{ "@id": "urn:uuid:9e4431e9-6e4f-42d0-8c1d-971b4b97de15", "role": "Document Creator", "author": "https://tuxcare.com", "version": 26, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-13T23:52:21.958941+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.5" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2020-7769 affects version 10.0.5 of nodemailer.", "vulnerability": { "name": "CVE-2020-7769" }, "action_statement": "Vulnerability CVE-2020-7769 affects version 10.0.5 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.5" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2021-23400 affects version 10.0.5 of nodemailer.", "vulnerability": { "name": "CVE-2021-23400" }, "action_statement": "Vulnerability CVE-2021-23400 affects version 10.0.5 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.5" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2025-13033 affects version 10.0.5 of nodemailer.", "vulnerability": { "name": "CVE-2025-13033" }, "action_statement": "Vulnerability CVE-2025-13033 affects version 10.0.5 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.5" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2025-14874 affects version 10.0.5 of nodemailer.", "vulnerability": { "name": "CVE-2025-14874" }, "action_statement": "Vulnerability CVE-2025-14874 affects version 10.0.5 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.5" } } ], "timestamp": "2026-10-15T15:49:00.133726+00:00", "status_notes": "Vulnerability CVE-2026-110869 affects version 10.0.5 of nodemailer.", "vulnerability": { "name": "CVE-2026-110869" }, "action_statement": "Vulnerability CVE-2026-110869 affects version 10.0.5 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.5" } } ], "timestamp": "2026-10-26T15:35:33.946658+00:00", "status_notes": "Vulnerability CVE-2026-110870 affects version 10.0.5 of nodemailer.", "vulnerability": { "name": "CVE-2026-110870" }, "action_statement": "Vulnerability CVE-2026-110870 affects version 10.0.5 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.5" } } ], "timestamp": "2026-10-20T02:47:06.846725+00:00", "status_notes": "Vulnerability CVE-2026-110871 affects version 10.0.5 of nodemailer.", "vulnerability": { "name": "CVE-2026-110871" }, "action_statement": "Vulnerability CVE-2026-110871 affects version 10.0.5 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.5" } } ], "timestamp": "2026-10-15T14:52:00.136801+00:00", "status_notes": "Vulnerability CVE-2026-110872 affects version 10.0.5 of nodemailer.", "vulnerability": { "name": "CVE-2026-110872" }, "action_statement": "Vulnerability CVE-2026-110872 affects version 10.0.5 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.5" } } ], "timestamp": "2026-11-03T14:36:48.497569+00:00", "status_notes": "Vulnerability CVE-2026-121424 affects version 10.0.5 of nodemailer.", "vulnerability": { "name": "CVE-2026-121424" }, "action_statement": "Vulnerability CVE-2026-121424 affects version 10.0.5 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.5" } } ], "timestamp": "2026-11-03T14:36:48.497569+00:00", "status_notes": "Vulnerability CVE-2026-121425 affects version 10.0.5 of nodemailer.", "vulnerability": { "name": "CVE-2026-121425" }, "action_statement": "Vulnerability CVE-2026-121425 affects version 10.0.5 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.5" } } ], "timestamp": "2026-11-03T14:36:48.497569+00:00", "status_notes": "Vulnerability CVE-2026-121426 affects version 10.0.5 of nodemailer.", "vulnerability": { "name": "CVE-2026-121426" }, "action_statement": "Vulnerability CVE-2026-121426 affects version 10.0.5 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.5" } } ], "timestamp": "2026-11-10T15:30:00.075367+00:00", "status_notes": "Vulnerability CVE-2026-125755 affects version 10.0.5 of nodemailer.", "vulnerability": { "name": "CVE-2026-125755" }, "action_statement": "Vulnerability CVE-2026-125755 affects version 10.0.5 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.5" } } ], "timestamp": "2026-11-13T22:31:00.045181+00:00", "status_notes": "Vulnerability CVE-2026-82659 does not affect version 10.0.5 of nodemailer. not_affected \u2014 Target (nodemailer 10.0.5, TS sources) already contains the upstream fix: MailComposer.compile() passes disableUrlAccess/disableFileAccess to the raw root MimeNode, and MimeNode._getStream enforces them. The fix commit a82e060 (andris@reinman.eu, upstream) is an ancestor of HEAD and part of the upstream release; no TuxCare-domain commit exists in history.