{
  "@id": "urn:uuid:fe5b253a-731b-415b-b008-70cdd5a6793d",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 28,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-12T12:05:00.038805+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@6.10.1",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@6.10.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2020-7769 affects version 6.10.1 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2020-7769"
      },
      "action_statement": "Vulnerability CVE-2020-7769 affects version 6.10.1 of nodemailer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@6.10.1",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@6.10.1"
          }
        }
      ],
      "timestamp": "2026-11-03T17:15:39.453186+00:00",
      "status_notes": "Vulnerability CVE-2021-23400 does not affect version 6.10.1 of nodemailer. not_affected \u2014 CVE-2021-23400 affects nodemailer before 6.6.1 due to missing sanitization of control characters (newlines, carriage returns) in email address fields, allowing HTTP Header Injection. The target is nodemailer 6.10.1-tuxcare.17. The fix (`.replace(/[\\x00-\\x1F<>]+/g, ' ')` in `_normalizeAddress` method at lib/mime-node/index.js:1331) was authored by upstream maintainer Andris Reinman in commit 7e0...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2021-23400"
      },
      "impact_statement": "not_affected \u2014 CVE-2021-23400 affects nodemailer before 6.6.1 due to missing sanitization of control characters (newlines, carriage returns) in email address fields, allowing HTTP Header Injection. The target is nodemailer 6.10.1-tuxcare.17. The fix (`.replace(/[\\x00-\\x1F<>]+/g, ' ')` in `_normalizeAddress` method at lib/mime-node/index.js:1331) was authored by upstream maintainer Andris Reinman in commit 7e0..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@6.10.1",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@6.10.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-13033 affects version 6.10.1 of nodemailer, and is fixed in 6.10.1-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2025-13033"
      },
      "action_statement": "Vulnerability CVE-2025-13033 affects version 6.10.1 of nodemailer, and is fixed in 6.10.1-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@6.10.1",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@6.10.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-14874 affects version 6.10.1 of nodemailer, and is fixed in 6.10.1-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2025-14874"
      },
      "action_statement": "Vulnerability CVE-2025-14874 affects version 6.10.1 of nodemailer, and is fixed in 6.10.1-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@6.10.1",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@6.10.1"
          }
        }
      ],
      "timestamp": "2026-10-31T12:29:18.792550+00:00",
      "status_notes": "Vulnerability CVE-2026-110869 affects version 6.10.1 of nodemailer, and is fixed in 6.10.1-tuxcare.17.",
      "vulnerability": {
        "name": "CVE-2026-110869"
      },
      "action_statement": "Vulnerability CVE-2026-110869 affects version 6.10.1 of nodemailer, and is fixed in 6.10.1-tuxcare.17."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@6.10.1",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@6.10.1"
          }
        }
      ],
      "timestamp": "2026-10-31T12:29:18.792550+00:00",
      "status_notes": "Vulnerability CVE-2026-110870 affects version 6.10.1 of nodemailer, and is fixed in 6.10.1-tuxcare.17.",
      "vulnerability": {
        "name": "CVE-2026-110870"
      },
      "action_statement": "Vulnerability CVE-2026-110870 affects version 6.10.1 of nodemailer, and is fixed in 6.10.1-tuxcare.17."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@6.10.1",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@6.10.1"
          }
        }
      ],
      "timestamp": "2026-10-21T09:32:00.286743+00:00",
      "status_notes": "Vulnerability CVE-2026-110871 affects version 6.10.1 of nodemailer, and is fixed in 6.10.1-tuxcare.14.",
      "vulnerability": {
        "name": "CVE-2026-110871"
      },
