{ "@id": "urn:uuid:998b3417-c633-4959-99d4-aee8704fc10b", "role": "Document Creator", "author": "https://tuxcare.com", "version": 21, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-13T23:22:24.687612+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.4" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2020-7769 affects version 8.0.4 of nodemailer.", "vulnerability": { "name": "CVE-2020-7769" }, "action_statement": "Vulnerability CVE-2020-7769 affects version 8.0.4 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.4" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2021-23400 affects version 8.0.4 of nodemailer.", "vulnerability": { "name": "CVE-2021-23400" }, "action_statement": "Vulnerability CVE-2021-23400 affects version 8.0.4 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.4" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2025-13033 affects version 8.0.4 of nodemailer.", "vulnerability": { "name": "CVE-2025-13033" }, "action_statement": "Vulnerability CVE-2025-13033 affects version 8.0.4 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.4" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2025-14874 affects version 8.0.4 of nodemailer.", "vulnerability": { "name": "CVE-2025-14874" }, "action_statement": "Vulnerability CVE-2025-14874 affects version 8.0.4 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.4" } } ], "timestamp": "2026-10-15T15:49:00.133726+00:00", "status_notes": "Vulnerability CVE-2026-110869 affects version 8.0.4 of nodemailer.", "vulnerability": { "name": "CVE-2026-110869" }, "action_statement": "Vulnerability CVE-2026-110869 affects version 8.0.4 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.4" } } ], "timestamp": "2026-10-26T15:35:33.946658+00:00", "status_notes": "Vulnerability CVE-2026-110870 affects version 8.0.4 of nodemailer.", "vulnerability": { "name": "CVE-2026-110870" }, "action_statement": "Vulnerability CVE-2026-110870 affects version 8.0.4 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.4" } } ], "timestamp": "2026-10-20T02:46:00.084729+00:00", "status_notes": "Vulnerability CVE-2026-110871 affects version 8.0.4 of nodemailer.", "vulnerability": { "name": "CVE-2026-110871" }, "action_statement": "Vulnerability CVE-2026-110871 affects version 8.0.4 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.4" } } ], "timestamp": "2026-10-15T14:51:00.186658+00:00", "status_notes": "Vulnerability CVE-2026-110872 affects version 8.0.4 of nodemailer.", "vulnerability": { "name": "CVE-2026-110872" }, "action_statement": "Vulnerability CVE-2026-110872 affects version 8.0.4 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.4" } } ], "timestamp": "2026-11-03T14:36:48.497569+00:00", "status_notes": "Vulnerability CVE-2026-121424 affects version 8.0.4 of nodemailer.", "vulnerability": { "name": "CVE-2026-121424" }, "action_statement": "Vulnerability CVE-2026-121424 affects version 8.0.4 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.4" } } ], "timestamp": "2026-11-03T14:36:48.497569+00:00", "status_notes": "Vulnerability CVE-2026-121425 affects version 8.0.4 of nodemailer.", "vulnerability": { "name": "CVE-2026-121425" }, "action_statement": "Vulnerability CVE-2026-121425 affects version 8.0.4 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.4" } } ], "timestamp": "2026-11-03T14:36:48.497569+00:00", "status_notes": "Vulnerability CVE-2026-121426 affects version 8.0.4 of nodemailer.", "vulnerability": { "name": "CVE-2026-121426" }, "action_statement": "Vulnerability CVE-2026-121426 affects version 8.0.4 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.4" } } ], "timestamp": "2026-11-10T15:29:32.523739+00:00", "status_notes": "Vulnerability CVE-2026-125755 affects version 8.0.4 of nodemailer.", "vulnerability": { "name": "CVE-2026-125755" }, "action_statement": "Vulnerability CVE-2026-125755 affects version 8.0.4 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.4" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-82659 affects version 8.0.4 of nodemailer.", "vulnerability": { "name": "CVE-2026-82659" }, "action_statement": "Vulnerability CVE-2026-82659 affects version 8.0.4 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.4" } } ], "timestamp": "2026-10-05T22:59:00.101528+00:00", "status_notes": "Vulnerability CVE-2026-82662 affects version 8.0.4 of nodemailer.", "vulnerability": { "name": "CVE-2026-82662" }, "action_statement": "Vulnerability CVE-2026-82662 affects version 8.0.4 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.4" } } ], "timestamp": "2026-11-13T23:22:24.687612+00:00", "status_notes": "Vulnerability CVE-2026-82854 does not affect version 8.0.4 of nodemailer. not_affected \u2014 Target is nodemailer 8.0.4, which already contains the upstream fix (commit 2d7b9710, \"sanitize envelope size to prevent SMTP command injection\"). envelope.size is coerced with Number() before being added to MAIL FROM, so CRLF cannot reach the SMTP command.