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-82659" }, "impact_statement": "not_affected \u2014 Target (nodemailer 10.0.5, TS sources) already contains the upstream fix: MailComposer.compile() passes disableUrlAccess/disableFileAccess to the raw root MimeNode, and MimeNode._getStream enforces them. The fix commit a82e060 (andris@reinman.eu, upstream) is an ancestor of HEAD and part of the upstream release; no TuxCare-domain commit exists in history." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.5" } } ], "timestamp": "2026-11-13T23:12:50.176480+00:00", "status_notes": "Vulnerability CVE-2026-82662 does not affect version 10.0.5 of nodemailer. not_affected \u2014 Target (nodemailer 10.0.5) does not contain the vulnerable pattern. The internal fetch client sets rejectUnauthorized: true by default (src/fetch/index.ts:247), and the XOAuth2 token request pins rejectUnauthorized: true as well. The upstream commit 6a947ac (andris@reinman.eu, \"fix!: validate TLS certificates by default when fetching remote content\") flipped the pre-fix value false to true. It ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-82662" }, "impact_statement": "not_affected \u2014 Target (nodemailer 10.0.5) does not contain the vulnerable pattern. The internal fetch client sets rejectUnauthorized: true by default (src/fetch/index.ts:247), and the XOAuth2 token request pins rejectUnauthorized: true as well. The upstream commit 6a947ac (andris@reinman.eu, \"fix!: validate TLS certificates by default when fetching remote content\") flipped the pre-fix value false to true. It ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.5" } } ], "timestamp": "2026-11-13T23:28:00.053366+00:00", "status_notes": "Vulnerability CVE-2026-82854 does not affect version 10.0.5 of nodemailer. not_affected \u2014 Nodemailer 10.0.5 is not affected. The upstream fix, commit 2d7b971 'fix: sanitize envelope size to prevent SMTP command injection' by Andris Reinman, is an ancestor of HEAD. src/smtp-connection/index.ts:1702-1707 coerces envelope.size with Number() and only emits SIZE= when the result is greater than 0, so CRLF payloads cannot reach the MAIL FROM command. HEAD is a plain upstream relea...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-82854" }, "impact_statement": "not_affected \u2014 Nodemailer 10.0.5 is not affected. The upstream fix, commit 2d7b971 'fix: sanitize envelope size to prevent SMTP command injection' by Andris Reinman, is an ancestor of HEAD. src/smtp-connection/index.ts:1702-1707 coerces envelope.size with Number() and only emits SIZE= when the result is greater than 0, so CRLF payloads cannot reach the MAIL FROM command. HEAD is a plain upstream relea..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.5" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2026-90776 affects version 10.0.5 of nodemailer.", "vulnerability": { "name": "CVE-2026-90776" }, "action_statement": "Vulnerability CVE-2026-90776 affects version 10.0.5 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.5" } } ], "timestamp": "2026-11-13T22:17:00.046957+00:00", "status_notes": "Vulnerability GHSA-268h-hp4c-crq3 does not affect version 10.0.5 of nodemailer. not_affected \u2014 Target (nodemailer 10.0.5) already neutralizes CR/LF in list.*.comment before building the prepared List-* header values. The fix shipped in the upstream release and is authored by the upstream maintainer, with no TuxCare commit involved. The vulnerable pattern is absent.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-268h-hp4c-crq3" }, "impact_statement": "not_affected \u2014 Target (nodemailer 10.0.5) already neutralizes CR/LF in list.*.comment before building the prepared List-* header values. The fix shipped in the upstream release and is authored by the upstream maintainer, with no TuxCare commit involved. The vulnerable pattern is absent." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.5" } } ], "timestamp": "2026-11-13T22:42:00.042020+00:00", "status_notes": "Vulnerability GHSA-2x7j-588g-ccc2 does not affect version 10.0.5 of nodemailer. not_affected \u2014 Target nodemailer 10.0.5 already contains all three upstream quadratic-time fixes for GHSA-2x7j-588g-ccc2 (addressparser accumulator, display-name merge loop, and recipient dedupe in MimeNode._convertAddresses), plus the maxRecipients cap. The fix commits are upstream-authored (andris@reinman.eu) and shipped in the upstream release, so this is not_affected rather than already_fixed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-2x7j-588g-ccc2" }, "impact_statement": "not_affected \u2014 Target nodemailer 10.0.5 already contains all three upstream quadratic-time fixes for GHSA-2x7j-588g-ccc2 (addressparser accumulator, display-name merge loop, and recipient dedupe in MimeNode._convertAddresses), plus the maxRecipients cap. The fix commits are upstream-authored (andris@reinman.eu) and shipped in the upstream release, so this is not_affected rather than already_fixed." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.5" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-46j5-6fg5-4gv3 is a false positive for nodemailer 10.0.5.", "vulnerability": { "name": "GHSA-46j5-6fg5-4gv3" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.5" } } ], "timestamp": "2026-10-27T15:13:32.414812+00:00", "status_notes": "Vulnerability GHSA-4ffr-jq9g-5ffx affects version 10.0.5 of nodemailer.", "vulnerability": { "name": "GHSA-4ffr-jq9g-5ffx" }, "action_statement": "Vulnerability GHSA-4ffr-jq9g-5ffx affects version 10.0.5 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.5" } } ], "timestamp": "2026-10-27T15:13:32.414812+00:00", "status_notes": "Vulnerability GHSA-4g23-2xm8-66gc affects version 10.0.5 of nodemailer.", "vulnerability": { "name": "GHSA-4g23-2xm8-66gc" }, "action_statement": "Vulnerability GHSA-4g23-2xm8-66gc affects version 10.0.5 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.5" } } ], "timestamp": "2026-11-13T23:48:00.073744+00:00", "status_notes": "Vulnerability GHSA-6vj9-mwq6-2f5v does not affect version 10.0.5 of nodemailer. not_affected \u2014 Target nodemailer 10.0.5 already contains the upstream fix (a6512dbc, \"keep the TLS server name out of the DNS cache\"). The DNS cache stores only addresses, and servername is computed per call from the current request's options. The fix was authored by the upstream maintainer and shipped in the release that TuxCare onboarded, so it is not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6vj9-mwq6-2f5v" }, "impact_statement": "not_affected \u2014 Target nodemailer 10.0.5 already contains the upstream fix (a6512dbc, \"keep the TLS server name out of the DNS cache\"). The DNS cache stores only addresses, and servername is computed per call from the current request's options. The fix was authored by the upstream maintainer and shipped in the release that TuxCare onboarded, so it is not a TuxCare backport." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.5" } } ], "timestamp": "2026-10-23T22:01:00.144162+00:00", "status_notes": "Vulnerability GHSA-85x2-q946-cp5h affects version 10.0.5 of nodemailer.", "vulnerability": { "name": "GHSA-85x2-q946-cp5h" }, "action_statement": "Vulnerability GHSA-85x2-q946-cp5h affects version 10.0.5 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.5" } } ], "timestamp": "2026-10-23T22:01:00.144162+00:00", "status_notes": "Vulnerability GHSA-8c8m-p3m8-cjg8 affects version 10.0.5 of nodemailer.", "vulnerability": { "name": "GHSA-8c8m-p3m8-cjg8" }, "action_statement": "Vulnerability GHSA-8c8m-p3m8-cjg8 affects version 10.0.5 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.5" } } ], "timestamp": "2026-11-13T22:32:00.034202+00:00", "status_notes": "Vulnerability GHSA-8m3c-c648-2xjj does not affect version 10.0.5 of nodemailer. not_affected \u2014 Target is nodemailer 10.0.5. MailMessage.resolveContent in src/mailer/mail-message.ts no longer passes through to shared.resolveContent. It merges the message-level disableFileAccess/disableUrlAccess flags with any caller options and passes that policy on, so the legacy (data, key, callback) signature can no longer bypass the sandbox. This is the upstream fix dc48ed3 (9.1.1). It shipped in the ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-8m3c-c648-2xjj" }, "impact_statement": "not_affected \u2014 Target is nodemailer 10.0.5. MailMessage.resolveContent in src/mailer/mail-message.ts no longer passes through to shared.resolveContent. It merges the message-level disableFileAccess/disableUrlAccess flags with any caller options and passes that policy on, so the legacy (data, key, callback) signature can no longer bypass the sandbox. This is the upstream fix dc48ed3 (9.1.1). It shipped in the ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.5" } } ], "timestamp": "2026-11-13T23:52:21.958941+00:00", "status_notes": "Vulnerability GHSA-8vvx-rff5-p5rq does not affect version 10.0.5 of nodemailer. not_affected \u2014 Target nodemailer 10.0.5 already contains the upstream fix for GHSA-8vvx-rff5-p5rq. Upstream commit ebe0849 (Andris Reinman) is an ancestor of HEAD. It makes MimeNode._parseAddresses flatten nested recipient arrays iteratively, so nested arrays are never stringified by addressparser. It also wraps the compile and getEnvelope step in sendMail in try/catch. The fix shipped in the upstream release...