{ "@id": "urn:uuid:95274db7-4ee4-40e1-98cf-ad1992d37a30", "role": "Document Creator", "author": "https://tuxcare.com", "version": 36, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-13T18:20:31.931558+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.1", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.1" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2020-7769 affects version 9.0.1 of nodemailer.", "vulnerability": { "name": "CVE-2020-7769" }, "action_statement": "Vulnerability CVE-2020-7769 affects version 9.0.1 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.1", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.1" } } ], "timestamp": "2026-11-03T17:15:39.453186+00:00", "status_notes": "Vulnerability CVE-2021-23400 does not affect version 9.0.1 of nodemailer. not_affected \u2014 CVE-2021-23400 affects nodemailer before 6.6.1. The target repository is nodemailer 9.0.1-tuxcare.6, which already contains the upstream fix from v6.6.1 (commit 7e02648c, 2021-05-23). The vulnerable pattern (missing control character sanitization in _normalizeAddress) is not present because it was removed by upstream author Andris Reinman before the 9.0.1 release that TuxCare onboarded. The fix...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-23400" }, "impact_statement": "not_affected \u2014 CVE-2021-23400 affects nodemailer before 6.6.1. The target repository is nodemailer 9.0.1-tuxcare.6, which already contains the upstream fix from v6.6.1 (commit 7e02648c, 2021-05-23). The vulnerable pattern (missing control character sanitization in _normalizeAddress) is not present because it was removed by upstream author Andris Reinman before the 9.0.1 release that TuxCare onboarded. The fix..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.1", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.1" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2025-13033 affects version 9.0.1 of nodemailer.", "vulnerability": { "name": "CVE-2025-13033" }, "action_statement": "Vulnerability CVE-2025-13033 affects version 9.0.1 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.1", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.1" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2025-14874 affects version 9.0.1 of nodemailer.", "vulnerability": { "name": "CVE-2025-14874" }, "action_statement": "Vulnerability CVE-2025-14874 affects version 9.0.1 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.1", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.1" } } ], "timestamp": "2026-10-19T17:02:00.141161+00:00", "status_notes": "Vulnerability CVE-2026-100701 affects version 9.0.1 of nodemailer, and is fixed in 9.0.1-tuxcare.3.", "vulnerability": { "name": "CVE-2026-100701" }, "action_statement": "Vulnerability CVE-2026-100701 affects version 9.0.1 of nodemailer, and is fixed in 9.0.1-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.1", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.1" } } ], "timestamp": "2026-11-13T18:20:31.931558+00:00", "status_notes": "Vulnerability CVE-2026-110869 affects version 9.0.1 of nodemailer, and is fixed in 9.0.1-tuxcare.9.", "vulnerability": { "name": "CVE-2026-110869" }, "action_statement": "Vulnerability CVE-2026-110869 affects version 9.0.1 of nodemailer, and is fixed in 9.0.1-tuxcare.9." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.1", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.1" } } ], "timestamp": "2026-11-07T16:44:00.030636+00:00", "status_notes": "Vulnerability CVE-2026-110870 affects version 9.0.1 of nodemailer, and is fixed in 9.0.1-tuxcare.6.", "vulnerability": { "name": "CVE-2026-110870" }, "action_statement": "Vulnerability CVE-2026-110870 affects version 9.0.1 of nodemailer, and is fixed in 9.0.1-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.1", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.1" } } ], "timestamp": "2026-10-20T17:42:07.104023+00:00", "status_notes": "Vulnerability CVE-2026-110871 affects version 9.0.1 of nodemailer, and is fixed in 9.0.1-tuxcare.4.", "vulnerability": { "name": "CVE-2026-110871" }, "action_statement": "Vulnerability CVE-2026-110871 affects version 9.0.1 of nodemailer, and is fixed in 9.0.1-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.1", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.1" } } ], "timestamp": "2026-10-27T12:04:00.097259+00:00", "status_notes": "Vulnerability CVE-2026-110872 affects version 9.0.1 of nodemailer, and is fixed in 9.0.1-tuxcare.5.", "vulnerability": { "name": "CVE-2026-110872" }, "action_statement": "Vulnerability CVE-2026-110872 affects version 9.0.1 of nodemailer, and is fixed in 9.0.1-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.1", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.1" } } ], "timestamp": "2026-11-07T16:44:00.030636+00:00", "status_notes": "Vulnerability