) already contains the upstream fix 2d7b971 (\"sanitize envelope size to prevent SMTP command injection\"). envelope.size is coerced with Number() before being appended to MAIL FROM, so CRLF cannot reach the command line. The fix shipped in the upstream release and no TuxCare commit exists in HEAD history.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-82854"
      },
      "impact_statement": "not_affected \u2014 Target (nodemailer 10.0.14) already contains the upstream fix 2d7b971 (\"sanitize envelope size to prevent SMTP command injection\"). envelope.size is coerced with Number() before being appended to MAIL FROM, so CRLF cannot reach the command line. The fix shipped in the upstream release and no TuxCare commit exists in HEAD history."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.14",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.14"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2026-90776 affects version 10.0.14 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-90776"
      },
      "action_statement": "Vulnerability CVE-2026-90776 affects version 10.0.14 of nodemailer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.14",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.14"
          }
        }
      ],
      "timestamp": "2026-11-13T22:18:00.036497+00:00",
      "status_notes": "Vulnerability GHSA-268h-hp4c-crq3 does not affect version 10.0.14 of nodemailer. not_affected \u2014 Target (nodemailer 10.0.14, TypeScript source) already contains the upstream fix for the List-* comment CRLF injection. _getListHeaders in src/mailer/mail-message.ts strips CR/LF from list comments before building the prepared header value. The fix is upstream commit 5f69497 (author andris@reinman.eu), which is an ancestor of HEAD and shipped in the upstream release. No TuxCare-domain commit ex...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-268h-hp4c-crq3"
      },
      "impact_statement": "not_affected \u2014 Target (nodemailer 10.0.14, TypeScript source) already contains the upstream fix for the List-* comment CRLF injection. _getListHeaders in src/mailer/mail-message.ts strips CR/LF from list comments before building the prepared header value. The fix is upstream commit 5f69497 (author andris@reinman.eu), which is an ancestor of HEAD and shipped in the upstream release. No TuxCare-domain commit ex..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.14",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.14"
          }
        }
      ],
      "timestamp": "2026-11-13T22:47:19.635867+00:00",
      "status_notes": "Vulnerability GHSA-2x7j-588g-ccc2 does not affect version 10.0.14 of nodemailer. not_affected \u2014 Nodemailer 10.0.14 already contains linear-time versions of all three quadratic paths fixed in 9.1.0: the addressparser accumulator, the display-name merge loop, and the _convertAddresses uniqueness check. The fix shipped in the upstream release (TypeScript migration, author andris@reinman.eu). The repo has no commit from a TuxCare/CloudLinux email.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-2x7j-588g-ccc2"
      },
      "impact_statement": "not_affected \u2014 Nodemailer 10.0.14 already contains linear-time versions of all three quadratic paths fixed in 9.1.0: the addressparser accumulator, the display-name merge loop, and the _convertAddresses uniqueness check. The fix shipped in the upstream release (TypeScript migration, author andris@reinman.eu). The repo has no commit from a TuxCare/CloudLinux email."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.14",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.14"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-46j5-6fg5-4gv3 is a false positive for nodemailer 10.0.14.",
      "vulnerability": {
        "name": "GHSA-46j5-6fg5-4gv3"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.14",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.14"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-4ffr-jq9g-5ffx affects version 10.0.14 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-4ffr-jq9g-5ffx"
      },
      "action_statement": "Vulnerability GHSA-4ffr-jq9g-5ffx affects version 10.0.14 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.14",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.14"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-4g23-2xm8-66gc affects version 10.0.14 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-4g23-2xm8-66gc"
      },
      "action_statement": "Vulnerability GHSA-4g23-2xm8-66gc affects version 10.0.14 of nodemailer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.14",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.14"