      "action_statement": "Vulnerability CVE-2026-110871 affects version 6.10.1 of nodemailer, and is fixed in 6.10.1-tuxcare.14."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@6.10.1",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@6.10.1"
          }
        }
      ],
      "timestamp": "2026-10-28T10:34:37.412471+00:00",
      "status_notes": "Vulnerability CVE-2026-110872 affects version 6.10.1 of nodemailer, and is fixed in 6.10.1-tuxcare.16.",
      "vulnerability": {
        "name": "CVE-2026-110872"
      },
      "action_statement": "Vulnerability CVE-2026-110872 affects version 6.10.1 of nodemailer, and is fixed in 6.10.1-tuxcare.16."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@6.10.1",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@6.10.1"
          }
        }
      ],
      "timestamp": "2026-11-07T16:43:00.061075+00:00",
      "status_notes": "Vulnerability CVE-2026-121424 affects version 6.10.1 of nodemailer, and is fixed in 6.10.1-tuxcare.15.",
      "vulnerability": {
        "name": "CVE-2026-121424"
      },
      "action_statement": "Vulnerability CVE-2026-121424 affects version 6.10.1 of nodemailer, and is fixed in 6.10.1-tuxcare.15."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@6.10.1",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@6.10.1"
          }
        }
      ],
      "timestamp": "2026-11-07T16:43:00.061075+00:00",
      "status_notes": "Vulnerability CVE-2026-121425 affects version 6.10.1 of nodemailer, and is fixed in 6.10.1-tuxcare.15.",
      "vulnerability": {
        "name": "CVE-2026-121425"
      },
      "action_statement": "Vulnerability CVE-2026-121425 affects version 6.10.1 of nodemailer, and is fixed in 6.10.1-tuxcare.15."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@6.10.1",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@6.10.1"
          }
        }
      ],
      "timestamp": "2026-11-07T16:43:00.061075+00:00",
      "status_notes": "Vulnerability CVE-2026-121426 affects version 6.10.1 of nodemailer, and is fixed in 6.10.1-tuxcare.15.",
      "vulnerability": {
        "name": "CVE-2026-121426"
      },
      "action_statement": "Vulnerability CVE-2026-121426 affects version 6.10.1 of nodemailer, and is fixed in 6.10.1-tuxcare.15."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@6.10.1",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@6.10.1"
          }
        }
      ],
      "timestamp": "2026-11-12T12:05:00.038805+00:00",
      "status_notes": "Vulnerability CVE-2026-125755 affects version 6.10.1 of nodemailer, and is fixed in 6.10.1-tuxcare.19.",
      "vulnerability": {
        "name": "CVE-2026-125755"
      },
      "action_statement": "Vulnerability CVE-2026-125755 affects version 6.10.1 of nodemailer, and is fixed in 6.10.1-tuxcare.19."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@6.10.1",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@6.10.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-82659 affects version 6.10.1 of nodemailer, and is fixed in 6.10.1-tuxcare.9.",
      "vulnerability": {
        "name": "CVE-2026-82659"
      },
      "action_statement": "Vulnerability CVE-2026-82659 affects version 6.10.1 of nodemailer, and is fixed in 6.10.1-tuxcare.9."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@6.10.1",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@6.10.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-82660 affects version 6.10.1 of nodemailer, and is fixed in 6.10.1-tuxcare.9.",
      "vulnerability": {
        "name": "CVE-2026-82660"
      },
      "action_statement": "Vulnerability CVE-2026-82660 affects version 6.10.1 of nodemailer, and is fixed in 6.10.1-tuxcare.9."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@6.10.1",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@6.10.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-82661 affects version 6.10.1 of nodemailer, and is fixed in 6.10.1-tuxcare.9.",
      "vulnerability": {
        "name": "CVE-2026-82661"
      },
      "action_statement": "Vulnerability CVE-2026-82661 affects version 6.10.1 of nodemailer, and is fixed in 6.10.1-tuxcare.9."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@6.10.1",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@6.10.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-82662 affects version 6.10.1 of nodemailer, and is fixed in 6.10.1-tuxcare.9.",