CVE-2026-121424 affects version 9.0.1 of nodemailer, and is fixed in 9.0.1-tuxcare.5.", "vulnerability": { "name": "CVE-2026-121424" }, "action_statement": "Vulnerability CVE-2026-121424 affects version 9.0.1 of nodemailer, and is fixed in 9.0.1-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.1", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.1" } } ], "timestamp": "2026-11-07T16:44:00.030636+00:00", "status_notes": "Vulnerability CVE-2026-121425 affects version 9.0.1 of nodemailer, and is fixed in 9.0.1-tuxcare.5.", "vulnerability": { "name": "CVE-2026-121425" }, "action_statement": "Vulnerability CVE-2026-121425 affects version 9.0.1 of nodemailer, and is fixed in 9.0.1-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.1", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.1" } } ], "timestamp": "2026-11-07T16:44:00.030636+00:00", "status_notes": "Vulnerability CVE-2026-121426 affects version 9.0.1 of nodemailer, and is fixed in 9.0.1-tuxcare.5.", "vulnerability": { "name": "CVE-2026-121426" }, "action_statement": "Vulnerability CVE-2026-121426 affects version 9.0.1 of nodemailer, and is fixed in 9.0.1-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.1", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.1" } } ], "timestamp": "2026-11-11T13:11:00.032588+00:00", "status_notes": "Vulnerability CVE-2026-125755 affects version 9.0.1 of nodemailer, and is fixed in 9.0.1-tuxcare.8.", "vulnerability": { "name": "CVE-2026-125755" }, "action_statement": "Vulnerability CVE-2026-125755 affects version 9.0.1 of nodemailer, and is fixed in 9.0.1-tuxcare.8." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.1", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.1" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2026-82659 affects version 9.0.1 of nodemailer.", "vulnerability": { "name": "CVE-2026-82659" }, "action_statement": "Vulnerability CVE-2026-82659 affects version 9.0.1 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.1", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.1" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2026-82662 affects version 9.0.1 of nodemailer.", "vulnerability": { "name": "CVE-2026-82662" }, "action_statement": "Vulnerability CVE-2026-82662 affects version 9.0.1 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.1", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.1" } } ], "timestamp": "2026-11-03T22:33:41.905405+00:00", "status_notes": "Vulnerability CVE-2026-82854 does not affect version 9.0.1 of nodemailer. not_affected \u2014 CVE-2026-82854 (SMTP command injection via unsanitized envelope.size) is NOT present in the target. The upstream vendor fix (commit 2d7b9710e6) was already shipped in the upstream release before TuxCare onboarding. The target code at lib/smtp-connection/index.js:1284-1289 correctly casts envelope.size to Number, preventing CRLF injection. When envelope.size contains line breaks (e.g., \"100\\r\\nR...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-82854" }, "impact_statement": "not_affected \u2014 CVE-2026-82854 (SMTP command injection via unsanitized envelope.size) is NOT present in the target. The upstream vendor fix (commit 2d7b9710e6) was already shipped in the upstream release before TuxCare onboarding. The target code at lib/smtp-connection/index.js:1284-1289 correctly casts envelope.size to Number, preventing CRLF injection. When envelope.size contains line breaks (e.g., \"100\\r\\nR..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.1", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.1" } } ], "timestamp": "2026-11-11T13:14:28.129531+00:00", "status_notes": "Vulnerability CVE-2026-90776 affects version 9.0.1 of nodemailer, and is fixed in 9.0.1-tuxcare.8.", "vulnerability": { "name": "CVE-2026-90776" }, "action_statement": "Vulnerability CVE-2026-90776 affects version 9.0.1 of nodemailer, and is fixed in 9.0.1-tuxcare.8." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.1", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.1" } } ], "timestamp": "2026-10-09T02:01:54.726674+00:00", "status_notes": "Vulnerability CVE-2026-92595 affects version 9.0.1 of nodemailer, and is fixed in 9.0.1-tuxcare.1.", "vulnerability": { "name": "CVE-2026-92595" }, "action_statement": "Vulnerability CVE-2026-92595 affects version 9.0.1 of nodemailer, and is fixed in 9.0.1-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.1", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.1" } } ], "timestamp": "2026-10-09T02:01:54.726674+00:00", "status_notes": "Vulnerability CVE-2026-92596 affects version 9.0.1 of nodemailer, and is fixed in 9.0.1-tuxcare.1.", "vulnerability": { "name": "CVE-2026-92596" }, "action_statement": "Vulnerability