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-8vvx-rff5-p5rq" }, "impact_statement": "not_affected \u2014 Target nodemailer 10.0.5 already contains the upstream fix for GHSA-8vvx-rff5-p5rq. Upstream commit ebe0849 (Andris Reinman) is an ancestor of HEAD. It makes MimeNode._parseAddresses flatten nested recipient arrays iteratively, so nested arrays are never stringified by addressparser. It also wraps the compile and getEnvelope step in sendMail in try/catch. The fix shipped in the upstream release..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.5" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-9h6g-pr28-7cqp affects version 10.0.5 of nodemailer.", "vulnerability": { "name": "GHSA-9h6g-pr28-7cqp" }, "action_statement": "Vulnerability GHSA-9h6g-pr28-7cqp affects version 10.0.5 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.5" } } ], "timestamp": "2026-11-13T22:08:24.214185+00:00", "status_notes": "Vulnerability GHSA-c7w3-x93f-qmm8 does not affect version 10.0.5 of nodemailer. not_affected \u2014 Not affected. In nodemailer 10.0.5 (TypeScript source in src/), envelope.size is coerced with Number() before being appended to MAIL FROM (src/smtp-connection/index.ts:1702-1707). A value like '100\\r\\nRCPT TO:' becomes NaN, then 0, and is dropped. Only digits can reach the command, so CRLF injection through size is not possible. This protection was present in the upstream release, not added ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-c7w3-x93f-qmm8" }, "impact_statement": "not_affected \u2014 Not affected. In nodemailer 10.0.5 (TypeScript source in src/), envelope.size is coerced with Number() before being appended to MAIL FROM (src/smtp-connection/index.ts:1702-1707). A value like '100\\r\\nRCPT TO:' becomes NaN, then 0, and is dropped. Only digits can reach the command, so CRLF injection through size is not possible. This protection was present in the upstream release, not added ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.5" } } ], "timestamp": "2026-11-13T22:57:00.061178+00:00", "status_notes": "Vulnerability GHSA-cc9r-2j5m-2m83 does not affect version 10.0.5 of nodemailer. not_affected \u2014 Nodemailer 10.0.5 (src/addressparser/index.ts) already contains the upstream fix for GHSA-cc9r-2j5m-2m83. The fix is upstream commit 902b63e by Andris Reinman. It is an ancestor of HEAD and ships in the upstream 10.0.5 release, before the first TuxCare commit (4679a12, tuxcare.yaml). A token that follows a comment-closing \")\" no longer joins the preceding text unless one side carries the \"@\". S...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-cc9r-2j5m-2m83" }, "impact_statement": "not_affected \u2014 Nodemailer 10.0.5 (src/addressparser/index.ts) already contains the upstream fix for GHSA-cc9r-2j5m-2m83. The fix is upstream commit 902b63e by Andris Reinman. It is an ancestor of HEAD and ships in the upstream 10.0.5 release, before the first TuxCare commit (4679a12, tuxcare.yaml). A token that follows a comment-closing \")\" no longer joins the preceding text unless one side carries the \"@\". S..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.5" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-frj6-5rhh-vwfw is a false positive for nodemailer 10.0.5.", "vulnerability": { "name": "GHSA-frj6-5rhh-vwfw" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.5" } } ], "timestamp": "2026-09-29T23:56:00.225781+00:00", "status_notes": "Vulnerability GHSA-g57g-f23g-4646 affects version 10.0.5 of nodemailer.", "vulnerability": { "name": "GHSA-g57g-f23g-4646" }, "action_statement": "Vulnerability GHSA-g57g-f23g-4646 affects version 10.0.5 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.5" } } ], "timestamp": "2026-10-27T15:13:32.414812+00:00", "status_notes": "Vulnerability GHSA-g73g-hqqh-jr95 affects version 10.0.5 of nodemailer.", "vulnerability": { "name": "GHSA-g73g-hqqh-jr95" }, "action_statement": "Vulnerability GHSA-g73g-hqqh-jr95 affects version 10.0.5 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.5" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-h3hj-cmcx-xc66 is a false positive for nodemailer 10.0.5.", "vulnerability": { "name": "GHSA-h3hj-cmcx-xc66" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.5" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-jj37-3377-m6vv is a false positive for nodemailer 