      "vulnerability": {
        "name": "CVE-2026-82662"
      },
      "action_statement": "Vulnerability CVE-2026-82662 affects version 6.10.1 of nodemailer, and is fixed in 6.10.1-tuxcare.9."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@6.10.1",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@6.10.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-82853 affects version 6.10.1 of nodemailer, and is fixed in 6.10.1-tuxcare.9.",
      "vulnerability": {
        "name": "CVE-2026-82853"
      },
      "action_statement": "Vulnerability CVE-2026-82853 affects version 6.10.1 of nodemailer, and is fixed in 6.10.1-tuxcare.9."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@6.10.1",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@6.10.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-82854 affects version 6.10.1 of nodemailer, and is fixed in 6.10.1-tuxcare.9.",
      "vulnerability": {
        "name": "CVE-2026-82854"
      },
      "action_statement": "Vulnerability CVE-2026-82854 affects version 6.10.1 of nodemailer, and is fixed in 6.10.1-tuxcare.9."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@6.10.1",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@6.10.1"
          }
        }
      ],
      "timestamp": "2026-11-12T12:05:00.038805+00:00",
      "status_notes": "Vulnerability CVE-2026-90776 affects version 6.10.1 of nodemailer, and is fixed in 6.10.1-tuxcare.19.",
      "vulnerability": {
        "name": "CVE-2026-90776"
      },
      "action_statement": "Vulnerability CVE-2026-90776 affects version 6.10.1 of nodemailer, and is fixed in 6.10.1-tuxcare.19."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@6.10.1",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@6.10.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-92595 affects version 6.10.1 of nodemailer, and is fixed in 6.10.1-tuxcare.10.",
      "vulnerability": {
        "name": "CVE-2026-92595"
      },
      "action_statement": "Vulnerability CVE-2026-92595 affects version 6.10.1 of nodemailer, and is fixed in 6.10.1-tuxcare.10."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@6.10.1",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@6.10.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-268h-hp4c-crq3 affects version 6.10.1 of nodemailer, and is fixed in 6.10.1-tuxcare.8.",
      "vulnerability": {
        "name": "GHSA-268h-hp4c-crq3"
      },
      "action_statement": "Vulnerability GHSA-268h-hp4c-crq3 affects version 6.10.1 of nodemailer, and is fixed in 6.10.1-tuxcare.8."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@6.10.1",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@6.10.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-2x7j-588g-ccc2 affects version 6.10.1 of nodemailer, and is fixed in 6.10.1-tuxcare.8.",
      "vulnerability": {
        "name": "GHSA-2x7j-588g-ccc2"
      },
      "action_statement": "Vulnerability GHSA-2x7j-588g-ccc2 affects version 6.10.1 of nodemailer, and is fixed in 6.10.1-tuxcare.8."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@6.10.1",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@6.10.1"
          }
        }
      ],
      "timestamp": "2026-10-20T12:46:51.138394+00:00",
      "status_notes": "Vulnerability GHSA-46j5-6fg5-4gv3 is a false positive for nodemailer 6.10.1.",
      "vulnerability": {
        "name": "GHSA-46j5-6fg5-4gv3"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@6.10.1",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@6.10.1"
          }
        }
      ],
      "timestamp": "2026-10-27T15:13:32.414812+00:00",
      "status_notes": "Vulnerability GHSA-4ffr-jq9g-5ffx affects version 6.10.1 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-4ffr-jq9g-5ffx"
      },
      "action_statement": "Vulnerability GHSA-4ffr-jq9g-5ffx affects version 6.10.1 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@6.10.1",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@6.10.1"
          }
        }
      ],