CVE-2026-92596 affects version 9.0.1 of nodemailer, and is fixed in 9.0.1-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.1", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.1" } } ], "timestamp": "2026-10-09T02:01:54.726674+00:00", "status_notes": "Vulnerability CVE-2026-92597 affects version 9.0.1 of nodemailer, and is fixed in 9.0.1-tuxcare.1.", "vulnerability": { "name": "CVE-2026-92597" }, "action_statement": "Vulnerability CVE-2026-92597 affects version 9.0.1 of nodemailer, and is fixed in 9.0.1-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.1", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.1" } } ], "timestamp": "2026-10-09T02:01:54.726674+00:00", "status_notes": "Vulnerability CVE-2026-92598 affects version 9.0.1 of nodemailer, and is fixed in 9.0.1-tuxcare.1.", "vulnerability": { "name": "CVE-2026-92598" }, "action_statement": "Vulnerability CVE-2026-92598 affects version 9.0.1 of nodemailer, and is fixed in 9.0.1-tuxcare.1." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.1", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.1" } } ], "timestamp": "2026-11-03T17:13:05.282153+00:00", "status_notes": "Vulnerability GHSA-268h-hp4c-crq3 does not affect version 9.0.1 of nodemailer. not_affected \u2014 The target nodemailer 9.0.1-tuxcare.6 is NOT AFFECTED by GHSA-268h-hp4c-crq3 (List-* header CRLF injection). The vulnerability pattern has been removed by upstream commit 5f694977 authored by Andris Reinman on 2026-05-26, which shipped in the upstream release before TuxCare's maintenance began (first TuxCare commit 9fb3d33 on 2026-06-12). The fix adds CRLF normalization (.replace(/\\r?\\n|\\r/g, '...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-268h-hp4c-crq3" }, "impact_statement": "not_affected \u2014 The target nodemailer 9.0.1-tuxcare.6 is NOT AFFECTED by GHSA-268h-hp4c-crq3 (List-* header CRLF injection). The vulnerability pattern has been removed by upstream commit 5f694977 authored by Andris Reinman on 2026-05-26, which shipped in the upstream release before TuxCare's maintenance began (first TuxCare commit 9fb3d33 on 2026-06-12). The fix adds CRLF normalization (.replace(/\\r?\\n|\\r/g, '..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.1", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-2x7j-588g-ccc2 affects version 9.0.1 of nodemailer.", "vulnerability": { "name": "GHSA-2x7j-588g-ccc2" }, "action_statement": "Vulnerability GHSA-2x7j-588g-ccc2 affects version 9.0.1 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.1", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.1" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-46j5-6fg5-4gv3 is a false positive for nodemailer 9.0.1.", "vulnerability": { "name": "GHSA-46j5-6fg5-4gv3" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.1", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.1" } } ], "timestamp": "2026-10-27T15:13:32.414812+00:00", "status_notes": "Vulnerability GHSA-4ffr-jq9g-5ffx affects version 9.0.1 of nodemailer.", "vulnerability": { "name": "GHSA-4ffr-jq9g-5ffx" }, "action_statement": "Vulnerability GHSA-4ffr-jq9g-5ffx affects version 9.0.1 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.1", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.1" } } ], "timestamp": "2026-10-27T15:13:32.414812+00:00", "status_notes": "Vulnerability GHSA-4g23-2xm8-66gc affects version 9.0.1 of nodemailer.", "vulnerability": { "name": "GHSA-4g23-2xm8-66gc" }, "action_statement": "Vulnerability GHSA-4g23-2xm8-66gc affects version 9.0.1 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.1", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.1" } } ], "timestamp": "2026-10-15T12:59:26.638264+00:00", "status_notes": "Vulnerability GHSA-6vj9-mwq6-2f5v affects version 9.0.1 of nodemailer.", "vulnerability": { "name": "GHSA-6vj9-mwq6-2f5v" }, "action_statement": "Vulnerability GHSA-6vj9-mwq6-2f5v affects version 9.0.1 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.1", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.1" } } ], "timestamp": "2026-10-27T12:04:00.097259+00:00", "status_notes": "Vulnerability GHSA-85x2-q946-cp5h affects version 9.0.1 of nodemailer, and is fixed in 9.0.1-tuxcare.5.", "vulnerability": { "name": "GHSA-85x2-q946-cp5h" }, "action_statement": "Vulnerability GHSA-85x2-q946-cp5h affects version 9.0.1 of nodemailer, and is fixed in 9.0.1-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.1", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.1" } } ], "timestamp": "2026-10-27T12:04:00.097259+00:00", "status_notes": "Vulnerability GHSA-8c8m-p3m8-cjg8 affects version 9.0.1 of nodemailer, and is fixed in 9.0.1-tuxcare.5.", "vulnerability": { "name": "GHSA-8c8m-p3m8-cjg8" }, "action_statement": "Vulnerability