{
  "@id": "urn:uuid:efc392f5-d0ff-40cb-b113-c3413e38f19f",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 21,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-13T23:27:15.823474+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.8",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.8"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2020-7769 affects version 8.0.8 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2020-7769"
      },
      "action_statement": "Vulnerability CVE-2020-7769 affects version 8.0.8 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.8",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.8"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2021-23400 affects version 8.0.8 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2021-23400"
      },
      "action_statement": "Vulnerability CVE-2021-23400 affects version 8.0.8 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.8",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.8"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2025-13033 affects version 8.0.8 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2025-13033"
      },
      "action_statement": "Vulnerability CVE-2025-13033 affects version 8.0.8 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.8",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.8"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2025-14874 affects version 8.0.8 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2025-14874"
      },
      "action_statement": "Vulnerability CVE-2025-14874 affects version 8.0.8 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.8",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.8"
          }
        }
      ],
      "timestamp": "2026-10-15T15:49:00.133726+00:00",
      "status_notes": "Vulnerability CVE-2026-110869 affects version 8.0.8 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-110869"
      },
      "action_statement": "Vulnerability CVE-2026-110869 affects version 8.0.8 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.8",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.8"
          }
        }
      ],
      "timestamp": "2026-10-26T15:35:33.946658+00:00",
      "status_notes": "Vulnerability CVE-2026-110870 affects version 8.0.8 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-110870"
      },
      "action_statement": "Vulnerability CVE-2026-110870 affects version 8.0.8 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.8",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.8"
          }
        }
      ],
      "timestamp": "2026-10-20T02:46:00.084729+00:00",
      "status_notes": "Vulnerability CVE-2026-110871 affects version 8.0.8 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-110871"
      },
      "action_statement": "Vulnerability CVE-2026-110871 affects version 8.0.8 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.8",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.8"
          }
        }
      ],
      "timestamp": "2026-10-15T14:51:00.186658+00:00",
      "status_notes": "Vulnerability CVE-2026-110872 affects version 8.0.8 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-110872"
      },
      "action_statement": "Vulnerability CVE-2026-110872 affects version 8.0.8 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.8",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.8"
          }
        }
      ],
      "timestamp": "2026-11-03T14:36:48.497569+00:00",
      "status_notes": "Vulnerability CVE-2026-121424 affects version 8.0.8 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-121424"
      },
      "action_statement": "Vulnerability CVE-2026-121424 affects version 8.0.8 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.8",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.8"
          }
        }
      ],
      "timestamp": "2026-11-03T14:36:48.497569+00:00",
      "status_notes": "Vulnerability CVE-2026-121425 affects version 8.0.8 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-121425"
      },
      "action_statement": "Vulnerability CVE-2026-121425 affects version 8.0.8 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.8",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.8"
          }
        }
      ],
      "timestamp": "2026-11-03T14:36:48.497569+00:00",
      "status_notes": "Vulnerability CVE-2026-121426 affects version 8.0.8 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-121426"
      },
      "action_statement": "Vulnerability CVE-2026-121426 affects version 8.0.8 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.8",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.8"
          }
        }
      ],
      "timestamp": "2026-11-10T15:29:32.523739+00:00",
      "status_notes": "Vulnerability CVE-2026-125755 affects version 8.0.8 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-125755"
      },
      "action_statement": "Vulnerability CVE-2026-125755 affects version 8.0.8 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.8",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-82659 affects version 8.0.8 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-82659"
      },
      "action_statement": "Vulnerability CVE-2026-82659 affects version 8.0.8 of nodemailer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.8",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.8"
          }
        }
      ],
      "timestamp": "2026-11-13T23:12:01.384820+00:00",
      "status_notes": "Vulnerability CVE-2026-82662 does not affect version 8.0.8 of nodemailer. not_affected \u2014 Upstream fix 833d6e58 (\"enforce strict TLS for OAuth2 and Ethereal credential requests\") is already in HEAD. lib/fetch/index.js still defaults to rejectUnauthorized:false, but the OAuth2 token request and the Ethereal API request now set tls.rejectUnauthorized:true for https URLs. The fix is upstream-authored and shipped in the upstream 8.0.8 release.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-82662"
      },
      "impact_statement": "not_affected \u2014 Upstream fix 833d6e58 (\"enforce strict TLS for OAuth2 and Ethereal credential requests\") is already in HEAD. lib/fetch/index.js still defaults to rejectUnauthorized:false, but the OAuth2 token request and the Ethereal API request now set tls.rejectUnauthorized:true for https URLs. The fix is upstream-authored and shipped in the upstream 8.0.8 release."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.8",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.8"
