{ "@id": "urn:uuid:31146862-b330-4369-a940-25284f869b45", "role": "Document Creator", "author": "https://tuxcare.com", "version": 27, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-13T23:52:21.958941+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.7", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.7" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2020-7769 affects version 10.0.7 of nodemailer.", "vulnerability": { "name": "CVE-2020-7769" }, "action_statement": "Vulnerability CVE-2020-7769 affects version 10.0.7 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.7", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.7" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2021-23400 affects version 10.0.7 of nodemailer.", "vulnerability": { "name": "CVE-2021-23400" }, "action_statement": "Vulnerability CVE-2021-23400 affects version 10.0.7 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.7", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.7" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2025-13033 affects version 10.0.7 of nodemailer.", "vulnerability": { "name": "CVE-2025-13033" }, "action_statement": "Vulnerability CVE-2025-13033 affects version 10.0.7 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.7", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.7" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2025-14874 affects version 10.0.7 of nodemailer.", "vulnerability": { "name": "CVE-2025-14874" }, "action_statement": "Vulnerability CVE-2025-14874 affects version 10.0.7 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.7", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.7" } } ], "timestamp": "2026-10-15T15:49:00.133726+00:00", "status_notes": "Vulnerability CVE-2026-110869 affects version 10.0.7 of nodemailer.", "vulnerability": { "name": "CVE-2026-110869" }, "action_statement": "Vulnerability CVE-2026-110869 affects version 10.0.7 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.7", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.7" } } ], "timestamp": "2026-10-26T15:35:33.946658+00:00", "status_notes": "Vulnerability CVE-2026-110870 affects version 10.0.7 of nodemailer.", "vulnerability": { "name": "CVE-2026-110870" }, "action_statement": "Vulnerability CVE-2026-110870 affects version 10.0.7 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.7", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.7" } } ], "timestamp": "2026-10-20T02:47:06.846725+00:00", "status_notes": "Vulnerability CVE-2026-110871 affects version 10.0.7 of nodemailer.", "vulnerability": { "name": "CVE-2026-110871" }, "action_statement": "Vulnerability CVE-2026-110871 affects version 10.0.7 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.7", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.7" } } ], "timestamp": "2026-10-15T14:52:00.136801+00:00", "status_notes": "Vulnerability CVE-2026-110872 affects version 10.0.7 of nodemailer.", "vulnerability": { "name": "CVE-2026-110872" }, "action_statement": "Vulnerability CVE-2026-110872 affects version 10.0.7 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.7", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.7" } } ], "timestamp": "2026-11-03T14:36:48.497569+00:00", "status_notes": "Vulnerability CVE-2026-121424 affects version 10.0.7 of nodemailer.", "vulnerability": { "name": "CVE-2026-121424" }, "action_statement": "Vulnerability CVE-2026-121424 affects version 10.0.7 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.7", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.7" } } ], "timestamp": "2026-11-03T14:36:48.497569+00:00", "status_notes": "Vulnerability CVE-2026-121425 affects version 10.0.7 of nodemailer.", "vulnerability": { "name": "CVE-2026-121425" }, "action_statement": "Vulnerability CVE-2026-121425 affects version 10.0.7 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.7", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.7" } } ], "timestamp": "2026-11-03T14:36:48.497569+00:00", "status_notes": "Vulnerability CVE-2026-121426 affects version 10.0.7 of nodemailer.", "vulnerability": { "name": "CVE-2026-121426" }, "action_statement": "Vulnerability CVE-2026-121426 affects version 10.0.7 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.7", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.7" } } ], "timestamp": "2026-11-10T15:30:00.075367+00:00", "status_notes": "Vulnerability CVE-2026-125755 affects version 10.0.7 of nodemailer.", "vulnerability": { "name": "CVE-2026-125755" }, "action_statement": "Vulnerability CVE-2026-125755 affects version 10.0.7 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.7", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.7" } } ], "timestamp": "2026-11-13T22:31:00.045181+00:00", "status_notes": "Vulnerability CVE-2026-82659 does not affect version 10.0.7 of nodemailer. not_affected \u2014 Target 10.0.7 already contains the upstream fix (a82e060d, \"enforce disableFileAccess/disableUrlAccess for raw