          }
        }
      ],
      "timestamp": "2026-11-13T23:51:08.444502+00:00",
      "status_notes": "Vulnerability GHSA-6vj9-mwq6-2f5v does not affect version 10.0.14 of nodemailer. not_affected \u2014 Target (nodemailer 10.0.14) already contains the upstream fix a6512db, \"fix(shared): keep the TLS server name out of the DNS cache\". The DNS cache stores addresses only, and the TLS servername is derived from the current caller's options on every resolveHostname return path, including cache hits. The fix shipped in the upstream release.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-6vj9-mwq6-2f5v"
      },
      "impact_statement": "not_affected \u2014 Target (nodemailer 10.0.14) already contains the upstream fix a6512db, \"fix(shared): keep the TLS server name out of the DNS cache\". The DNS cache stores addresses only, and the TLS servername is derived from the current caller's options on every resolveHostname return path, including cache hits. The fix shipped in the upstream release."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.14",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.14"
          }
        }
      ],
      "timestamp": "2026-10-23T22:01:00.144162+00:00",
      "status_notes": "Vulnerability GHSA-85x2-q946-cp5h affects version 10.0.14 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-85x2-q946-cp5h"
      },
      "action_statement": "Vulnerability GHSA-85x2-q946-cp5h affects version 10.0.14 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.14",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.14"
          }
        }
      ],
      "timestamp": "2026-10-23T22:01:00.144162+00:00",
      "status_notes": "Vulnerability GHSA-8c8m-p3m8-cjg8 affects version 10.0.14 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-8c8m-p3m8-cjg8"
      },
      "action_statement": "Vulnerability GHSA-8c8m-p3m8-cjg8 affects version 10.0.14 of nodemailer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.14",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.14"
          }
        }
      ],
      "timestamp": "2026-11-13T22:32:00.034202+00:00",
      "status_notes": "Vulnerability GHSA-8m3c-c648-2xjj does not affect version 10.0.14 of nodemailer. not_affected \u2014 Target (nodemailer 10.0.14) already contains the upstream fix. MailMessage.resolveContent in src/mailer/mail-message.ts no longer passes the call straight through to shared.resolveContent. It builds an access policy from this.data.disableFileAccess / disableUrlAccess, ORed with any explicit options, and passes that policy on. The legacy (data, key, callback) signature therefore keeps the sandbo...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-8m3c-c648-2xjj"
      },
      "impact_statement": "not_affected \u2014 Target (nodemailer 10.0.14) already contains the upstream fix. MailMessage.resolveContent in src/mailer/mail-message.ts no longer passes the call straight through to shared.resolveContent. It builds an access policy from this.data.disableFileAccess / disableUrlAccess, ORed with any explicit options, and passes that policy on. The legacy (data, key, callback) signature therefore keeps the sandbo..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.14",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.14"
          }
        }
      ],
      "timestamp": "2026-11-13T23:53:00.038549+00:00",
      "status_notes": "Vulnerability GHSA-8vvx-rff5-p5rq does not affect version 10.0.14 of nodemailer. not_affected \u2014 Target 10.0.14 already contains the upstream fix (ebe0849, \"flatten nested recipient arrays without recursion\"). MimeNode._parseAddresses now flattens nested arrays iteratively with an explicit stack and a WeakSet cycle guard, so nested arrays never reach addressparser's Tokenizer toString(). The fix is upstream-authored and ships in the base release. No TuxCare-domain commit exists in history.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-8vvx-rff5-p5rq"
      },
      "impact_statement": "not_affected \u2014 Target 10.0.14 already contains the upstream fix (ebe0849, \"flatten nested recipient arrays without recursion\"). MimeNode._parseAddresses now flattens nested arrays iteratively with an explicit stack and a WeakSet cycle guard, so nested arrays never reach addressparser's Tokenizer toString(). The fix is upstream-authored and ships in the base release. No TuxCare-domain commit exists in history."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.14",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.14"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-9h6g-pr28-7cqp affects version 10.0.14 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-9h6g-pr28-7cqp"
