{
  "@id": "urn:uuid:91661530-ad2c-4531-b63a-79bb130b6ae3",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 23,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-13T23:27:00.042596+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.10",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.10"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2020-7769 affects version 8.0.10 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2020-7769"
      },
      "action_statement": "Vulnerability CVE-2020-7769 affects version 8.0.10 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.10",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.10"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2021-23400 affects version 8.0.10 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2021-23400"
      },
      "action_statement": "Vulnerability CVE-2021-23400 affects version 8.0.10 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.10",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.10"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2025-13033 affects version 8.0.10 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2025-13033"
      },
      "action_statement": "Vulnerability CVE-2025-13033 affects version 8.0.10 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.10",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.10"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2025-14874 affects version 8.0.10 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2025-14874"
      },
      "action_statement": "Vulnerability CVE-2025-14874 affects version 8.0.10 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.10",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.10"
          }
        }
      ],
      "timestamp": "2026-10-15T15:49:00.133726+00:00",
      "status_notes": "Vulnerability CVE-2026-110869 affects version 8.0.10 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-110869"
      },
      "action_statement": "Vulnerability CVE-2026-110869 affects version 8.0.10 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.10",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.10"
          }
        }
      ],
      "timestamp": "2026-10-26T15:35:33.946658+00:00",
      "status_notes": "Vulnerability CVE-2026-110870 affects version 8.0.10 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-110870"
      },
      "action_statement": "Vulnerability CVE-2026-110870 affects version 8.0.10 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.10",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.10"
          }
        }
      ],
      "timestamp": "2026-10-20T02:46:00.084729+00:00",
      "status_notes": "Vulnerability CVE-2026-110871 affects version 8.0.10 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-110871"
      },
      "action_statement": "Vulnerability CVE-2026-110871 affects version 8.0.10 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.10",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.10"
          }
        }
      ],
      "timestamp": "2026-10-15T14:51:00.186658+00:00",
      "status_notes": "Vulnerability CVE-2026-110872 affects version 8.0.10 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-110872"
      },
      "action_statement": "Vulnerability CVE-2026-110872 affects version 8.0.10 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.10",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.10"
          }
        }
      ],
      "timestamp": "2026-11-03T14:36:48.497569+00:00",
      "status_notes": "Vulnerability CVE-2026-121424 affects version 8.0.10 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-121424"
      },
      "action_statement": "Vulnerability CVE-2026-121424 affects version 8.0.10 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.10",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.10"
          }
        }
      ],
      "timestamp": "2026-11-03T14:36:48.497569+00:00",
      "status_notes": "Vulnerability CVE-2026-121425 affects version 8.0.10 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-121425"
      },
      "action_statement": "Vulnerability CVE-2026-121425 affects version 8.0.10 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.10",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.10"
          }
        }
      ],
      "timestamp": "2026-11-03T14:36:48.497569+00:00",
      "status_notes": "Vulnerability CVE-2026-121426 affects version 8.0.10 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-121426"
      },
      "action_statement": "Vulnerability CVE-2026-121426 affects version 8.0.10 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.10",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.10"
          }
        }
      ],
      "timestamp": "2026-11-10T15:29:32.523739+00:00",
      "status_notes": "Vulnerability CVE-2026-125755 affects version 8.0.10 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-125755"
      },
      "action_statement": "Vulnerability CVE-2026-125755 affects version 8.0.10 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.10",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.10"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-82659 affects version 8.0.10 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-82659"
      },