message option\"). MailComposer.compile() passes disableUrlAccess and disableFileAccess to the raw root MimeNode. MimeNode._getStream also checks the flags along the whole parent chain. The fix shipped in the upstream release, so this is not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-82659" }, "impact_statement": "not_affected \u2014 Target 10.0.7 already contains the upstream fix (a82e060d, \"enforce disableFileAccess/disableUrlAccess for raw message option\"). MailComposer.compile() passes disableUrlAccess and disableFileAccess to the raw root MimeNode. MimeNode._getStream also checks the flags along the whole parent chain. The fix shipped in the upstream release, so this is not a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.7", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.7" } } ], "timestamp": "2026-11-13T23:17:57.275732+00:00", "status_notes": "Vulnerability CVE-2026-82662 does not affect version 10.0.7 of nodemailer. not_affected \u2014 Target nodemailer 10.0.7 is not affected. Its internal fetch client (src/fetch/index.ts) validates TLS certificates by default (rejectUnauthorized: true), and the OAuth2 token request path pins strict validation. The upstream fix (833d6e5, author andris@reinman.eu) is an ancestor of HEAD, and HEAD carries no TuxCare-authored commit, so this is an upstream-shipped fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-82662" }, "impact_statement": "not_affected \u2014 Target nodemailer 10.0.7 is not affected. Its internal fetch client (src/fetch/index.ts) validates TLS certificates by default (rejectUnauthorized: true), and the OAuth2 token request path pins strict validation. The upstream fix (833d6e5, author andris@reinman.eu) is an ancestor of HEAD, and HEAD carries no TuxCare-authored commit, so this is an upstream-shipped fix." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.7", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.7" } } ], "timestamp": "2026-11-13T23:28:00.053366+00:00", "status_notes": "Vulnerability CVE-2026-82854 does not affect version 10.0.7 of nodemailer. not_affected \u2014 Nodemailer 10.0.7 already contains the upstream fix for CVE-2026-82854. In src/smtp-connection/index.ts, envelope.size is coerced with Number() before it is placed in the MAIL FROM command, so CRLF cannot reach the SMTP stream. The fix was written by the upstream author and shipped in the upstream release that TuxCare onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-82854" }, "impact_statement": "not_affected \u2014 Nodemailer 10.0.7 already contains the upstream fix for CVE-2026-82854. In src/smtp-connection/index.ts, envelope.size is coerced with Number() before it is placed in the MAIL FROM command, so CRLF cannot reach the SMTP stream. The fix was written by the upstream author and shipped in the upstream release that TuxCare onboarded." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.7", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.7" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2026-90776 affects version 10.0.7 of nodemailer.", "vulnerability": { "name": "CVE-2026-90776" }, "action_statement": "Vulnerability CVE-2026-90776 affects version 10.0.7 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.7", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.7" } } ], "timestamp": "2026-11-13T22:17:00.046957+00:00", "status_notes": "Vulnerability GHSA-268h-hp4c-crq3 does not affect version 10.0.7 of nodemailer. not_affected \u2014 Target nodemailer 10.0.7 already contains the upstream fix for GHSA-268h-hp4c-crq3. In src/mailer/mail-message.ts, _getListHeaders strips CR/LF from list.*.comment before building the prepared List-* header value. The fix commit 5f69497 is by upstream author Andris Reinman and is part of the upstream 10.0.7 release, before the only TuxCare commit (ac76748, build config).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-268h-hp4c-crq3" }, "impact_statement": "not_affected \u2014 Target nodemailer 10.0.7 already contains the upstream fix for GHSA-268h-hp4c-crq3. In src/mailer/mail-message.ts, _getListHeaders strips CR/LF from list.*.comment before building the prepared List-* header value. The fix commit 5f69497 is by upstream author Andris Reinman and is part of the upstream 10.0.7 release, before the only TuxCare commit (ac76748, build config)." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.7", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.7" } } ], "timestamp": "2026-11-13T22:42:00.042020+00:00", "status_notes": "Vulnerability GHSA-2x7j-588g-ccc2 does not affect version 10.0.7 of nodemailer. not_affected \u2014 Target is nodemailer 10.0.7 (TypeScript sources under src/). It already contains the upstream fixes for GHSA-2x7j-588g-ccc2: the addressparser accumulator, the display-name merge loop and the recipient dedupe are all linear, and a maxRecipients cap exists. The fixes were shipped in the upstream release and no TuxCare-domain commit exists in history.