      },
      "action_statement": "Vulnerability GHSA-9h6g-pr28-7cqp affects version 10.0.14 of nodemailer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.14",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.14"
          }
        }
      ],
      "timestamp": "2026-11-13T22:09:32.764375+00:00",
      "status_notes": "Vulnerability GHSA-c7w3-x93f-qmm8 does not affect version 10.0.14 of nodemailer. not_affected \u2014 The target (nodemailer 10.0.14, TypeScript source) already contains the upstream fix for GHSA-c7w3-x93f-qmm8. envelope.size is coerced with Number() and only a positive numeric value is appended to MAIL FROM, so CRLF cannot reach the SMTP stream. The fix is upstream commit 2d7b9710 (\"fix: sanitize envelope size to prevent SMTP command injection\") by andris@reinman.eu. It is an ancestor of HEAD,...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-c7w3-x93f-qmm8"
      },
      "impact_statement": "not_affected \u2014 The target (nodemailer 10.0.14, TypeScript source) already contains the upstream fix for GHSA-c7w3-x93f-qmm8. envelope.size is coerced with Number() and only a positive numeric value is appended to MAIL FROM, so CRLF cannot reach the SMTP stream. The fix is upstream commit 2d7b9710 (\"fix: sanitize envelope size to prevent SMTP command injection\") by andris@reinman.eu. It is an ancestor of HEAD,..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.14",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.14"
          }
        }
      ],
      "timestamp": "2026-11-13T22:57:00.061178+00:00",
      "status_notes": "Vulnerability GHSA-cc9r-2j5m-2m83 does not affect version 10.0.14 of nodemailer. not_affected \u2014 Target 10.0.14 already contains the upstream fix 902b63e (\"terminate the domain at an RFC 5322 comment\"), authored by andris@reinman.eu and shipped in the upstream release. The address assembler no longer glues tokens across a comment-closing ')' unless the '@' sits on one side of the comment, so 'user@good-corp.com(x)evil.com' no longer becomes 'good-corp.comevil.com'.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-cc9r-2j5m-2m83"
      },
      "impact_statement": "not_affected \u2014 Target 10.0.14 already contains the upstream fix 902b63e (\"terminate the domain at an RFC 5322 comment\"), authored by andris@reinman.eu and shipped in the upstream release. The address assembler no longer glues tokens across a comment-closing ')' unless the '@' sits on one side of the comment, so 'user@good-corp.com(x)evil.com' no longer becomes 'good-corp.comevil.com'."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.14",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.14"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-frj6-5rhh-vwfw is a false positive for nodemailer 10.0.14.",
      "vulnerability": {
        "name": "GHSA-frj6-5rhh-vwfw"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.14",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.14"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-g57g-f23g-4646 affects version 10.0.14 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-g57g-f23g-4646"
      },
      "action_statement": "Vulnerability GHSA-g57g-f23g-4646 affects version 10.0.14 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.14",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.14"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-g73g-hqqh-jr95 affects version 10.0.14 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-g73g-hqqh-jr95"
      },
      "action_statement": "Vulnerability GHSA-g73g-hqqh-jr95 affects version 10.0.14 of nodemailer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.14",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.14"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-h3hj-cmcx-xc66 is a false positive for nodemailer 10.0.14.",
      "vulnerability": {
        "name": "GHSA-h3hj-cmcx-xc66"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.14",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.14"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-jj37-3377-m6vv is a false positive for nodemailer 10.0.14.",
      "vulnerability": {
        "name": "GHSA-jj37-3377-m6vv"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.14",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.14"
          }
        }
      ],
      "timestamp": "2026-10-23T22:01:49.029239+00:00",
      "status_notes": "Vulnerability GHSA-m943-m63m-w62w affects version 10.0.14 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-m943-m63m-w62w"
      },