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-82854" }, "impact_statement": "not_affected \u2014 Target is nodemailer 8.0.4, which already contains the upstream fix (commit 2d7b9710, \"sanitize envelope size to prevent SMTP command injection\"). envelope.size is coerced with Number() before being added to MAIL FROM, so CRLF cannot reach the SMTP command." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.4" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2026-90776 affects version 8.0.4 of nodemailer.", "vulnerability": { "name": "CVE-2026-90776" }, "action_statement": "Vulnerability CVE-2026-90776 affects version 8.0.4 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.4" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-268h-hp4c-crq3 affects version 8.0.4 of nodemailer.", "vulnerability": { "name": "GHSA-268h-hp4c-crq3" }, "action_statement": "Vulnerability GHSA-268h-hp4c-crq3 affects version 8.0.4 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.4" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-2x7j-588g-ccc2 affects version 8.0.4 of nodemailer.", "vulnerability": { "name": "GHSA-2x7j-588g-ccc2" }, "action_statement": "Vulnerability GHSA-2x7j-588g-ccc2 affects version 8.0.4 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.4" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-46j5-6fg5-4gv3 is a false positive for nodemailer 8.0.4.", "vulnerability": { "name": "GHSA-46j5-6fg5-4gv3" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.4" } } ], "timestamp": "2026-10-27T15:13:32.414812+00:00", "status_notes": "Vulnerability GHSA-4ffr-jq9g-5ffx affects version 8.0.4 of nodemailer.", "vulnerability": { "name": "GHSA-4ffr-jq9g-5ffx" }, "action_statement": "Vulnerability GHSA-4ffr-jq9g-5ffx affects version 8.0.4 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.4" } } ], "timestamp": "2026-10-27T15:13:32.414812+00:00", "status_notes": "Vulnerability GHSA-4g23-2xm8-66gc affects version 8.0.4 of nodemailer.", "vulnerability": { "name": "GHSA-4g23-2xm8-66gc" }, "action_statement": "Vulnerability GHSA-4g23-2xm8-66gc affects version 8.0.4 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.4" } } ], "timestamp": "2026-10-15T12:59:10.273238+00:00", "status_notes": "Vulnerability GHSA-6vj9-mwq6-2f5v affects version 8.0.4 of nodemailer.", "vulnerability": { "name": "GHSA-6vj9-mwq6-2f5v" }, "action_statement": "Vulnerability GHSA-6vj9-mwq6-2f5v affects version 8.0.4 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.4" } } ], "timestamp": "2026-10-23T22:01:00.144162+00:00", "status_notes": "Vulnerability GHSA-85x2-q946-cp5h affects version 8.0.4 of nodemailer.", "vulnerability": { "name": "GHSA-85x2-q946-cp5h" }, "action_statement": "Vulnerability GHSA-85x2-q946-cp5h affects version 8.0.4 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.4" } } ], "timestamp": "2026-10-23T22:01:00.144162+00:00", "status_notes": "Vulnerability GHSA-8c8m-p3m8-cjg8 affects version 8.0.4 of nodemailer.", "vulnerability": { "name": "GHSA-8c8m-p3m8-cjg8" }, "action_statement": "Vulnerability GHSA-8c8m-p3m8-cjg8 affects version 8.0.4 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.4" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-8m3c-c648-2xjj affects version 8.0.4 of nodemailer.", "vulnerability": { "name": "GHSA-8m3c-c648-2xjj" }, "action_statement": "Vulnerability GHSA-8m3c-c648-2xjj affects version 8.0.4 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.4" } } ], "timestamp": "2026-09-29T18:46:58.638266+00:00", "status_notes": "Vulnerability GHSA-8vvx-rff5-p5rq affects version 8.0.4 of nodemailer.", "vulnerability": { "name": "GHSA-8vvx-rff5-p5rq" }, "action_statement": "Vulnerability GHSA-8vvx-rff5-p5rq affects version 8.0.4 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.4" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-9h6g-pr28-7cqp affects version 8.0.4 of nodemailer.", "vulnerability": { "name": "GHSA-9h6g-pr28-7cqp" }, "action_statement": "Vulnerability GHSA-9h6g-pr28-7cqp affects version 8.0.4 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.4" } } ], "timestamp": "2026-11-13T22:05:00.053359+00:00", "status_notes": "Vulnerability GHSA-c7w3-x93f-qmm8 does not affect version 8.0.4 of nodemailer. not_affected \u2014 nodemailer 8.0.4 already contains the upstream fix 2d7b971 (\"sanitize envelope size to prevent SMTP command injection\"). envelope.size is coerced with Number() and only a positive number is appended to MAIL FROM, so CRLF cannot reach the SMTP command line. The fix shipped in the upstream release and no TuxCare commit exists in HEAD's history.