      "action_statement": "Vulnerability CVE-2026-82659 affects version 8.0.10 of nodemailer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.10",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.10"
          }
        }
      ],
      "timestamp": "2026-11-13T23:12:35.229146+00:00",
      "status_notes": "Vulnerability CVE-2026-82662 does not affect version 8.0.10 of nodemailer. not_affected \u2014 Nodemailer 8.0.10 already contains the upstream fix 833d6e58 (\"enforce strict TLS for OAuth2 and Ethereal credential requests\"), authored by Andris Reinman (upstream). The XOAuth2 token request now passes tls.rejectUnauthorized:true to the internal fetch client for HTTPS URLs, so a self-signed or invalid certificate on the token endpoint is rejected before credentials are sent. lib/fetch still ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-82662"
      },
      "impact_statement": "not_affected \u2014 Nodemailer 8.0.10 already contains the upstream fix 833d6e58 (\"enforce strict TLS for OAuth2 and Ethereal credential requests\"), authored by Andris Reinman (upstream). The XOAuth2 token request now passes tls.rejectUnauthorized:true to the internal fetch client for HTTPS URLs, so a self-signed or invalid certificate on the token endpoint is rejected before credentials are sent. lib/fetch still ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.10",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.10"
          }
        }
      ],
      "timestamp": "2026-11-13T23:27:00.042596+00:00",
      "status_notes": "Vulnerability CVE-2026-82854 does not affect version 8.0.10 of nodemailer. not_affected \u2014 Target nodemailer 8.0.10 already contains the upstream fix (commit 2d7b971, \"sanitize envelope size to prevent SMTP command injection\"). In lib/smtp-connection/index.js the envelope.size is coerced with Number() and only appended as SIZE=<number> when positive, so CRLF cannot reach the MAIL FROM line.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-82854"
      },
      "impact_statement": "not_affected \u2014 Target nodemailer 8.0.10 already contains the upstream fix (commit 2d7b971, \"sanitize envelope size to prevent SMTP command injection\"). In lib/smtp-connection/index.js the envelope.size is coerced with Number() and only appended as SIZE=<number> when positive, so CRLF cannot reach the MAIL FROM line."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.10",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.10"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2026-90776 affects version 8.0.10 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-90776"
      },
      "action_statement": "Vulnerability CVE-2026-90776 affects version 8.0.10 of nodemailer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.10",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.10"
          }
        }
      ],
      "timestamp": "2026-11-13T22:16:24.742318+00:00",
      "status_notes": "Vulnerability GHSA-268h-hp4c-crq3 does not affect version 8.0.10 of nodemailer. not_affected \u2014 Target is nodemailer 8.0.10. The List-* comment CRLF injection (GHSA-268h-hp4c-crq3) is already fixed by the upstream commit 5f694977 (shipped in release 8.0.9). _getListHeaders in lib/mailer/mail-message.js strips CR/LF from list.*.comment for List-ID and all other List-* headers before the prepared header value is built. The fix is upstream-authored and no TuxCare commit appears in HEAD's his...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-268h-hp4c-crq3"
      },
      "impact_statement": "not_affected \u2014 Target is nodemailer 8.0.10. The List-* comment CRLF injection (GHSA-268h-hp4c-crq3) is already fixed by the upstream commit 5f694977 (shipped in release 8.0.9). _getListHeaders in lib/mailer/mail-message.js strips CR/LF from list.*.comment for List-ID and all other List-* headers before the prepared header value is built. The fix is upstream-authored and no TuxCare commit appears in HEAD's his..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.10",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.10"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-2x7j-588g-ccc2 affects version 8.0.10 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-2x7j-588g-ccc2"
      },
      "action_statement": "Vulnerability GHSA-2x7j-588g-ccc2 affects version 8.0.10 of nodemailer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.10",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.10"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-46j5-6fg5-4gv3 is a false positive for nodemailer 8.0.10.",
      "vulnerability": {
        "name": "GHSA-46j5-6fg5-4gv3"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.10",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.10"
          }
        }
      ],
      "timestamp": "2026-10-27T15:13:32.414812+00:00",
      "status_notes": "Vulnerability GHSA-4ffr-jq9g-5ffx affects version 8.0.10 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-4ffr-jq9g-5ffx"
      },
      "action_statement": "Vulnerability GHSA-4ffr-jq9g-5ffx affects version 8.0.10 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.10",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.10"
          }
        }
      ],
      "timestamp": "2026-10-27T15:13:32.414812+00:00",