          }
        }
      ],
      "timestamp": "2026-11-13T23:27:15.823474+00:00",
      "status_notes": "Vulnerability CVE-2026-82854 does not affect version 8.0.8 of nodemailer. not_affected \u2014 Nodemailer 8.0.8 already contains the upstream fix for CVE-2026-82854. The envelope size is coerced to a number before it is added to the MAIL FROM command, so CRLF cannot be injected. The fix is upstream commit 2d7b9710 (author andris@reinman.eu), which is an ancestor of HEAD and ships in the upstream 8.0.x release.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-82854"
      },
      "impact_statement": "not_affected \u2014 Nodemailer 8.0.8 already contains the upstream fix for CVE-2026-82854. The envelope size is coerced to a number before it is added to the MAIL FROM command, so CRLF cannot be injected. The fix is upstream commit 2d7b9710 (author andris@reinman.eu), which is an ancestor of HEAD and ships in the upstream 8.0.x release."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.8",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.8"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability CVE-2026-90776 affects version 8.0.8 of nodemailer.",
      "vulnerability": {
        "name": "CVE-2026-90776"
      },
      "action_statement": "Vulnerability CVE-2026-90776 affects version 8.0.8 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.8",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-268h-hp4c-crq3 affects version 8.0.8 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-268h-hp4c-crq3"
      },
      "action_statement": "Vulnerability GHSA-268h-hp4c-crq3 affects version 8.0.8 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.8",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-2x7j-588g-ccc2 affects version 8.0.8 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-2x7j-588g-ccc2"
      },
      "action_statement": "Vulnerability GHSA-2x7j-588g-ccc2 affects version 8.0.8 of nodemailer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.8",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.8"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-46j5-6fg5-4gv3 is a false positive for nodemailer 8.0.8.",
      "vulnerability": {
        "name": "GHSA-46j5-6fg5-4gv3"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.8",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.8"
          }
        }
      ],
      "timestamp": "2026-10-27T15:13:32.414812+00:00",
      "status_notes": "Vulnerability GHSA-4ffr-jq9g-5ffx affects version 8.0.8 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-4ffr-jq9g-5ffx"
      },
      "action_statement": "Vulnerability GHSA-4ffr-jq9g-5ffx affects version 8.0.8 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.8",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.8"
          }
        }
      ],
      "timestamp": "2026-10-27T15:13:32.414812+00:00",
      "status_notes": "Vulnerability GHSA-4g23-2xm8-66gc affects version 8.0.8 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-4g23-2xm8-66gc"
      },
      "action_statement": "Vulnerability GHSA-4g23-2xm8-66gc affects version 8.0.8 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.8",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.8"
          }
        }
      ],
      "timestamp": "2026-10-15T12:59:10.273238+00:00",
      "status_notes": "Vulnerability GHSA-6vj9-mwq6-2f5v affects version 8.0.8 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-6vj9-mwq6-2f5v"
      },
      "action_statement": "Vulnerability GHSA-6vj9-mwq6-2f5v affects version 8.0.8 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.8",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.8"
          }
        }
      ],
      "timestamp": "2026-10-23T22:01:00.144162+00:00",
      "status_notes": "Vulnerability GHSA-85x2-q946-cp5h affects version 8.0.8 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-85x2-q946-cp5h"
      },
      "action_statement": "Vulnerability GHSA-85x2-q946-cp5h affects version 8.0.8 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.8",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.8"
          }
        }
      ],
      "timestamp": "2026-10-23T22:01:00.144162+00:00",
      "status_notes": "Vulnerability GHSA-8c8m-p3m8-cjg8 affects version 8.0.8 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-8c8m-p3m8-cjg8"
      },
      "action_statement": "Vulnerability GHSA-8c8m-p3m8-cjg8 affects version 8.0.8 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.8",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-8m3c-c648-2xjj affects version 8.0.8 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-8m3c-c648-2xjj"
      },
      "action_statement": "Vulnerability GHSA-8m3c-c648-2xjj affects version 8.0.8 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.8",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.8"
          }
        }
      ],
      "timestamp": "2026-09-29T18:46:58.638266+00:00",
      "status_notes": "Vulnerability GHSA-8vvx-rff5-p5rq affects version 8.0.8 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-8vvx-rff5-p5rq"
      },
      "action_statement": "Vulnerability GHSA-8vvx-rff5-p5rq affects version 8.0.8 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.8",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.8"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-9h6g-pr28-7cqp affects version 8.0.8 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-9h6g-pr28-7cqp"
      },
      "action_statement": "Vulnerability GHSA-9h6g-pr28-7cqp affects version 8.0.8 of nodemailer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.8",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.8"
          }
        }
      ],
      "timestamp": "2026-11-13T22:06:56.306734+00:00",
      "status_notes": "Vulnerability GHSA-c7w3-x93f-qmm8 does not affect version 8.0.8 of nodemailer. not_affected \u2014 The target already contains the upstream fix (commit 2d7b971, \"sanitize envelope size to prevent SMTP command injection\"). envelope.size is coerced to a number before it is placed in MAIL FROM, so CRLF cannot reach the wire. The fix is upstream-authored and is an ancestor of HEAD.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-c7w3-x93f-qmm8"
