{ "@id": "urn:uuid:fb0f81ae-c871-4eb1-9cb9-cd86800939c1", "role": "Document Creator", "author": "https://tuxcare.com", "version": 37, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-12T07:12:00.050394+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.0" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2020-7769 affects version 9.0.0 of nodemailer.", "vulnerability": { "name": "CVE-2020-7769" }, "action_statement": "Vulnerability CVE-2020-7769 affects version 9.0.0 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.0" } } ], "timestamp": "2026-11-03T17:15:39.453186+00:00", "status_notes": "Vulnerability CVE-2021-23400 does not affect version 9.0.0 of nodemailer. not_affected \u2014 CVE-2021-23400 (HTTP Header Injection via newlines in email addresses) is NOT present in nodemailer 9.0.0-tuxcare.9. The vulnerability was fixed in upstream version 6.6.1 (commit 7e02648c by Andris Reinman on 2021-05-23) by adding control character sanitization to the _normalizeAddress() method. This fix predates all TuxCare commits in the target's history, meaning it was already present in the...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-23400" }, "impact_statement": "not_affected \u2014 CVE-2021-23400 (HTTP Header Injection via newlines in email addresses) is NOT present in nodemailer 9.0.0-tuxcare.9. The vulnerability was fixed in upstream version 6.6.1 (commit 7e02648c by Andris Reinman on 2021-05-23) by adding control character sanitization to the _normalizeAddress() method. This fix predates all TuxCare commits in the target's history, meaning it was already present in the..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.0" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2025-13033 affects version 9.0.0 of nodemailer.", "vulnerability": { "name": "CVE-2025-13033" }, "action_statement": "Vulnerability CVE-2025-13033 affects version 9.0.0 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.0" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2025-14874 affects version 9.0.0 of nodemailer.", "vulnerability": { "name": "CVE-2025-14874" }, "action_statement": "Vulnerability CVE-2025-14874 affects version 9.0.0 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.0" } } ], "timestamp": "2026-10-19T17:05:16.856684+00:00", "status_notes": "Vulnerability CVE-2026-100701 affects version 9.0.0 of nodemailer, and is fixed in 9.0.0-tuxcare.4.", "vulnerability": { "name": "CVE-2026-100701" }, "action_statement": "Vulnerability CVE-2026-100701 affects version 9.0.0 of nodemailer, and is fixed in 9.0.0-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.0" } } ], "timestamp": "2026-10-31T12:27:28.498963+00:00", "status_notes": "Vulnerability CVE-2026-110869 affects version 9.0.0 of nodemailer, and is fixed in 9.0.0-tuxcare.9.", "vulnerability": { "name": "CVE-2026-110869" }, "action_statement": "Vulnerability CVE-2026-110869 affects version 9.0.0 of nodemailer, and is fixed in 9.0.0-tuxcare.9." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.0" } } ], "timestamp": "2026-10-26T15:35:33.946658+00:00", "status_notes": "Vulnerability CVE-2026-110870 affects version 9.0.0 of nodemailer.", "vulnerability": { "name": "CVE-2026-110870" }, "action_statement": "Vulnerability CVE-2026-110870 affects version 9.0.0 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.0" } } ], "timestamp": "2026-10-20T19:24:00.112901+00:00", "status_notes": "Vulnerability CVE-2026-110871 affects version 9.0.0 of nodemailer, and is fixed in 9.0.0-tuxcare.5.", "vulnerability": { "name": "CVE-2026-110871" }, "action_statement": "Vulnerability CVE-2026-110871 affects version 9.0.0 of nodemailer, and is fixed in 9.0.0-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.0" } } ], "timestamp": "2026-10-28T09:49:47.570972+00:00", "status_notes": "Vulnerability CVE-2026-110872 affects version 9.0.0 of nodemailer, and is fixed in 9.0.0-tuxcare.7.", "vulnerability": { "name": "CVE-2026-110872" }, "action_statement": "Vulnerability CVE-2026-110872 affects version 9.0.0 of nodemailer, and is fixed in 9.0.0-tuxcare.7." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.0" } } ], "timestamp": "2026-11-03T14:36:48.497569+00:00", "status_notes": "Vulnerability CVE-2026-121424 affects version 9.0.0 of nodemailer.", "vulnerability": { "name": "CVE-2026-121424" }, "action_statement": "Vulnerability CVE-2026-121424 affects version 9.0.0 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.0" } } ], "timestamp": "2026-11-03T14:36:48.497569+00:00", "status_notes": "Vulnerability CVE-2026-121425 affects version 9.0.0 of nodemailer.", "vulnerability": { "name": "CVE-2026-121425" }, "action_statement": "Vulnerability CVE-2026-121425 affects version 9.0.0 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.0" } } ], "timestamp": "2026-11-03T14:36:48.497569+00:00", "status_notes": "Vulnerability CVE-2026-121426 affects version 9.0.0 of nodemailer.", "vulnerability": { "name": "CVE-2026-121426" }, "action_statement": "Vulnerability CVE-2026-121426 affects version 9.0.0 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.0" } } ], "timestamp": "2026-11-12T07:12:00.050394+00:00", "status_notes": "Vulnerability CVE-2026-125755 affects version 9.0.0 of nodemailer, and is fixed in 9.0.0-tuxcare.11.", "vulnerability": { "name": "CVE-2026-125755" }, "action_statement": "Vulnerability CVE-2026-125755 affects version 9.0.0 of nodemailer, and is fixed in 9.0.0-tuxcare.11." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.0" } } ], "timestamp": "2026-10-10T21:18:00.073945+00:00", "status_notes": "Vulnerability CVE-2026-82659 affects version 9.0.0 of nodemailer, and is fixed in 9.0.0-tuxcare.1.", "vulnerability": { "name": "CVE-2026-82659" }, "action_statement": "Vulnerability CVE-2026-82659 affects version 9.0.0 of nodemailer, and is fixed in 9.0.0-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.0" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2026-82662 affects version 9.0.0 of nodemailer.", "vulnerability": { "name": "CVE-2026-82662" }, "action_statement": "Vulnerability CVE-2026-82662 affects version 9.0.0 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.0" } } ], "timestamp": "2026-11-03T22:34:29.636715+00:00", "status_notes": "Vulnerability CVE-2026-82854 does not affect version 9.0.0 of nodemailer. not_affected \u2014 The target (nodemailer 9.0.0-tuxcare.9) is NOT AFFECTED by CVE-2026-82854. The vulnerability concerns SMTP command injection through unsanitized envelope.size parameter. The upstream vendor fix (commit 2d7b971 by Andris Reinman ) was already present in the upstream 9.0.0 release that TuxCare onboarded. The fix converts envelope.size to Number type before concatenation into SM...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-82854" }, "impact_statement": "not_affected \u2014 The target (nodemailer 9.0.0-tuxcare.9) is NOT AFFECTED by CVE-2026-82854. The vulnerability concerns SMTP command injection through unsanitized envelope.size parameter. The upstream vendor fix (commit 2d7b971 by Andris Reinman ) was already present in the upstream 9.0.0 release that TuxCare onboarded. The fix converts envelope.size to Number type before concatenation into SM..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.0" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2026-90776 affects version 9.0.0 of nodemailer.", "vulnerability": { "name": "CVE-2026-90776" }, "action_statement": "Vulnerability CVE-2026-90776 affects version 9.0.0 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.0" } } ], "timestamp": "2026-10-16T00:37:00.218819+00:00", "status_notes": "Vulnerability CVE-2026-92595 affects version 9.0.0 of nodemailer, and is fixed in 9.0.0-tuxcare.3.", "vulnerability": { "name": "CVE-2026-92595" }, "action_statement": "Vulnerability CVE-2026-92595 affects version 9.0.0 of nodemailer, and is fixed in 9.0.0-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.0" } } ], "timestamp": "2026-10-16T00:37:00.218819+00:00", "status_notes": "Vulnerability CVE-2026-92596 affects version 9.0.0 of nodemailer, and is fixed in 9.0.0-tuxcare.3.", "vulnerability": { "name": "CVE-2026-92596" }, "action_statement": "Vulnerability CVE-2026-92596 affects version 9.0.0 of nodemailer, and is fixed in 9.0.0-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.0" } } ], "timestamp": "2026-10-16T00:37:00.218819+00:00", "status_notes": "Vulnerability CVE-2026-92597 affects version 9.0.0 of nodemailer, and is fixed in 9.0.0-tuxcare.3.", "vulnerability": { "name": "CVE-2026-92597" }, "action_statement": "Vulnerability CVE-2026-92597 affects version 9.0.0 of nodemailer, and is fixed in 9.0.0-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.0" } } ], "timestamp": "2026-10-19T17:05:16.856684+00:00", "status_notes": "Vulnerability CVE-2026-92598 affects version 9.0.0 of nodemailer, and is fixed in 9.0.0-tuxcare.4.", "vulnerability": { "name": "CVE-2026-92598" }, "action_statement": "Vulnerability CVE-2026-92598 affects version 9.0.0 of nodemailer, and is fixed in 9.0.0-tuxcare.4." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.0" } } ], "timestamp": "2026-11-03T17:13:05.282153+00:00", "status_notes": "Vulnerability GHSA-268h-hp4c-crq3 does not affect version 9.0.0 of nodemailer. not_affected \u2014 Target nodemailer 9.0.0-tuxcare.9 is not affected by GHSA-268h-hp4c-crq3 (List-* header CRLF injection). The upstream vendor fix that strips CR/LF characters from list comment values before incorporating them into prepared headers was already present in upstream version 8.0.9, and the target is based on v9.0.0 which inherits this fix. The defense code exists at lib/mailer/mail-message.js lines ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-268h-hp4c-crq3" }, "impact_statement": "not_affected \u2014 Target nodemailer 9.0.0-tuxcare.9 is not affected by GHSA-268h-hp4c-crq3 (List-* header CRLF injection). The upstream vendor fix that strips CR/LF characters from list comment values before incorporating them into prepared headers was already present in upstream version 8.0.9, and the target is based on v9.0.0 which inherits this fix. The defense code exists at lib/mailer/mail-message.js lines ..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-2x7j-588g-ccc2 affects version 9.0.0 of nodemailer.", "vulnerability": { "name": "GHSA-2x7j-588g-ccc2" }, "action_statement": "Vulnerability GHSA-2x7j-588g-ccc2 affects version 9.0.0 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.0" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-46j5-6fg5-4gv3 is a false positive for nodemailer 9.0.0.", "vulnerability": { "name": "GHSA-46j5-6fg5-4gv3" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.0" } } ], "timestamp": "2026-10-27T15:13:32.414812+00:00", "status_notes": "Vulnerability GHSA-4ffr-jq9g-5ffx affects version 9.0.0 of nodemailer.", "vulnerability": { "name": "GHSA-4ffr-jq9g-5ffx" }, "action_statement": "Vulnerability GHSA-4ffr-jq9g-5ffx affects version 9.0.0 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.0" } } ], "timestamp": "2026-10-27T15:13:32.414812+00:00", "status_notes": "Vulnerability GHSA-4g23-2xm8-66gc affects version 9.0.0 of nodemailer.", "vulnerability": { "name": "GHSA-4g23-2xm8-66gc" }, "action_statement": "Vulnerability GHSA-4g23-2xm8-66gc affects version 9.0.0 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.0" } } ], "timestamp": "2026-10-15T12:59:10.273238+00:00", "status_notes": "Vulnerability GHSA-6vj9-mwq6-2f5v affects version 9.0.0 of nodemailer.", "vulnerability": { "name": "GHSA-6vj9-mwq6-2f5v" }, "action_statement": "Vulnerability GHSA-6vj9-mwq6-2f5v affects version 9.0.0 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.0" } } ], "timestamp": "2026-10-27T12:00:27.484618+00:00", "status_notes": "Vulnerability GHSA-85x2-q946-cp5h affects version 9.0.0 of nodemailer, and is fixed in 9.0.0-tuxcare.6.", "vulnerability": { "name": "GHSA-85x2-q946-cp5h" }, "action_statement": "Vulnerability GHSA-85x2-q946-cp5h affects version 9.0.0 of nodemailer, and is fixed in 9.0.0-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.0" } } ], "timestamp": "2026-10-27T12:00:27.484618+00:00", "status_notes": "Vulnerability GHSA-8c8m-p3m8-cjg8 affects version 9.0.0 of nodemailer, and is fixed in 9.0.0-tuxcare.6.", "vulnerability": { "name": "GHSA-8c8m-p3m8-cjg8" }, "action_statement": "Vulnerability GHSA-8c8m-p3m8-cjg8 affects version 9.0.0 of nodemailer, and is fixed in 9.0.0-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-8m3c-c648-2xjj affects version 9.0.0 of nodemailer.", "vulnerability": { "name": "GHSA-8m3c-c648-2xjj" }, "action_statement": "Vulnerability GHSA-8m3c-c648-2xjj affects version 9.0.0 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.0" } } ], "timestamp": "2026-10-13T00:01:06.692490+00:00", "status_notes": "Vulnerability GHSA-8vvx-rff5-p5rq affects version 9.0.0 of nodemailer, and is fixed in 9.0.0-tuxcare.2.", "vulnerability": { "name": "GHSA-8vvx-rff5-p5rq" }, "action_statement": "Vulnerability GHSA-8vvx-rff5-p5rq affects version 9.0.0 of nodemailer, and is fixed in 9.0.0-tuxcare.2." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.0" } } ], "timestamp": "2026-11-03T17:26:20.261617+00:00", "status_notes": "Vulnerability GHSA-9h6g-pr28-7cqp does not affect version 9.0.0 of nodemailer. not_affected \u2014 Target nodemailer 9.0.0 is NOT vulnerable to GHSA-9h6g-pr28-7cqp (ReDoS in data URI parsing). The upstream fixes were already present in version 9.0.0 before TuxCare onboarded it. All vulnerable regex patterns with unbounded quantifiers have been replaced with safe string parsing operations using indexOf, substring, and split. The fix commit dd8f5e8a was authored by the upstream maintainer (And...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-9h6g-pr28-7cqp" }, "impact_statement": "not_affected \u2014 Target nodemailer 9.0.0 is NOT vulnerable to GHSA-9h6g-pr28-7cqp (ReDoS in data URI parsing). The upstream fixes were already present in version 9.0.0 before TuxCare onboarded it. All vulnerable regex patterns with unbounded quantifiers have been replaced with safe string parsing operations using indexOf, substring, and split. The fix commit dd8f5e8a was authored by the upstream maintainer (And..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.0" } } ], "timestamp": "2026-11-03T17:26:36.158776+00:00", "status_notes": "Vulnerability GHSA-c7w3-x93f-qmm8 does not affect version 9.0.0 of nodemailer. not_affected \u2014 The target nodemailer 9.0.0-tuxcare.9 is NOT AFFECTED by GHSA-c7w3-x93f-qmm8 (SMTP command injection via CRLF in envelope.size). The upstream vendor (Andris Reinman) applied a fix in commit 2d7b9710 that converts envelope.size to a Number before concatenating it into SMTP commands. This sanitization was already present in the nodemailer 9.0.0 upstream release that TuxCare onboarded, eliminating...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-c7w3-x93f-qmm8" }, "impact_statement": "not_affected \u2014 The target nodemailer 9.0.0-tuxcare.9 is NOT AFFECTED by GHSA-c7w3-x93f-qmm8 (SMTP command injection via CRLF in envelope.size). The upstream vendor (Andris Reinman) applied a fix in commit 2d7b9710 that converts envelope.size to a Number before concatenating it into SMTP commands. This sanitization was already present in the nodemailer 9.0.0 upstream release that TuxCare onboarded, eliminating..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-cc9r-2j5m-2m83 affects version 9.0.0 of nodemailer.", "vulnerability": { "name": "GHSA-cc9r-2j5m-2m83" }, "action_statement": "Vulnerability GHSA-cc9r-2j5m-2m83 affects version 9.0.0 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.0" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-frj6-5rhh-vwfw is a false positive for nodemailer 9.0.0.", "vulnerability": { "name": "GHSA-frj6-5rhh-vwfw" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.0" } } ], "timestamp": "2026-11-05T11:36:17.214596+00:00", "status_notes": "Vulnerability GHSA-g57g-f23g-4646 affects version 9.0.0 of nodemailer, and is fixed in 9.0.0-tuxcare.10.", "vulnerability": { "name": "GHSA-g57g-f23g-4646" }, "action_statement": "Vulnerability GHSA-g57g-f23g-4646 affects version 9.0.0 of nodemailer, and is fixed in 9.0.0-tuxcare.10." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.0" } } ], "timestamp": "2026-10-29T10:21:18.524281+00:00", "status_notes": "Vulnerability GHSA-g73g-hqqh-jr95 affects version 9.0.0 of nodemailer, and is fixed in 9.0.0-tuxcare.8.", "vulnerability": { "name": "GHSA-g73g-hqqh-jr95" }, "action_statement": "Vulnerability GHSA-g73g-hqqh-jr95 affects version 9.0.0 of nodemailer, and is fixed in 9.0.0-tuxcare.8." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.0" } } ], "timestamp": "2026-10-26T11:12:01.434845+00:00", "status_notes": "Vulnerability GHSA-h3hj-cmcx-xc66 is a false positive for nodemailer 9.0.0.", "vulnerability": { "name": "GHSA-h3hj-cmcx-xc66" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.0" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-jj37-3377-m6vv is a false positive for nodemailer 9.0.0.", "vulnerability": { "name": "GHSA-jj37-3377-m6vv" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.0" } } ], "timestamp": "2026-10-27T12:00:27.484618+00:00", "status_notes": "Vulnerability GHSA-m943-m63m-w62w affects version 9.0.0 of nodemailer, and is fixed in 9.0.0-tuxcare.6.", "vulnerability": { "name": "GHSA-m943-m63m-w62w" }, "action_statement": "Vulnerability GHSA-m943-m63m-w62w affects version 9.0.0 of nodemailer, and is fixed in 9.0.0-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-p6gq-j5cr-w38f affects version 9.0.0 of nodemailer.", "vulnerability": { "name": "GHSA-p6gq-j5cr-w38f" }, "action_statement": "Vulnerability GHSA-p6gq-j5cr-w38f affects version 9.0.0 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.0" } } ], "timestamp": "2026-10-13T00:01:06.692490+00:00", "status_notes": "Vulnerability GHSA-v53p-9fqp-m79j affects version 9.0.0 of nodemailer, and is fixed in 9.0.0-tuxcare.2.", "vulnerability": { "name": "GHSA-v53p-9fqp-m79j" }, "action_statement": "Vulnerability GHSA-v53p-9fqp-m79j affects version 9.0.0 of nodemailer, and is fixed in 9.0.0-tuxcare.2." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.0" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-vm5r-23w9-m8hx is a false positive for nodemailer 9.0.0.", "vulnerability": { "name": "GHSA-vm5r-23w9-m8hx" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.0" } } ], "timestamp": "2026-11-03T17:17:53.657243+00:00", "status_notes": "Vulnerability GHSA-vvjj-xcjg-gr5g does not affect version 9.0.0 of nodemailer. not_affected \u2014 The target nodemailer 9.0.0 is NOT AFFECTED by GHSA-vvjj-xcjg-gr5g (SMTP command injection via CRLF in transport name option). The vulnerability was fixed by upstream commit 0a43876 (authored by andris@reinman.eu on 2026-04-07), which sanitizes the `name` option by stripping all CR/LF characters. This fix was included in the upstream v9.0.0 release (released 2026-06-14) before TuxCare began pat...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-vvjj-xcjg-gr5g" }, "impact_statement": "not_affected \u2014 The target nodemailer 9.0.0 is NOT AFFECTED by GHSA-vvjj-xcjg-gr5g (SMTP command injection via CRLF in transport name option). The vulnerability was fixed by upstream commit 0a43876 (authored by andris@reinman.eu on 2026-04-07), which sanitizes the `name` option by stripping all CR/LF characters. This fix was included in the upstream v9.0.0 release (released 2026-06-14) before TuxCare began pat..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wmmp-3585-3rmp affects version 9.0.0 of nodemailer.", "vulnerability": { "name": "GHSA-wmmp-3585-3rmp" }, "action_statement": "Vulnerability GHSA-wmmp-3585-3rmp affects version 9.0.0 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.0" } } ], "timestamp": "2026-11-03T17:20:10.514084+00:00", "status_notes": "Vulnerability GHSA-wqvq-jvpq-h66f does not affect version 9.0.0 of nodemailer. not_affected \u2014 The target nodemailer 9.0.0 is not affected by GHSA-wqvq-jvpq-h66f. The vulnerability (jsonTransport bypassing disableFileAccess/disableUrlAccess) was fixed in upstream commit 5f694977da2e0e13dc947037566e8e689a01217e by Andris Reinman before TuxCare onboarded this version. The fix adds access control checks in shared.resolveContent() that reject file/URL access when the respective flags are set...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wqvq-jvpq-h66f" }, "impact_statement": "not_affected \u2014 The target nodemailer 9.0.0 is not affected by GHSA-wqvq-jvpq-h66f. The vulnerability (jsonTransport bypassing disableFileAccess/disableUrlAccess) was fixed in upstream commit 5f694977da2e0e13dc947037566e8e689a01217e by Andris Reinman before TuxCare onboarded this version. The fix adds access control checks in shared.resolveContent() that reject file/URL access when the respective flags are set..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.0" } } ], "timestamp": "2026-10-22T17:05:00.556684+00:00", "status_notes": "Vulnerability GHSA-wxxx-r42m-9rp8 is a false positive for nodemailer 9.0.0.", "vulnerability": { "name": "GHSA-wxxx-r42m-9rp8" }, "impact_statement": "The vulnerability has been withdrawn." } ] }