      "status_notes": "Vulnerability GHSA-4g23-2xm8-66gc affects version 8.0.10 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-4g23-2xm8-66gc"
      },
      "action_statement": "Vulnerability GHSA-4g23-2xm8-66gc affects version 8.0.10 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.10",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.10"
          }
        }
      ],
      "timestamp": "2026-10-15T12:59:10.273238+00:00",
      "status_notes": "Vulnerability GHSA-6vj9-mwq6-2f5v affects version 8.0.10 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-6vj9-mwq6-2f5v"
      },
      "action_statement": "Vulnerability GHSA-6vj9-mwq6-2f5v affects version 8.0.10 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.10",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.10"
          }
        }
      ],
      "timestamp": "2026-10-23T22:01:00.144162+00:00",
      "status_notes": "Vulnerability GHSA-85x2-q946-cp5h affects version 8.0.10 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-85x2-q946-cp5h"
      },
      "action_statement": "Vulnerability GHSA-85x2-q946-cp5h affects version 8.0.10 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.10",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.10"
          }
        }
      ],
      "timestamp": "2026-10-23T22:01:00.144162+00:00",
      "status_notes": "Vulnerability GHSA-8c8m-p3m8-cjg8 affects version 8.0.10 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-8c8m-p3m8-cjg8"
      },
      "action_statement": "Vulnerability GHSA-8c8m-p3m8-cjg8 affects version 8.0.10 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.10",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.10"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-8m3c-c648-2xjj affects version 8.0.10 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-8m3c-c648-2xjj"
      },
      "action_statement": "Vulnerability GHSA-8m3c-c648-2xjj affects version 8.0.10 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.10",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.10"
          }
        }
      ],
      "timestamp": "2026-09-29T18:46:58.638266+00:00",
      "status_notes": "Vulnerability GHSA-8vvx-rff5-p5rq affects version 8.0.10 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-8vvx-rff5-p5rq"
      },
      "action_statement": "Vulnerability GHSA-8vvx-rff5-p5rq affects version 8.0.10 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.10",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.10"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-9h6g-pr28-7cqp affects version 8.0.10 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-9h6g-pr28-7cqp"
      },
      "action_statement": "Vulnerability GHSA-9h6g-pr28-7cqp affects version 8.0.10 of nodemailer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.10",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.10"
          }
        }
      ],
      "timestamp": "2026-11-13T22:06:56.306734+00:00",
      "status_notes": "Vulnerability GHSA-c7w3-x93f-qmm8 does not affect version 8.0.10 of nodemailer. not_affected \u2014 Nodemailer 8.0.10 already contains the upstream fix (commit 2d7b971, \"fix: sanitize envelope size to prevent SMTP command injection\"). envelope.size is coerced with Number() and only emitted as SIZE=<number> when it is a positive number, so CRLF payloads cannot reach the MAIL FROM command line. The fix shipped in the upstream release. The only TuxCare commit on top is a build-config file.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-c7w3-x93f-qmm8"
      },
      "impact_statement": "not_affected \u2014 Nodemailer 8.0.10 already contains the upstream fix (commit 2d7b971, \"fix: sanitize envelope size to prevent SMTP command injection\"). envelope.size is coerced with Number() and only emitted as SIZE=<number> when it is a positive number, so CRLF payloads cannot reach the MAIL FROM command line. The fix shipped in the upstream release. The only TuxCare commit on top is a build-config file."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.10",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.10"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-cc9r-2j5m-2m83 affects version 8.0.10 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-cc9r-2j5m-2m83"
      },
      "action_statement": "Vulnerability GHSA-cc9r-2j5m-2m83 affects version 8.0.10 of nodemailer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.10",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.10"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-frj6-5rhh-vwfw is a false positive for nodemailer 8.0.10.",
      "vulnerability": {
        "name": "GHSA-frj6-5rhh-vwfw"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.10",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.10"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-g57g-f23g-4646 affects version 8.0.10 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-g57g-f23g-4646"
      },
      "action_statement": "Vulnerability GHSA-g57g-f23g-4646 affects version 8.0.10 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.10",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.10"
          }
        }
      ],
      "timestamp": "2026-10-27T15:13:32.414812+00:00",
      "status_notes": "Vulnerability GHSA-g73g-hqqh-jr95 affects version 8.0.10 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-g73g-hqqh-jr95"
