{ "@id": "urn:uuid:3ec14cff-fcd5-4c21-89ac-28f14139adcf", "role": "Document Creator", "author": "https://tuxcare.com", "version": 35, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-10T19:05:36.986319+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.6" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2020-7769 affects version 9.0.6 of nodemailer.", "vulnerability": { "name": "CVE-2020-7769" }, "action_statement": "Vulnerability CVE-2020-7769 affects version 9.0.6 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.6" } } ], "timestamp": "2026-11-03T17:17:53.657243+00:00", "status_notes": "Vulnerability CVE-2021-23400 does not affect version 9.0.6 of nodemailer. not_affected \u2014 CVE-2021-23400 (HTTP Header Injection via newlines/carriage returns in email addresses) is not present in the target. The upstream fix from nodemailer v6.6.1 (commit 7e02648, 2021-05-23) was already shipped in the upstream release before TuxCare began maintaining version 9.0.6. The target contains the defense at lib/mime-node/index.js:1436 which strips control characters including newlines and ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-23400" }, "impact_statement": "not_affected \u2014 CVE-2021-23400 (HTTP Header Injection via newlines/carriage returns in email addresses) is not present in the target. The upstream fix from nodemailer v6.6.1 (commit 7e02648, 2021-05-23) was already shipped in the upstream release before TuxCare began maintaining version 9.0.6. The target contains the defense at lib/mime-node/index.js:1436 which strips control characters including newlines and ..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.6" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2025-13033 affects version 9.0.6 of nodemailer.", "vulnerability": { "name": "CVE-2025-13033" }, "action_statement": "Vulnerability CVE-2025-13033 affects version 9.0.6 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.6" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2025-14874 affects version 9.0.6 of nodemailer.", "vulnerability": { "name": "CVE-2025-14874" }, "action_statement": "Vulnerability CVE-2025-14874 affects version 9.0.6 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.6" } } ], "timestamp": "2026-11-04T12:04:50.502212+00:00", "status_notes": "Vulnerability CVE-2026-100699 affects version 9.0.6 of nodemailer, and is fixed in 9.0.6-tuxcare.8.", "vulnerability": { "name": "CVE-2026-100699" }, "action_statement": "Vulnerability CVE-2026-100699 affects version 9.0.6 of nodemailer, and is fixed in 9.0.6-tuxcare.8." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.6" } } ], "timestamp": "2026-10-12T12:02:05.374422+00:00", "status_notes": "Vulnerability CVE-2026-100700 affects version 9.0.6 of nodemailer, and is fixed in 9.0.6-tuxcare.1.", "vulnerability": { "name": "CVE-2026-100700" }, "action_statement": "Vulnerability CVE-2026-100700 affects version 9.0.6 of nodemailer, and is fixed in 9.0.6-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.6" } } ], "timestamp": "2026-10-16T08:27:00.090163+00:00", "status_notes": "Vulnerability CVE-2026-100701 affects version 9.0.6 of nodemailer, and is fixed in 9.0.6-tuxcare.2.", "vulnerability": { "name": "CVE-2026-100701" }, "action_statement": "Vulnerability CVE-2026-100701 affects version 9.0.6 of nodemailer, and is fixed in 9.0.6-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.6" } } ], "timestamp": "2026-10-12T12:02:05.374422+00:00", "status_notes": "Vulnerability CVE-2026-100702 affects version 9.0.6 of nodemailer, and is fixed in 9.0.6-tuxcare.1.", "vulnerability": { "name": "CVE-2026-100702" }, "action_statement": "Vulnerability CVE-2026-100702 affects version 9.0.6 of nodemailer, and is fixed in 9.0.6-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.6" } } ], "timestamp": "2026-10-19T21:34:00.116670+00:00", "status_notes": "Vulnerability CVE-2026-110869 affects version 9.0.6 of nodemailer, and is fixed in 9.0.6-tuxcare.3.", "vulnerability": { "name": "CVE-2026-110869" }, "action_statement": "Vulnerability CVE-2026-110869 affects version 9.0.6 of nodemailer, and is fixed in 9.0.6-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.6" } } ], "timestamp": "2026-10-28T10:36:43.203557+00:00", "status_notes": "Vulnerability CVE-2026-110870 affects version 9.0.6 of nodemailer, and is fixed in 9.0.6-tuxcare.7.", "vulnerability": { "name": "CVE-2026-110870" }, "action_statement": "Vulnerability CVE-2026-110870 affects version 9.0.6 of nodemailer, and is fixed in 9.0.6-tuxcare.7." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.6" } } ], "timestamp": "2026-10-20T08:51:00.106716+00:00", "status_notes": "Vulnerability CVE-2026-110871 affects version 9.0.6 of nodemailer, and is fixed in 9.0.6-tuxcare.4.", "vulnerability": { "name": "CVE-2026-110871" }, "action_statement": "Vulnerability CVE-2026-110871 affects version 9.0.6 of nodemailer, and is fixed in 9.0.6-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.6" } } ], "timestamp": "2026-10-19T21:34:00.116670+00:00", "status_notes": "Vulnerability CVE-2026-110872 affects version 9.0.6 of nodemailer, and is fixed in 9.0.6-tuxcare.3.", "vulnerability": { "name": "CVE-2026-110872" }, "action_statement": "Vulnerability CVE-2026-110872 affects version 9.0.6 of nodemailer, and is fixed in 9.0.6-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.6" } } ], "timestamp": "2026-11-07T16:44:00.030636+00:00", "status_notes": "Vulnerability CVE-2026-121424 affects version 9.0.6 of nodemailer, and is fixed in 9.0.6-tuxcare.5.", "vulnerability": { "name": "CVE-2026-121424" }, "action_statement": "Vulnerability CVE-2026-121424 affects version 9.0.6 of nodemailer, and is fixed in 9.0.6-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.6" } } ], "timestamp": "2026-11-07T16:44:00.030636+00:00", "status_notes": "Vulnerability CVE-2026-121425 affects version 9.0.6 of nodemailer, and is fixed in 9.0.6-tuxcare.6.", "vulnerability": { "name": "CVE-2026-121425" }, "action_statement": "Vulnerability CVE-2026-121425 affects version 9.0.6 of nodemailer, and is fixed in 9.0.6-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.6" } } ], "timestamp": "2026-11-07T16:44:00.030636+00:00", "status_notes": "Vulnerability CVE-2026-121426 affects version 9.0.6 of nodemailer, and is fixed in 9.0.6-tuxcare.6.", "vulnerability": { "name": "CVE-2026-121426" }, "action_statement": "Vulnerability CVE-2026-121426 affects version 9.0.6 of nodemailer, and is fixed in 9.0.6-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.6" } } ], "timestamp": "2026-11-10T19:05:36.986319+00:00", "status_notes": "Vulnerability CVE-2026-125755 affects version 9.0.6 of nodemailer, and is fixed in 9.0.6-tuxcare.9.", "vulnerability": { "name": "CVE-2026-125755" }, "action_statement": "Vulnerability CVE-2026-125755 affects version 9.0.6 of nodemailer, and is fixed in 9.0.6-tuxcare.9." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.6" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2026-82659 affects version 9.0.6 of nodemailer.", "vulnerability": { "name": "CVE-2026-82659" }, "action_statement": "Vulnerability CVE-2026-82659 affects version 9.0.6 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.6" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2026-82662 affects version 9.0.6 of nodemailer.", "vulnerability": { "name": "CVE-2026-82662" }, "action_statement": "Vulnerability CVE-2026-82662 affects version 9.0.6 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.6" } } ], "timestamp": "2026-11-03T22:35:26.557332+00:00", "status_notes": "Vulnerability CVE-2026-82854 does not affect version 9.0.6 of nodemailer. not_affected \u2014 The target nodemailer version 9.0.6-tuxcare.7 is NOT AFFECTED by CVE-2026-82854. The upstream fix (commit 2d7b9710e63555a1eb13d721296c51186d4b5651 by Andris Reinman) that sanitizes envelope.size to prevent SMTP command injection was already present in the upstream release before TuxCare onboarded this version. The vulnerable pattern (direct string concatenation of unsanitized envelope.size into...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-82854" }, "impact_statement": "not_affected \u2014 The target nodemailer version 9.0.6-tuxcare.7 is NOT AFFECTED by CVE-2026-82854. The upstream fix (commit 2d7b9710e63555a1eb13d721296c51186d4b5651 by Andris Reinman) that sanitizes envelope.size to prevent SMTP command injection was already present in the upstream release before TuxCare onboarded this version. The vulnerable pattern (direct string concatenation of unsanitized envelope.size into..