      },
      "impact_statement": "not_affected \u2014 The target already contains the upstream fix (commit 2d7b971, \"sanitize envelope size to prevent SMTP command injection\"). envelope.size is coerced to a number before it is placed in MAIL FROM, so CRLF cannot reach the wire. The fix is upstream-authored and is an ancestor of HEAD."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.8",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-cc9r-2j5m-2m83 affects version 8.0.8 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-cc9r-2j5m-2m83"
      },
      "action_statement": "Vulnerability GHSA-cc9r-2j5m-2m83 affects version 8.0.8 of nodemailer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.8",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.8"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-frj6-5rhh-vwfw is a false positive for nodemailer 8.0.8.",
      "vulnerability": {
        "name": "GHSA-frj6-5rhh-vwfw"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.8",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.8"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-g57g-f23g-4646 affects version 8.0.8 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-g57g-f23g-4646"
      },
      "action_statement": "Vulnerability GHSA-g57g-f23g-4646 affects version 8.0.8 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.8",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.8"
          }
        }
      ],
      "timestamp": "2026-10-27T15:13:32.414812+00:00",
      "status_notes": "Vulnerability GHSA-g73g-hqqh-jr95 affects version 8.0.8 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-g73g-hqqh-jr95"
      },
      "action_statement": "Vulnerability GHSA-g73g-hqqh-jr95 affects version 8.0.8 of nodemailer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.8",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.8"
          }
        }
      ],
      "timestamp": "2026-10-26T11:12:01.434845+00:00",
      "status_notes": "Vulnerability GHSA-h3hj-cmcx-xc66 is a false positive for nodemailer 8.0.8.",
      "vulnerability": {
        "name": "GHSA-h3hj-cmcx-xc66"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.8",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.8"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-jj37-3377-m6vv is a false positive for nodemailer 8.0.8.",
      "vulnerability": {
        "name": "GHSA-jj37-3377-m6vv"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.8",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.8"
          }
        }
      ],
      "timestamp": "2026-10-23T22:01:49.029239+00:00",
      "status_notes": "Vulnerability GHSA-m943-m63m-w62w affects version 8.0.8 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-m943-m63m-w62w"
      },
      "action_statement": "Vulnerability GHSA-m943-m63m-w62w affects version 8.0.8 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.8",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-p6gq-j5cr-w38f affects version 8.0.8 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-p6gq-j5cr-w38f"
      },
      "action_statement": "Vulnerability GHSA-p6gq-j5cr-w38f affects version 8.0.8 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.8",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.8"
          }
        }
      ],
      "timestamp": "2026-09-29T23:59:00.245334+00:00",
      "status_notes": "Vulnerability GHSA-v53p-9fqp-m79j affects version 8.0.8 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-v53p-9fqp-m79j"
      },
      "action_statement": "Vulnerability GHSA-v53p-9fqp-m79j affects version 8.0.8 of nodemailer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.8",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.8"
          }
        }
      ],
      "timestamp": "2026-10-29T07:57:13.458746+00:00",
      "status_notes": "Vulnerability GHSA-vm5r-23w9-m8hx is a false positive for nodemailer 8.0.8.",
      "vulnerability": {
        "name": "GHSA-vm5r-23w9-m8hx"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.8",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.8"
          }
        }
      ],
      "timestamp": "2026-11-13T22:09:00.042716+00:00",
      "status_notes": "Vulnerability GHSA-vvjj-xcjg-gr5g does not affect version 8.0.8 of nodemailer. not_affected \u2014 Target (nodemailer 8.0.8) already contains the upstream fix 0a43876 (GHSA-vvjj-xcjg-gr5g). The transport `name` option is stripped of CR/LF at lib/smtp-connection/index.js:93 before it is used in EHLO/HELO/LHLO. The fix is upstream-authored and shipped in the release, so the verdict is not_affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-vvjj-xcjg-gr5g"
      },
      "impact_statement": "not_affected \u2014 Target (nodemailer 8.0.8) already contains the upstream fix 0a43876 (GHSA-vvjj-xcjg-gr5g). The transport `name` option is stripped of CR/LF at lib/smtp-connection/index.js:93 before it is used in EHLO/HELO/LHLO. The fix is upstream-authored and shipped in the release, so the verdict is not_affected."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.8",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-wmmp-3585-3rmp affects version 8.0.8 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-wmmp-3585-3rmp"
      },
      "action_statement": "Vulnerability GHSA-wmmp-3585-3rmp affects version 8.0.8 of nodemailer."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.8",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-wqvq-jvpq-h66f affects version 8.0.8 of nodemailer.",
      "vulnerability": {
        "name": "GHSA-wqvq-jvpq-h66f"
      },
      "action_statement": "Vulnerability GHSA-wqvq-jvpq-h66f affects version 8.0.8 of nodemailer."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/nodemailer@8.0.8",
          "identifiers": {
            "purl": "pkg:npm/nodemailer@8.0.8"
          }
        }
      ],
      "timestamp": "2026-10-22T17:05:00.556684+00:00",
      "status_notes": "Vulnerability GHSA-wxxx-r42m-9rp8 is a false positive for nodemailer 8.0.8.",
      "vulnerability": {
        "name": "GHSA-wxxx-r42m-9rp8"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}