10.0.5.", "vulnerability": { "name": "GHSA-jj37-3377-m6vv" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.5" } } ], "timestamp": "2026-10-23T22:01:49.029239+00:00", "status_notes": "Vulnerability GHSA-m943-m63m-w62w affects version 10.0.5 of nodemailer.", "vulnerability": { "name": "GHSA-m943-m63m-w62w" }, "action_statement": "Vulnerability GHSA-m943-m63m-w62w affects version 10.0.5 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.5" } } ], "timestamp": "2026-09-29T23:56:00.225781+00:00", "status_notes": "Vulnerability GHSA-v53p-9fqp-m79j affects version 10.0.5 of nodemailer.", "vulnerability": { "name": "GHSA-v53p-9fqp-m79j" }, "action_statement": "Vulnerability GHSA-v53p-9fqp-m79j affects version 10.0.5 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.5" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-vm5r-23w9-m8hx is a false positive for nodemailer 10.0.5.", "vulnerability": { "name": "GHSA-vm5r-23w9-m8hx" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.5" } } ], "timestamp": "2026-11-13T22:09:35.112613+00:00", "status_notes": "Vulnerability GHSA-vvjj-xcjg-gr5g does not affect version 10.0.5 of nodemailer. not_affected \u2014 Nodemailer 10.0.5 is not affected by GHSA-vvjj-xcjg-gr5g. SmtpConnection's constructor strips CR/LF from the `name` option (falling back to the hostname) before it is stored as `this.name`. EHLO, HELO and LHLO are all built from `this.name` only. The strip arrived with the upstream TypeScript migration commit f7cbf83 (author andris@reinman.eu), which is in HEAD. The target has no TuxCare-author...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-vvjj-xcjg-gr5g" }, "impact_statement": "not_affected \u2014 Nodemailer 10.0.5 is not affected by GHSA-vvjj-xcjg-gr5g. SmtpConnection's constructor strips CR/LF from the `name` option (falling back to the hostname) before it is stored as `this.name`. EHLO, HELO and LHLO are all built from `this.name` only. The strip arrived with the upstream TypeScript migration commit f7cbf83 (author andris@reinman.eu), which is in HEAD. The target has no TuxCare-author..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.5" } } ], "timestamp": "2026-11-13T22:58:23.343685+00:00", "status_notes": "Vulnerability GHSA-wmmp-3585-3rmp does not affect version 10.0.5 of nodemailer. not_affected \u2014 Nodemailer 10.0.5 already contains both upstream fixes for GHSA-wmmp-3585-3rmp. The domain encoder in src/mime-node/index.ts applies UTS-46 mapping through url.domainToASCII/domainToUnicode. It first rejects URL-delimiter characters so the host parser cannot truncate the domain. Both fix commits (259c32d, b212ac4) are upstream-authored, are ancestors of HEAD, and shipped in the upstream release...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wmmp-3585-3rmp" }, "impact_statement": "not_affected \u2014 Nodemailer 10.0.5 already contains both upstream fixes for GHSA-wmmp-3585-3rmp. The domain encoder in src/mime-node/index.ts applies UTS-46 mapping through url.domainToASCII/domainToUnicode. It first rejects URL-delimiter characters so the host parser cannot truncate the domain. Both fix commits (259c32d, b212ac4) are upstream-authored, are ancestors of HEAD, and shipped in the upstream release..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.5" } } ], "timestamp": "2026-11-13T22:15:08.551507+00:00", "status_notes": "Vulnerability GHSA-wqvq-jvpq-h66f does not affect version 10.0.5 of nodemailer. not_affected \u2014 Not affected. The upstream fix (nodemailer commit 5f69497, \"jsonTransport access bypass\") is already in the 10.0.5 release this branch was built from. shared.resolveContent now takes an access policy and rejects file and URL content with EFILEACCESS/EURLACCESS. The json-transport and attachDataUrls paths both pass that policy.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wqvq-jvpq-h66f" }, "impact_statement": "not_affected \u2014 Not affected. The upstream fix (nodemailer commit 5f69497, \"jsonTransport access bypass\") is already in the 10.0.5 release this branch was built from. shared.resolveContent now takes an access policy and rejects file and URL content with EFILEACCESS/EURLACCESS. The json-transport and attachDataUrls paths both pass that policy." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.5", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.5" } } ], "timestamp": "2026-10-22T17:05:00.556684+00:00", "status_notes": "Vulnerability GHSA-wxxx-r42m-9rp8 is a false positive for nodemailer 10.0.5.", "vulnerability": { "name": "GHSA-wxxx-r42m-9rp8" }, "impact_statement": "The vulnerability has been withdrawn." } ] }