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.6" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2026-90776 affects version 9.0.6 of nodemailer.", "vulnerability": { "name": "CVE-2026-90776" }, "action_statement": "Vulnerability CVE-2026-90776 affects version 9.0.6 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.6" } } ], "timestamp": "2026-10-12T12:02:05.374422+00:00", "status_notes": "Vulnerability CVE-2026-92595 affects version 9.0.6 of nodemailer, and is fixed in 9.0.6-tuxcare.1.", "vulnerability": { "name": "CVE-2026-92595" }, "action_statement": "Vulnerability CVE-2026-92595 affects version 9.0.6 of nodemailer, and is fixed in 9.0.6-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.6" } } ], "timestamp": "2026-10-12T12:02:05.374422+00:00", "status_notes": "Vulnerability CVE-2026-92597 affects version 9.0.6 of nodemailer, and is fixed in 9.0.6-tuxcare.1.", "vulnerability": { "name": "CVE-2026-92597" }, "action_statement": "Vulnerability CVE-2026-92597 affects version 9.0.6 of nodemailer, and is fixed in 9.0.6-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.6" } } ], "timestamp": "2026-10-12T12:02:05.374422+00:00", "status_notes": "Vulnerability CVE-2026-92598 affects version 9.0.6 of nodemailer, and is fixed in 9.0.6-tuxcare.1.", "vulnerability": { "name": "CVE-2026-92598" }, "action_statement": "Vulnerability CVE-2026-92598 affects version 9.0.6 of nodemailer, and is fixed in 9.0.6-tuxcare.1." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.6" } } ], "timestamp": "2026-11-03T17:13:05.282153+00:00", "status_notes": "Vulnerability GHSA-268h-hp4c-crq3 does not affect version 9.0.6 of nodemailer. not_affected \u2014 The target nodemailer 9.0.6-tuxcare.7 is NOT affected by GHSA-268h-hp4c-crq3 (CRLF injection in List-* headers). The vulnerability was already fixed by the upstream vendor (Andris Reinman) in commit 5f694977da2e0e13dc947037566e8e689a01217e, which shipped in the upstream release that TuxCare onboarded. The fix strips CR and LF characters from list.*.comment fields before constructing prepared he...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-268h-hp4c-crq3" }, "impact_statement": "not_affected \u2014 The target nodemailer 9.0.6-tuxcare.7 is NOT affected by GHSA-268h-hp4c-crq3 (CRLF injection in List-* headers). The vulnerability was already fixed by the upstream vendor (Andris Reinman) in commit 5f694977da2e0e13dc947037566e8e689a01217e, which shipped in the upstream release that TuxCare onboarded. The fix strips CR and LF characters from list.*.comment fields before constructing prepared he..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.6" } } ], "timestamp": "2026-10-12T12:02:05.374422+00:00", "status_notes": "Vulnerability GHSA-2x7j-588g-ccc2 affects version 9.0.6 of nodemailer, and is fixed in 9.0.6-tuxcare.1.", "vulnerability": { "name": "GHSA-2x7j-588g-ccc2" }, "action_statement": "Vulnerability GHSA-2x7j-588g-ccc2 affects version 9.0.6 of nodemailer, and is fixed in 9.0.6-tuxcare.1." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.6" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-46j5-6fg5-4gv3 is a false positive for nodemailer 9.0.6.", "vulnerability": { "name": "GHSA-46j5-6fg5-4gv3" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.6" } } ], "timestamp": "2026-10-27T15:13:32.414812+00:00", "status_notes": "Vulnerability GHSA-4ffr-jq9g-5ffx affects version 9.0.6 of nodemailer.", "vulnerability": { "name": "GHSA-4ffr-jq9g-5ffx" }, "action_statement": "Vulnerability GHSA-4ffr-jq9g-5ffx affects version 9.0.6 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.6" } } ], "timestamp": "2026-10-27T15:13:32.414812+00:00", "status_notes": "Vulnerability GHSA-4g23-2xm8-66gc affects version 9.0.6 of nodemailer.", "vulnerability": { "name": "GHSA-4g23-2xm8-66gc" }, "action_statement": "Vulnerability GHSA-4g23-2xm8-66gc affects version 9.0.6 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.6" } } ], "timestamp": "2026-10-15T12:59:26.638264+00:00", "status_notes": "Vulnerability GHSA-6vj9-mwq6-2f5v affects version 9.0.6 of nodemailer.", "vulnerability": { "name": "GHSA-6vj9-mwq6-2f5v" }, "action_statement": "Vulnerability GHSA-6vj9-mwq6-2f5v affects version 9.0.6 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.6" } } ], "timestamp": "2026-10-27T14:03:00.454707+00:00", "status_notes": "Vulnerability GHSA-85x2-q946-cp5h affects version 9.0.6 of nodemailer, and is fixed in 9.0.6-tuxcare.6.", "vulnerability": { "name": "GHSA-85x2-q946-cp5h" }, "action_statement": "Vulnerability GHSA-85x2-q946-cp5h affects version 9.0.6 of nodemailer, and is fixed in 9.0.6-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.6" } } ], "timestamp": "2026-10-27T11:55:21.433196+00:00", "status_notes": "Vulnerability GHSA-8c8m-p3m8-cjg8 affects version 9.0.6 of nodemailer, and is fixed in 9.0.6-tuxcare.5.", "vulnerability": { "name": "GHSA-8c8m-p3m8-cjg8" }, "action_statement": "Vulnerability