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-c7w3-x93f-qmm8" }, "impact_statement": "not_affected \u2014 nodemailer 8.0.4 already contains the upstream fix 2d7b971 (\"sanitize envelope size to prevent SMTP command injection\"). envelope.size is coerced with Number() and only a positive number is appended to MAIL FROM, so CRLF cannot reach the SMTP command line. The fix shipped in the upstream release and no TuxCare commit exists in HEAD's history." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.4" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-cc9r-2j5m-2m83 affects version 8.0.4 of nodemailer.", "vulnerability": { "name": "GHSA-cc9r-2j5m-2m83" }, "action_statement": "Vulnerability GHSA-cc9r-2j5m-2m83 affects version 8.0.4 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.4" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-frj6-5rhh-vwfw is a false positive for nodemailer 8.0.4.", "vulnerability": { "name": "GHSA-frj6-5rhh-vwfw" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.4" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-g57g-f23g-4646 affects version 8.0.4 of nodemailer.", "vulnerability": { "name": "GHSA-g57g-f23g-4646" }, "action_statement": "Vulnerability GHSA-g57g-f23g-4646 affects version 8.0.4 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.4" } } ], "timestamp": "2026-10-27T15:13:32.414812+00:00", "status_notes": "Vulnerability GHSA-g73g-hqqh-jr95 affects version 8.0.4 of nodemailer.", "vulnerability": { "name": "GHSA-g73g-hqqh-jr95" }, "action_statement": "Vulnerability GHSA-g73g-hqqh-jr95 affects version 8.0.4 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.4" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability GHSA-h3hj-cmcx-xc66 is a false positive for nodemailer 8.0.4.", "vulnerability": { "name": "GHSA-h3hj-cmcx-xc66" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.4" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-jj37-3377-m6vv is a false positive for nodemailer 8.0.4.", "vulnerability": { "name": "GHSA-jj37-3377-m6vv" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.4" } } ], "timestamp": "2026-10-23T22:01:49.029239+00:00", "status_notes": "Vulnerability GHSA-m943-m63m-w62w affects version 8.0.4 of nodemailer.", "vulnerability": { "name": "GHSA-m943-m63m-w62w" }, "action_statement": "Vulnerability GHSA-m943-m63m-w62w affects version 8.0.4 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.4" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-p6gq-j5cr-w38f affects version 8.0.4 of nodemailer.", "vulnerability": { "name": "GHSA-p6gq-j5cr-w38f" }, "action_statement": "Vulnerability GHSA-p6gq-j5cr-w38f affects version 8.0.4 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.4" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-r7g4-qg5f-qqm2 affects version 8.0.4 of nodemailer.", "vulnerability": { "name": "GHSA-r7g4-qg5f-qqm2" }, "action_statement": "Vulnerability GHSA-r7g4-qg5f-qqm2 affects version 8.0.4 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.4" } } ], "timestamp": "2026-09-29T23:59:00.245334+00:00", "status_notes": "Vulnerability GHSA-v53p-9fqp-m79j affects version 8.0.4 of nodemailer.", "vulnerability": { "name": "GHSA-v53p-9fqp-m79j" }, "action_statement": "Vulnerability GHSA-v53p-9fqp-m79j affects version 8.0.4 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.4" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-vm5r-23w9-m8hx is a false positive for nodemailer 8.0.4.", "vulnerability": { "name": "GHSA-vm5r-23w9-m8hx" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.4" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-vvjj-xcjg-gr5g affects version 8.0.4 of nodemailer.", "vulnerability": { "name": "GHSA-vvjj-xcjg-gr5g" }, "action_statement": "Vulnerability GHSA-vvjj-xcjg-gr5g affects version 8.0.4 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.4" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wmmp-3585-3rmp affects version 8.0.4 of nodemailer.", "vulnerability": { "name": "GHSA-wmmp-3585-3rmp" }, "action_statement": "Vulnerability GHSA-wmmp-3585-3rmp affects version 8.0.4 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.4" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wqvq-jvpq-h66f affects version 8.0.4 of nodemailer.", "vulnerability": { "name": "GHSA-wqvq-jvpq-h66f" }, "action_statement": "Vulnerability GHSA-wqvq-jvpq-h66f affects version 8.0.4 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@8.0.4", "identifiers": { "purl": "pkg:npm/nodemailer@8.0.4" } } ], "timestamp": "2026-10-22T17:05:00.556684+00:00", "status_notes": "Vulnerability GHSA-wxxx-r42m-9rp8 is a false positive for nodemailer 8.0.4.", "vulnerability": { "name": "GHSA-wxxx-r42m-9rp8" }, "impact_statement": "The vulnerability has been withdrawn." } ] }