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-2x7j-588g-ccc2" }, "impact_statement": "not_affected \u2014 Target is nodemailer 10.0.7 (TypeScript sources under src/). It already contains the upstream fixes for GHSA-2x7j-588g-ccc2: the addressparser accumulator, the display-name merge loop and the recipient dedupe are all linear, and a maxRecipients cap exists. The fixes were shipped in the upstream release and no TuxCare-domain commit exists in history." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.7", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.7" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-46j5-6fg5-4gv3 is a false positive for nodemailer 10.0.7.", "vulnerability": { "name": "GHSA-46j5-6fg5-4gv3" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.7", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.7" } } ], "timestamp": "2026-10-27T15:13:32.414812+00:00", "status_notes": "Vulnerability GHSA-4ffr-jq9g-5ffx affects version 10.0.7 of nodemailer.", "vulnerability": { "name": "GHSA-4ffr-jq9g-5ffx" }, "action_statement": "Vulnerability GHSA-4ffr-jq9g-5ffx affects version 10.0.7 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.7", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.7" } } ], "timestamp": "2026-10-27T15:13:32.414812+00:00", "status_notes": "Vulnerability GHSA-4g23-2xm8-66gc affects version 10.0.7 of nodemailer.", "vulnerability": { "name": "GHSA-4g23-2xm8-66gc" }, "action_statement": "Vulnerability GHSA-4g23-2xm8-66gc affects version 10.0.7 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.7", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.7" } } ], "timestamp": "2026-11-13T23:48:43.538332+00:00", "status_notes": "Vulnerability GHSA-6vj9-mwq6-2f5v does not affect version 10.0.7 of nodemailer. not_affected \u2014 Target (nodemailer 10.0.7) already contains the upstream fix a6512db \"keep the TLS server name out of the DNS cache\". The DNS cache stores only addresses; servername is computed per call from the current options. The fix shipped in the upstream release and is not TuxCare-authored.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-6vj9-mwq6-2f5v" }, "impact_statement": "not_affected \u2014 Target (nodemailer 10.0.7) already contains the upstream fix a6512db \"keep the TLS server name out of the DNS cache\". The DNS cache stores only addresses; servername is computed per call from the current options. The fix shipped in the upstream release and is not TuxCare-authored." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.7", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.7" } } ], "timestamp": "2026-10-23T22:01:00.144162+00:00", "status_notes": "Vulnerability GHSA-85x2-q946-cp5h affects version 10.0.7 of nodemailer.", "vulnerability": { "name": "GHSA-85x2-q946-cp5h" }, "action_statement": "Vulnerability GHSA-85x2-q946-cp5h affects version 10.0.7 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.7", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.7" } } ], "timestamp": "2026-10-23T22:01:00.144162+00:00", "status_notes": "Vulnerability GHSA-8c8m-p3m8-cjg8 affects version 10.0.7 of nodemailer.", "vulnerability": { "name": "GHSA-8c8m-p3m8-cjg8" }, "action_statement": "Vulnerability GHSA-8c8m-p3m8-cjg8 affects version 10.0.7 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.7", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.7" } } ], "timestamp": "2026-11-13T22:32:00.034202+00:00", "status_notes": "Vulnerability GHSA-8m3c-c648-2xjj does not affect version 10.0.7 of nodemailer. not_affected \u2014 Target nodemailer 10.0.7 is not affected. MailMessage.resolveContent in src/mailer/mail-message.ts applies the message-level disableFileAccess/disableUrlAccess flags when the legacy 3-argument signature is used. The upstream fix commits (dc48ed3, ab7ef34, 262d550, all by andris@reinman.eu) are ancestors of HEAD. HEAD has no TuxCare-domain commit, so this is an upstream fix shipped in the release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-8m3c-c648-2xjj" }, "impact_statement": "not_affected \u2014 Target nodemailer 10.0.7 is not affected. MailMessage.resolveContent in src/mailer/mail-message.ts applies the message-level disableFileAccess/disableUrlAccess flags when the legacy 3-argument signature is used. The upstream fix commits (dc48ed3, ab7ef34, 262d550, all by andris@reinman.eu) are ancestors of HEAD. HEAD has no TuxCare-domain commit, so this is an upstream fix shipped in the release." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.7", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.7" } } ], "timestamp": "2026-11-13T23:52:21.958941+00:00", "status_notes": "Vulnerability GHSA-8vvx-rff5-p5rq does not affect version 10.0.7 of nodemailer. not_affected \u2014 Target nodemailer 10.0.7 already contains the upstream fix for GHSA-8vvx-rff5-p5rq. MimeNode._parseAddresses() flattens nested recipient arrays iteratively with an explicit stack and a WeakSet, and only scalars or address objects reach addressparser(). The fix is upstream commit ebe0849 (\"fix(mime-node): flatten nested recipient arrays without recursion\"), authored by andris@reinman.eu, and it ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-8vvx-rff5-p5rq" }, "impact_statement": "not_affected \u2014 Target nodemailer 10.0.7 already contains the upstream fix for GHSA-8vvx-rff5-p5rq. MimeNode._parseAddresses() flattens nested recipient arrays iteratively with an explicit stack and a WeakSet, and only scalars or address objects reach addressparser(). The fix is upstream commit ebe0849 (\"fix(mime-node): flatten nested recipient arrays without recursion\"), authored by andris@reinman.eu, and it ..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.7", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.7" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-9h6g-pr28-7cqp affects version 10.0.7 of nodemailer.", "vulnerability": { "name": "GHSA-9h6g-pr28-7cqp" }, "action_statement": "Vulnerability GHSA-9h6g-pr28-7cqp affects version 10.0.7 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.7", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.7" } } ], "timestamp": "2026-11-13T22:08:24.214185+00:00", "status_notes": "Vulnerability GHSA-c7w3-x93f-qmm8 does not affect version 10.0.7 of nodemailer. not_affected \u2014 Target nodemailer 10.0.7 already contains the upstream fix (commit 2d7b971, \"fix: sanitize envelope size to prevent SMTP command injection\"). In src/smtp-connection/index.ts the envelope.size value is coerced with Number() and only emitted as SIZE= when positive, so CRLF cannot reach the MAIL FROM command. The fix is upstream-authored and no TuxCare commit exists in HEAD's history.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-c7w3-x93f-qmm8" }, "impact_statement": "not_affected \u2014 Target nodemailer 10.0.7 already contains the upstream fix (commit 2d7b971, \"fix: sanitize envelope size to prevent SMTP command injection\"). In src/smtp-connection/index.ts the envelope.size value is coerced with Number() and only emitted as SIZE= when positive, so CRLF cannot reach the MAIL FROM command. The fix is upstream-authored and no TuxCare commit exists in HEAD's history." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.7", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.7" } } ], "timestamp": "2026-11-13T22:57:00.061178+00:00", "status_notes": "Vulnerability GHSA-cc9r-2j5m-2m83 does not affect version 10.0.7 of nodemailer. not_affected \u2014 Nodemailer 10.0.7 already contains the GHSA-cc9r-2j5m-2m83 fix. In src/addressparser/index.ts, _handleAddress no longer concatenates tokens across a comment-closing ')'. It joins only when one side carries the '@'. user@good-corp.com(x)evil.com therefore yields user@good-corp.com. The fix shipped in the upstream release (the TypeScript migration commit f7cbf83, author andris@reinman.eu). HEAD h...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-cc9r-2j5m-2m83" }, "impact_statement": "not_affected \u2014 Nodemailer 10.0.7 already contains the GHSA-cc9r-2j5m-2m83 fix. In src/addressparser/index.ts, _handleAddress no longer concatenates tokens across a comment-closing ')'. It joins only when one side carries the '@'. user@good-corp.com(x)evil.com therefore yields user@good-corp.com. The fix shipped in the upstream release (the TypeScript migration commit f7cbf83, author andris@reinman.eu). HEAD h..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.7", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.7" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-frj6-5rhh-vwfw is a false positive for nodemailer 10.0.7.", "vulnerability": { "name": "GHSA-frj6-5rhh-vwfw" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.7", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.7" } } ], "timestamp": "2026-09-29T23:56:00.225781+00:00", "status_notes": "Vulnerability GHSA-g57g-f23g-4646 affects version 10.0.7 of nodemailer.", "vulnerability": { "name": "GHSA-g57g-f23g-4646" }, "action_statement": "Vulnerability GHSA-g57g-f23g-4646 affects version 10.0.7 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.7", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.7" } } ], "timestamp": "2026-10-27T15:13:36.008785+00:00", "status_notes": "Vulnerability GHSA-g73g-hqqh-jr95 affects version 10.0.7 of nodemailer.", "vulnerability": { "name": "GHSA-g73g-hqqh-jr95" }, "action_statement": "Vulnerability GHSA-g73g-hqqh-jr95 affects version 10.0.7 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.7", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.7" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-h3hj-cmcx-xc66 is a false positive for nodemailer 10.0.7.", "vulnerability": { "name": "GHSA-h3hj-cmcx-xc66" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.7", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.7" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-jj37-3377-m6vv is a false positive for nodemailer 