      "timestamp": "2026-10-27T15:13:32.414812+00:00",
      "status_notes": "Vulnerability GHSA-4g23-2xm8-66gc affects version 6.10.1 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-4g23-2xm8-66gc"
      },
      "action_statement": "Vulnerability GHSA-4g23-2xm8-66gc affects version 6.10.1 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@6.10.1",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@6.10.1"
          }
        }
      ],
      "timestamp": "2026-09-29T10:15:52.863462+00:00",
      "status_notes": "Vulnerability GHSA-6vj9-mwq6-2f5v affects version 6.10.1 of nodemailer, and is fixed in 6.10.1-tuxcare.11.",
      "vulnerability": {
        "name": "GHSA-6vj9-mwq6-2f5v"
      },
      "action_statement": "Vulnerability GHSA-6vj9-mwq6-2f5v affects version 6.10.1 of nodemailer, and is fixed in 6.10.1-tuxcare.11."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@6.10.1",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@6.10.1"
          }
        }
      ],
      "timestamp": "2026-10-27T12:07:20.175688+00:00",
      "status_notes": "Vulnerability GHSA-85x2-q946-cp5h affects version 6.10.1 of nodemailer, and is fixed in 6.10.1-tuxcare.15.",
      "vulnerability": {
        "name": "GHSA-85x2-q946-cp5h"
      },
      "action_statement": "Vulnerability GHSA-85x2-q946-cp5h affects version 6.10.1 of nodemailer, and is fixed in 6.10.1-tuxcare.15."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@6.10.1",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@6.10.1"
          }
        }
      ],
      "timestamp": "2026-10-27T12:07:20.175688+00:00",
      "status_notes": "Vulnerability GHSA-8c8m-p3m8-cjg8 affects version 6.10.1 of nodemailer, and is fixed in 6.10.1-tuxcare.15.",
      "vulnerability": {
        "name": "GHSA-8c8m-p3m8-cjg8"
      },
      "action_statement": "Vulnerability GHSA-8c8m-p3m8-cjg8 affects version 6.10.1 of nodemailer, and is fixed in 6.10.1-tuxcare.15."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@6.10.1",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@6.10.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-8m3c-c648-2xjj affects version 6.10.1 of nodemailer, and is fixed in 6.10.1-tuxcare.10.",
      "vulnerability": {
        "name": "GHSA-8m3c-c648-2xjj"
      },
      "action_statement": "Vulnerability GHSA-8m3c-c648-2xjj affects version 6.10.1 of nodemailer, and is fixed in 6.10.1-tuxcare.10."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@6.10.1",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@6.10.1"
          }
        }
      ],
      "timestamp": "2026-09-30T21:22:27.434104+00:00",
      "status_notes": "Vulnerability GHSA-8vvx-rff5-p5rq affects version 6.10.1 of nodemailer, and is fixed in 6.10.1-tuxcare.12.",
      "vulnerability": {
        "name": "GHSA-8vvx-rff5-p5rq"
      },
      "action_statement": "Vulnerability GHSA-8vvx-rff5-p5rq affects version 6.10.1 of nodemailer, and is fixed in 6.10.1-tuxcare.12."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@6.10.1",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@6.10.1"
          }
        }
      ],
      "timestamp": "2026-11-03T17:27:08.566682+00:00",
      "status_notes": "Vulnerability GHSA-9h6g-pr28-7cqp does not affect version 6.10.1 of nodemailer. not_affected \u2014 The target repository nodemailer version 6.10.1-tuxcare.17 is NOT AFFECTED by GHSA-9h6g-pr28-7cqp. The ReDoS vulnerability described in the CVE was already fixed in the upstream release before TuxCare onboarded this version. The vulnerable regex patterns with unbounded quantifiers have been replaced with either bounded quantifiers or safe string-based parsing functions. Fix commits (dd8f5e8a, 1...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-9h6g-pr28-7cqp"
      },
      "impact_statement": "not_affected \u2014 The target repository nodemailer version 6.10.1-tuxcare.17 is NOT AFFECTED by GHSA-9h6g-pr28-7cqp. The ReDoS vulnerability described in the CVE was already fixed in the upstream release before TuxCare onboarded this version. The vulnerable regex patterns with unbounded quantifiers have been replaced with either bounded quantifiers or safe string-based parsing functions. Fix commits (dd8f5e8a, 1..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@6.10.1",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@6.10.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-c7w3-x93f-qmm8 affects version 6.10.1 of nodemailer, and is fixed in 6.10.1-tuxcare.6.",