GHSA-8c8m-p3m8-cjg8 affects version 9.0.1 of nodemailer, and is fixed in 9.0.1-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.1", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-8m3c-c648-2xjj affects version 9.0.1 of nodemailer.", "vulnerability": { "name": "GHSA-8m3c-c648-2xjj" }, "action_statement": "Vulnerability GHSA-8m3c-c648-2xjj affects version 9.0.1 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.1", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.1" } } ], "timestamp": "2026-10-12T23:13:00.090427+00:00", "status_notes": "Vulnerability GHSA-8vvx-rff5-p5rq affects version 9.0.1 of nodemailer, and is fixed in 9.0.1-tuxcare.2.", "vulnerability": { "name": "GHSA-8vvx-rff5-p5rq" }, "action_statement": "Vulnerability GHSA-8vvx-rff5-p5rq affects version 9.0.1 of nodemailer, and is fixed in 9.0.1-tuxcare.2." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.1", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.1" } } ], "timestamp": "2026-11-03T17:27:24.364104+00:00", "status_notes": "Vulnerability GHSA-9h6g-pr28-7cqp does not affect version 9.0.1 of nodemailer. not_affected \u2014 The target nodemailer 9.0.1-tuxcare.6 is NOT AFFECTED by GHSA-9h6g-pr28-7cqp (ReDoS in data URI parsing). The upstream nodemailer project fixed this vulnerability in commits dd8f5e8a (Feb 2024) and 90b3e24d (Aug 2025), both of which shipped in the upstream v9.0.1 release before TuxCare onboarded this version. The vulnerable regex patterns have been replaced with deterministic string parsing usi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-9h6g-pr28-7cqp" }, "impact_statement": "not_affected \u2014 The target nodemailer 9.0.1-tuxcare.6 is NOT AFFECTED by GHSA-9h6g-pr28-7cqp (ReDoS in data URI parsing). The upstream nodemailer project fixed this vulnerability in commits dd8f5e8a (Feb 2024) and 90b3e24d (Aug 2025), both of which shipped in the upstream v9.0.1 release before TuxCare onboarded this version. The vulnerable regex patterns have been replaced with deterministic string parsing usi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.1", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.1" } } ], "timestamp": "2026-11-03T17:27:52.523797+00:00", "status_notes": "Vulnerability GHSA-c7w3-x93f-qmm8 does not affect version 9.0.1 of nodemailer. not_affected \u2014 The target version 9.0.1 is NOT AFFECTED by GHSA-c7w3-x93f-qmm8. The upstream vendor (Andris Reinman) fixed this SMTP command injection vulnerability in commit 2d7b9710 on 2026-03-25, which was already present in the upstream release before TuxCare onboarded version 9.0.1. The fix converts envelope.size to a number before concatenating it into the SMTP MAIL FROM command, effectively preventing ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-c7w3-x93f-qmm8" }, "impact_statement": "not_affected \u2014 The target version 9.0.1 is NOT AFFECTED by GHSA-c7w3-x93f-qmm8. The upstream vendor (Andris Reinman) fixed this SMTP command injection vulnerability in commit 2d7b9710 on 2026-03-25, which was already present in the upstream release before TuxCare onboarded version 9.0.1. The fix converts envelope.size to a number before concatenating it into the SMTP MAIL FROM command, effectively preventing ..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.1", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-cc9r-2j5m-2m83 affects version 9.0.1 of nodemailer.", "vulnerability": { "name": "GHSA-cc9r-2j5m-2m83" }, "action_statement": "Vulnerability GHSA-cc9r-2j5m-2m83 affects version 9.0.1 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.1", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.1" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-frj6-5rhh-vwfw is a false positive for nodemailer 9.0.1.", "vulnerability": { "name": "GHSA-frj6-5rhh-vwfw" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.1", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.1" } } ], "timestamp": "2026-11-04T22:49:29.317726+00:00", "status_notes": "Vulnerability GHSA-g57g-f23g-4646 affects version 9.0.1 of nodemailer, and is fixed in 9.0.1-tuxcare.7.", "vulnerability": { "name": "GHSA-g57g-f23g-4646" }, "action_statement": "Vulnerability GHSA-g57g-f23g-4646 affects version 9.0.1 of nodemailer, and is fixed in 9.0.1-tuxcare.7." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.1", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.1" } } ], "timestamp": "2026-10-28T18:25:50.594919+00:00", "status_notes": "Vulnerability GHSA-g73g-hqqh-jr95 affects version 9.0.1 of nodemailer, and is fixed in 9.0.1-tuxcare.6.", "vulnerability": { "name": "GHSA-g73g-hqqh-jr95" }, "action_statement": "Vulnerability GHSA-g73g-hqqh-jr95 affects version 9.0.1 of nodemailer, and is fixed in 9.0.1-tuxcare.6." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.1", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.1" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-h3hj-cmcx-xc66 is a false positive for nodemailer 9.0.1.", "vulnerability": { "name": "GHSA-h3hj-cmcx-xc66" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.1", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.1" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-jj37-3377-m6vv is a false positive for nodemailer 9.0.1.", "vulnerability": { "name": "GHSA-jj37-3377-m6vv" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.1", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.1" } } ], "timestamp": "2026-10-27T12:04:00.097259+00:00", "status_notes": "Vulnerability GHSA-m943-m63m-w62w affects version 9.0.1 of nodemailer, and is fixed in 9.0.1-tuxcare.5.", "vulnerability": { "name": "GHSA-m943-m63m-w62w" }, "action_statement": "Vulnerability GHSA-m943-m63m-w62w affects version 9.0.1 of nodemailer, and is fixed in 9.0.1-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.1", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.1" } } ], "timestamp": "2026-10-12T23:13:00.090427+00:00", "status_notes": "Vulnerability GHSA-v53p-9fqp-m79j affects version 9.0.1 of nodemailer, and is fixed in 9.0.1-tuxcare.2.", "vulnerability": { "name": "GHSA-v53p-9fqp-m79j" }, "action_statement": "Vulnerability GHSA-v53p-9fqp-m79j affects version 9.0.1 of nodemailer, and is fixed in 9.0.1-tuxcare.2." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.1", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.1" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-vm5r-23w9-m8hx is a false positive for nodemailer 9.0.1.", "vulnerability": { "name": "GHSA-vm5r-23w9-m8hx" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.1", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.1" } } ], "timestamp": "2026-11-03T17:17:53.657243+00:00", "status_notes": "Vulnerability GHSA-vvjj-xcjg-gr5g does not affect version 9.0.1 of nodemailer. not_affected \u2014 The target repository (nodemailer 9.0.1-tuxcare.6) is NOT AFFECTED by GHSA-vvjj-xcjg-gr5g. The vulnerability (SMTP command injection via CRLF sequences in the transport `name` option) was already fixed by the upstream maintainer Andris Reinman in commit 0a43876, which was included in the upstream release that TuxCare onboarded. The fix sanitizes `options.name` by stripping all CRLF characters a...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-vvjj-xcjg-gr5g" }, "impact_statement": "not_affected \u2014 The target repository (nodemailer 9.0.1-tuxcare.6) is NOT AFFECTED by GHSA-vvjj-xcjg-gr5g. The vulnerability (SMTP command injection via CRLF sequences in the transport `name` option) was already fixed by the upstream maintainer Andris Reinman in commit 0a43876, which was included in the upstream release that TuxCare onboarded. The fix sanitizes `options.name` by stripping all CRLF characters a..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.1", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-wmmp-3585-3rmp affects version 9.0.1 of nodemailer.", "vulnerability": { "name": "GHSA-wmmp-3585-3rmp" }, "action_statement": "Vulnerability GHSA-wmmp-3585-3rmp affects version 9.0.1 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.1", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.1" } } ], "timestamp": "2026-11-03T17:20:54.241430+00:00", "status_notes": "Vulnerability GHSA-wqvq-jvpq-h66f does not affect version 9.0.1 of nodemailer. not_affected \u2014 The target nodemailer 9.0.1-tuxcare.6 is NOT AFFECTED by GHSA-wqvq-jvpq-h66f. The vulnerability (jsonTransport bypass of disableFileAccess/disableUrlAccess) was fixed in the upstream v9.0.1 release by commit 5f69497 (authored by andris@reinman.eu, committed May 26, 2026) before TuxCare onboarded this version. The fix is fully present in HEAD: shared.resolveContent() enforces both access flags b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wqvq-jvpq-h66f" }, "impact_statement": "not_affected \u2014 The target nodemailer 9.0.1-tuxcare.6 is NOT AFFECTED by GHSA-wqvq-jvpq-h66f. The vulnerability (jsonTransport bypass of disableFileAccess/disableUrlAccess) was fixed in the upstream v9.0.1 release by commit 5f69497 (authored by andris@reinman.eu, committed May 26, 2026) before TuxCare onboarded this version. The fix is fully present in HEAD: shared.resolveContent() enforces both access flags b..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.1", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.1" } } ], "timestamp": "2026-10-22T17:05:00.556684+00:00", "status_notes": "Vulnerability GHSA-wxxx-r42m-9rp8 is a false positive for nodemailer 9.0.1.", "vulnerability": { "name": "GHSA-wxxx-r42m-9rp8" }, "impact_statement": "The vulnerability has been withdrawn." } ] }