      },
      "action_statement": "Vulnerability GHSA-g73g-hqqh-jr95 affects version 8.0.10 of nodemailer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.10",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.10"
          }
        }
      ],
      "timestamp": "2026-10-26T11:12:01.434845+00:00",
      "status_notes": "Vulnerability GHSA-h3hj-cmcx-xc66 is a false positive for nodemailer 8.0.10.",
      "vulnerability": {
        "name": "GHSA-h3hj-cmcx-xc66"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.10",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.10"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-jj37-3377-m6vv is a false positive for nodemailer 8.0.10.",
      "vulnerability": {
        "name": "GHSA-jj37-3377-m6vv"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.10",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.10"
          }
        }
      ],
      "timestamp": "2026-10-23T22:01:49.029239+00:00",
      "status_notes": "Vulnerability GHSA-m943-m63m-w62w affects version 8.0.10 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-m943-m63m-w62w"
      },
      "action_statement": "Vulnerability GHSA-m943-m63m-w62w affects version 8.0.10 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.10",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.10"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-p6gq-j5cr-w38f affects version 8.0.10 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-p6gq-j5cr-w38f"
      },
      "action_statement": "Vulnerability GHSA-p6gq-j5cr-w38f affects version 8.0.10 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.10",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.10"
          }
        }
      ],
      "timestamp": "2026-09-29T23:59:00.245334+00:00",
      "status_notes": "Vulnerability GHSA-v53p-9fqp-m79j affects version 8.0.10 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-v53p-9fqp-m79j"
      },
      "action_statement": "Vulnerability GHSA-v53p-9fqp-m79j affects version 8.0.10 of nodemailer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.10",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.10"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-vm5r-23w9-m8hx is a false positive for nodemailer 8.0.10.",
      "vulnerability": {
        "name": "GHSA-vm5r-23w9-m8hx"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.10",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.10"
          }
        }
      ],
      "timestamp": "2026-11-13T22:09:00.042716+00:00",
      "status_notes": "Vulnerability GHSA-vvjj-xcjg-gr5g does not affect version 8.0.10 of nodemailer. not_affected \u2014 Target nodemailer 8.0.10 already contains the upstream fix for GHSA-vvjj-xcjg-gr5g. lib/smtp-connection/index.js:93 strips CR/LF from the `name` option before it is used in EHLO/HELO/LHLO. The fix is upstream commit 0a43876 by andris@reinman.eu, shipped in the upstream release and not authored by TuxCare.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-vvjj-xcjg-gr5g"
      },
      "impact_statement": "not_affected \u2014 Target nodemailer 8.0.10 already contains the upstream fix for GHSA-vvjj-xcjg-gr5g. lib/smtp-connection/index.js:93 strips CR/LF from the `name` option before it is used in EHLO/HELO/LHLO. The fix is upstream commit 0a43876 by andris@reinman.eu, shipped in the upstream release and not authored by TuxCare."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.10",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.10"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-wmmp-3585-3rmp affects version 8.0.10 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-wmmp-3585-3rmp"
      },
      "action_statement": "Vulnerability GHSA-wmmp-3585-3rmp affects version 8.0.10 of nodemailer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.10",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.10"
          }
        }
      ],
      "timestamp": "2026-11-13T22:14:17.313956+00:00",
      "status_notes": "Vulnerability GHSA-wqvq-jvpq-h66f does not affect version 8.0.10 of nodemailer. not_affected \u2014 Nodemailer 8.0.10 already contains the upstream fix for GHSA-wqvq-jvpq-h66f. The fix is upstream commit 5f69497 (shipped in 8.0.9), which passes the disableFileAccess/disableUrlAccess policy into shared.resolveContent(). The jsonTransport and attachDataUrls pre-resolution paths now both pass the policy, so the bypass is closed.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-wqvq-jvpq-h66f"
      },
      "impact_statement": "not_affected \u2014 Nodemailer 8.0.10 already contains the upstream fix for GHSA-wqvq-jvpq-h66f. The fix is upstream commit 5f69497 (shipped in 8.0.9), which passes the disableFileAccess/disableUrlAccess policy into shared.resolveContent(). The jsonTransport and attachDataUrls pre-resolution paths now both pass the policy, so the bypass is closed."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.10",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.10"
          }
        }
      ],
      "timestamp": "2026-10-22T17:05:00.556684+00:00",
      "status_notes": "Vulnerability GHSA-wxxx-r42m-9rp8 is a false positive for nodemailer 8.0.10.",
      "vulnerability": {
        "name": "GHSA-wxxx-r42m-9rp8"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}