      "vulnerability": {
        "name": "GHSA-c7w3-x93f-qmm8"
      },
      "action_statement": "Vulnerability GHSA-c7w3-x93f-qmm8 affects version 6.10.1 of nodemailer, and is fixed in 6.10.1-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@6.10.1",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@6.10.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-cc9r-2j5m-2m83 affects version 6.10.1 of nodemailer, and is fixed in 6.10.1-tuxcare.8.",
      "vulnerability": {
        "name": "GHSA-cc9r-2j5m-2m83"
      },
      "action_statement": "Vulnerability GHSA-cc9r-2j5m-2m83 affects version 6.10.1 of nodemailer, and is fixed in 6.10.1-tuxcare.8."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@6.10.1",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@6.10.1"
          }
        }
      ],
      "timestamp": "2026-10-20T12:46:51.138394+00:00",
      "status_notes": "Vulnerability GHSA-frj6-5rhh-vwfw is a false positive for nodemailer 6.10.1.",
      "vulnerability": {
        "name": "GHSA-frj6-5rhh-vwfw"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@6.10.1",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@6.10.1"
          }
        }
      ],
      "timestamp": "2026-11-05T13:44:00.103481+00:00",
      "status_notes": "Vulnerability GHSA-g57g-f23g-4646 affects version 6.10.1 of nodemailer, and is fixed in 6.10.1-tuxcare.18.",
      "vulnerability": {
        "name": "GHSA-g57g-f23g-4646"
      },
      "action_statement": "Vulnerability GHSA-g57g-f23g-4646 affects version 6.10.1 of nodemailer, and is fixed in 6.10.1-tuxcare.18."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@6.10.1",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@6.10.1"
          }
        }
      ],
      "timestamp": "2026-10-27T15:13:32.414812+00:00",
      "status_notes": "Vulnerability GHSA-g73g-hqqh-jr95 affects version 6.10.1 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-g73g-hqqh-jr95"
      },
      "action_statement": "Vulnerability GHSA-g73g-hqqh-jr95 affects version 6.10.1 of nodemailer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@6.10.1",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@6.10.1"
          }
        }
      ],
      "timestamp": "2026-10-20T12:46:51.138394+00:00",
      "status_notes": "Vulnerability GHSA-h3hj-cmcx-xc66 is a false positive for nodemailer 6.10.1.",
      "vulnerability": {
        "name": "GHSA-h3hj-cmcx-xc66"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@6.10.1",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@6.10.1"
          }
        }
      ],
      "timestamp": "2026-10-20T12:46:51.138394+00:00",
      "status_notes": "Vulnerability GHSA-jj37-3377-m6vv is a false positive for nodemailer 6.10.1.",
      "vulnerability": {
        "name": "GHSA-jj37-3377-m6vv"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@6.10.1",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@6.10.1"
          }
        }
      ],
      "timestamp": "2026-10-27T12:07:20.175688+00:00",
      "status_notes": "Vulnerability GHSA-m943-m63m-w62w affects version 6.10.1 of nodemailer, and is fixed in 6.10.1-tuxcare.15.",
      "vulnerability": {
        "name": "GHSA-m943-m63m-w62w"
      },
      "action_statement": "Vulnerability GHSA-m943-m63m-w62w affects version 6.10.1 of nodemailer, and is fixed in 6.10.1-tuxcare.15."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@6.10.1",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@6.10.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-mm7p-fcc7-pg87 does not affect version 6.10.1 of nodemailer. already_fixed \u2014 The target repository (nodemailer 6.10.1-tuxcare.3) already contains the complete security fix for CVE-2025-13033/GHSA-mm7p-fcc7-pg87. The fix was backported by TuxCare on December 9, 2025 via commit 189d7aa. The vulnerability involved incorrect parsing of quoted local-parts containing @ symbols, which could cause email misrouting to attacker-controlled domains. The fix adds quote state trackin...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-mm7p-fcc7-pg87"