      "action_statement": "Vulnerability GHSA-m943-m63m-w62w affects version 10.0.14 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.14",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.14"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-v53p-9fqp-m79j affects version 10.0.14 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-v53p-9fqp-m79j"
      },
      "action_statement": "Vulnerability GHSA-v53p-9fqp-m79j affects version 10.0.14 of nodemailer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.14",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.14"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-vm5r-23w9-m8hx is a false positive for nodemailer 10.0.14.",
      "vulnerability": {
        "name": "GHSA-vm5r-23w9-m8hx"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.14",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.14"
          }
        }
      ],
      "timestamp": "2026-11-13T22:09:49.702960+00:00",
      "status_notes": "Vulnerability GHSA-vvjj-xcjg-gr5g does not affect version 10.0.14 of nodemailer. not_affected \u2014 Target nodemailer 10.0.14 already contains the upstream fix for GHSA-vvjj-xcjg-gr5g. SmtpConnection strips CR/LF from the `name` option before it is used in EHLO/HELO/LHLO. The fix commit 0a43876 is by the upstream author (andris@reinman.eu) and is an ancestor of HEAD. HEAD has no TuxCare-domain commit, so this is an upstream fix.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-vvjj-xcjg-gr5g"
      },
      "impact_statement": "not_affected \u2014 Target nodemailer 10.0.14 already contains the upstream fix for GHSA-vvjj-xcjg-gr5g. SmtpConnection strips CR/LF from the `name` option before it is used in EHLO/HELO/LHLO. The fix commit 0a43876 is by the upstream author (andris@reinman.eu) and is an ancestor of HEAD. HEAD has no TuxCare-domain commit, so this is an upstream fix."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.14",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.14"
          }
        }
      ],
      "timestamp": "2026-11-13T22:58:00.049762+00:00",
      "status_notes": "Vulnerability GHSA-wmmp-3585-3rmp does not affect version 10.0.14 of nodemailer. not_affected \u2014 Target is nodemailer 10.0.14, which already contains the upstream fix for GHSA-wmmp-3585-3rmp. Upstream commits 259c32d (UTS-46 mapping) and b212ac4 (keep URL delimiters away from the mapper) are ancestors of HEAD. normalizeDomain() in src/mime-node/index.ts now uses url.domainToASCII/domainToUnicode and rejects unsafe host characters before using the mapper. HEAD has no TuxCare-domain commits,...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-wmmp-3585-3rmp"
      },
      "impact_statement": "not_affected \u2014 Target is nodemailer 10.0.14, which already contains the upstream fix for GHSA-wmmp-3585-3rmp. Upstream commits 259c32d (UTS-46 mapping) and b212ac4 (keep URL delimiters away from the mapper) are ancestors of HEAD. normalizeDomain() in src/mime-node/index.ts now uses url.domainToASCII/domainToUnicode and rejects unsafe host characters before using the mapper. HEAD has no TuxCare-domain commits,..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.14",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.14"
          }
        }
      ],
      "timestamp": "2026-11-13T22:15:08.551507+00:00",
      "status_notes": "Vulnerability GHSA-wqvq-jvpq-h66f does not affect version 10.0.14 of nodemailer. not_affected \u2014 Not affected. The fix for GHSA-wqvq-jvpq-h66f is already in the upstream 10.0.14 release. Upstream commit dc48ed3 (andris@reinman.eu, \"fix(mailer): apply the message access policy in resolveContent\") is an ancestor of HEAD. shared.resolveContent now takes an access policy and rejects protected URLs and file paths. MailMessage.resolveContent, resolveAll (the jsonTransport path) and _convertDataI...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-wqvq-jvpq-h66f"
      },
      "impact_statement": "not_affected \u2014 Not affected. The fix for GHSA-wqvq-jvpq-h66f is already in the upstream 10.0.14 release. Upstream commit dc48ed3 (andris@reinman.eu, \"fix(mailer): apply the message access policy in resolveContent\") is an ancestor of HEAD. shared.resolveContent now takes an access policy and rejects protected URLs and file paths. MailMessage.resolveContent, resolveAll (the jsonTransport path) and _convertDataI..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@10.0.14",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@10.0.14"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-wxxx-r42m-9rp8 is a false positive for nodemailer 10.0.14.",
      "vulnerability": {
        "name": "GHSA-wxxx-r42m-9rp8"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}