10.0.7.", "vulnerability": { "name": "GHSA-jj37-3377-m6vv" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.7", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.7" } } ], "timestamp": "2026-10-23T22:01:49.029239+00:00", "status_notes": "Vulnerability GHSA-m943-m63m-w62w affects version 10.0.7 of nodemailer.", "vulnerability": { "name": "GHSA-m943-m63m-w62w" }, "action_statement": "Vulnerability GHSA-m943-m63m-w62w affects version 10.0.7 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.7", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.7" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-v53p-9fqp-m79j affects version 10.0.7 of nodemailer.", "vulnerability": { "name": "GHSA-v53p-9fqp-m79j" }, "action_statement": "Vulnerability GHSA-v53p-9fqp-m79j affects version 10.0.7 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.7", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.7" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-vm5r-23w9-m8hx is a false positive for nodemailer 10.0.7.", "vulnerability": { "name": "GHSA-vm5r-23w9-m8hx" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.7", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.7" } } ], "timestamp": "2026-11-13T22:09:32.764375+00:00", "status_notes": "Vulnerability GHSA-vvjj-xcjg-gr5g does not affect version 10.0.7 of nodemailer. not_affected \u2014 Target (nodemailer 10.0.7, TypeScript source) already strips CR/LF from the SMTP client `name` option in the SmtpConnection constructor, so EHLO/HELO/LHLO cannot be CRLF-injected. The fix shipped in the upstream release (f7cbf83, author andris@reinman.eu). No TuxCare-domain commit exists in HEAD's history, so this is an upstream fix and not TuxCare-attributed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-vvjj-xcjg-gr5g" }, "impact_statement": "not_affected \u2014 Target (nodemailer 10.0.7, TypeScript source) already strips CR/LF from the SMTP client `name` option in the SmtpConnection constructor, so EHLO/HELO/LHLO cannot be CRLF-injected. The fix shipped in the upstream release (f7cbf83, author andris@reinman.eu). No TuxCare-domain commit exists in HEAD's history, so this is an upstream fix and not TuxCare-attributed." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.7", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.7" } } ], "timestamp": "2026-11-13T22:58:00.049762+00:00", "status_notes": "Vulnerability GHSA-wmmp-3585-3rmp does not affect version 10.0.7 of nodemailer. not_affected \u2014 Target 10.0.7 already contains both upstream fixes for GHSA-wmmp-3585-3rmp: 259c32d (UTS-46 mapping via url.domainToASCII/domainToUnicode in domain encoding) and b212ac4 (URL-parser-unsafe characters kept away from the mapper). Both commits are ancestors of HEAD, authored by the upstream maintainer, and shipped in the upstream release before the only non-upstream commit (an automation tuxcare.y...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wmmp-3585-3rmp" }, "impact_statement": "not_affected \u2014 Target 10.0.7 already contains both upstream fixes for GHSA-wmmp-3585-3rmp: 259c32d (UTS-46 mapping via url.domainToASCII/domainToUnicode in domain encoding) and b212ac4 (URL-parser-unsafe characters kept away from the mapper). Both commits are ancestors of HEAD, authored by the upstream maintainer, and shipped in the upstream release before the only non-upstream commit (an automation tuxcare.y..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.7", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.7" } } ], "timestamp": "2026-11-13T22:14:17.313956+00:00", "status_notes": "Vulnerability GHSA-wqvq-jvpq-h66f does not affect version 10.0.7 of nodemailer. not_affected \u2014 Nodemailer 10.0.7 already contains the upstream fix for GHSA-wqvq-jvpq-h66f. shared.resolveContent() now takes an access policy and rejects URL and file references with EURLACCESS / EFILEACCESS. The jsonTransport path (resolveAll) and the attachDataUrls path (_convertDataImages) both pass the policy. The fix is upstream commit 5f694977 by Andris Reinman, an ancestor of HEAD and shipped in the u...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wqvq-jvpq-h66f" }, "impact_statement": "not_affected \u2014 Nodemailer 10.0.7 already contains the upstream fix for GHSA-wqvq-jvpq-h66f. shared.resolveContent() now takes an access policy and rejects URL and file references with EURLACCESS / EFILEACCESS. The jsonTransport path (resolveAll) and the attachDataUrls path (_convertDataImages) both pass the policy. The fix is upstream commit 5f694977 by Andris Reinman, an ancestor of HEAD and shipped in the u..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@10.0.7", "identifiers": { "purl": "pkg:npm/nodemailer@10.0.7" } } ], "timestamp": "2026-10-22T17:05:00.556684+00:00", "status_notes": "Vulnerability GHSA-wxxx-r42m-9rp8 is a false positive for nodemailer 10.0.7.", "vulnerability": { "name": "GHSA-wxxx-r42m-9rp8" }, "impact_statement": "The vulnerability has been withdrawn." } ] }