      },
      "impact_statement": "already_fixed \u2014 The target repository (nodemailer 6.10.1-tuxcare.3) already contains the complete security fix for CVE-2025-13033/GHSA-mm7p-fcc7-pg87. The fix was backported by TuxCare on December 9, 2025 via commit 189d7aa. The vulnerability involved incorrect parsing of quoted local-parts containing @ symbols, which could cause email misrouting to attacker-controlled domains. The fix adds quote state trackin..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@6.10.1",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@6.10.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-p6gq-j5cr-w38f affects version 6.10.1 of nodemailer, and is fixed in 6.10.1-tuxcare.5.",
      "vulnerability": {
        "name": "GHSA-p6gq-j5cr-w38f"
      },
      "action_statement": "Vulnerability GHSA-p6gq-j5cr-w38f affects version 6.10.1 of nodemailer, and is fixed in 6.10.1-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@6.10.1",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@6.10.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-r7g4-qg5f-qqm2 affects version 6.10.1 of nodemailer, and is fixed in 6.10.1-tuxcare.6.",
      "vulnerability": {
        "name": "GHSA-r7g4-qg5f-qqm2"
      },
      "action_statement": "Vulnerability GHSA-r7g4-qg5f-qqm2 affects version 6.10.1 of nodemailer, and is fixed in 6.10.1-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@6.10.1",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@6.10.1"
          }
        }
      ],
      "timestamp": "2026-10-02T10:34:58.463788+00:00",
      "status_notes": "Vulnerability GHSA-v53p-9fqp-m79j affects version 6.10.1 of nodemailer, and is fixed in 6.10.1-tuxcare.13.",
      "vulnerability": {
        "name": "GHSA-v53p-9fqp-m79j"
      },
      "action_statement": "Vulnerability GHSA-v53p-9fqp-m79j affects version 6.10.1 of nodemailer, and is fixed in 6.10.1-tuxcare.13."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@6.10.1",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@6.10.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-vm5r-23w9-m8hx is a false positive for nodemailer 6.10.1.",
      "vulnerability": {
        "name": "GHSA-vm5r-23w9-m8hx"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@6.10.1",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@6.10.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-vvjj-xcjg-gr5g affects version 6.10.1 of nodemailer, and is fixed in 6.10.1-tuxcare.4.",
      "vulnerability": {
        "name": "GHSA-vvjj-xcjg-gr5g"
      },
      "action_statement": "Vulnerability GHSA-vvjj-xcjg-gr5g affects version 6.10.1 of nodemailer, and is fixed in 6.10.1-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@6.10.1",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@6.10.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-wmmp-3585-3rmp affects version 6.10.1 of nodemailer, and is fixed in 6.10.1-tuxcare.8.",
      "vulnerability": {
        "name": "GHSA-wmmp-3585-3rmp"
      },
      "action_statement": "Vulnerability GHSA-wmmp-3585-3rmp affects version 6.10.1 of nodemailer, and is fixed in 6.10.1-tuxcare.8."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@6.10.1",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@6.10.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-wqvq-jvpq-h66f affects version 6.10.1 of nodemailer, and is fixed in 6.10.1-tuxcare.5.",
      "vulnerability": {
        "name": "GHSA-wqvq-jvpq-h66f"
      },
      "action_statement": "Vulnerability GHSA-wqvq-jvpq-h66f affects version 6.10.1 of nodemailer, and is fixed in 6.10.1-tuxcare.5."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@6.10.1",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@6.10.1"
          }
        }
      ],
      "timestamp": "2026-10-22T17:05:00.556684+00:00",
      "status_notes": "Vulnerability GHSA-wxxx-r42m-9rp8 is a false positive for nodemailer 6.10.1.",
      "vulnerability": {
        "name": "GHSA-wxxx-r42m-9rp8"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}