GHSA-8c8m-p3m8-cjg8 affects version 9.0.6 of nodemailer, and is fixed in 9.0.6-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.6" } } ], "timestamp": "2026-10-12T12:02:05.374422+00:00", "status_notes": "Vulnerability GHSA-8m3c-c648-2xjj affects version 9.0.6 of nodemailer, and is fixed in 9.0.6-tuxcare.1.", "vulnerability": { "name": "GHSA-8m3c-c648-2xjj" }, "action_statement": "Vulnerability GHSA-8m3c-c648-2xjj affects version 9.0.6 of nodemailer, and is fixed in 9.0.6-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.6" } } ], "timestamp": "2026-10-12T12:02:05.374422+00:00", "status_notes": "Vulnerability GHSA-8vvx-rff5-p5rq affects version 9.0.6 of nodemailer, and is fixed in 9.0.6-tuxcare.1.", "vulnerability": { "name": "GHSA-8vvx-rff5-p5rq" }, "action_statement": "Vulnerability GHSA-8vvx-rff5-p5rq affects version 9.0.6 of nodemailer, and is fixed in 9.0.6-tuxcare.1." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.6" } } ], "timestamp": "2026-11-03T17:26:36.158776+00:00", "status_notes": "Vulnerability GHSA-9h6g-pr28-7cqp does not affect version 9.0.6 of nodemailer. not_affected \u2014 The target is not affected by GHSA-9h6g-pr28-7cqp. The vulnerable unbounded regex patterns that cause ReDoS have been fixed in the upstream nodemailer v9.0.6 release. The target repository at version 9.0.6-tuxcare.7 inherited these fixes from the upstream release. The vulnerable code patterns are not present in the current codebase.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-9h6g-pr28-7cqp" }, "impact_statement": "not_affected \u2014 The target is not affected by GHSA-9h6g-pr28-7cqp. The vulnerable unbounded regex patterns that cause ReDoS have been fixed in the upstream nodemailer v9.0.6 release. The target repository at version 9.0.6-tuxcare.7 inherited these fixes from the upstream release. The vulnerable code patterns are not present in the current codebase." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.6" } } ], "timestamp": "2026-11-03T17:27:52.523797+00:00", "status_notes": "Vulnerability GHSA-c7w3-x93f-qmm8 does not affect version 9.0.6 of nodemailer. not_affected \u2014 The target is NOT AFFECTED. The vulnerable pattern (unsanitized concatenation of envelope.size into SMTP commands) is not present because the upstream fix (commit 2d7b9710 by Andris Reinman) was already shipped in nodemailer v8.0.4, before TuxCare started maintaining version 9.0.6-tuxcare.7. The target code at lib/smtp-connection/index.js:1349-1353 contains the complete fix: envelope.size is co...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-c7w3-x93f-qmm8" }, "impact_statement": "not_affected \u2014 The target is NOT AFFECTED. The vulnerable pattern (unsanitized concatenation of envelope.size into SMTP commands) is not present because the upstream fix (commit 2d7b9710 by Andris Reinman) was already shipped in nodemailer v8.0.4, before TuxCare started maintaining version 9.0.6-tuxcare.7. The target code at lib/smtp-connection/index.js:1349-1353 contains the complete fix: envelope.size is co..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.6" } } ], "timestamp": "2026-10-12T12:02:05.374422+00:00", "status_notes": "Vulnerability GHSA-cc9r-2j5m-2m83 affects version 9.0.6 of nodemailer, and is fixed in 9.0.6-tuxcare.1.", "vulnerability": { "name": "GHSA-cc9r-2j5m-2m83" }, "action_statement": "Vulnerability GHSA-cc9r-2j5m-2m83 affects version 9.0.6 of nodemailer, and is fixed in 9.0.6-tuxcare.1." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.6" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-frj6-5rhh-vwfw is a false positive for nodemailer 9.0.6.", "vulnerability": { "name": "GHSA-frj6-5rhh-vwfw" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.6" } } ], "timestamp": "2026-11-04T12:04:50.502212+00:00", "status_notes": "Vulnerability GHSA-g57g-f23g-4646 affects version 9.0.6 of nodemailer, and is fixed in 9.0.6-tuxcare.8.", "vulnerability": { "name": "GHSA-g57g-f23g-4646" }, "action_statement": "Vulnerability GHSA-g57g-f23g-4646 affects version 9.0.6 of nodemailer, and is fixed in 9.0.6-tuxcare.8." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.6" } } ], "timestamp": "2026-10-28T10:36:43.203557+00:00", "status_notes": "Vulnerability GHSA-g73g-hqqh-jr95 affects version 9.0.6 of nodemailer, and is fixed in 9.0.6-tuxcare.7.", "vulnerability": { "name": "GHSA-g73g-hqqh-jr95" }, "action_statement": "Vulnerability GHSA-g73g-hqqh-jr95 affects version 9.0.6 of nodemailer, and is fixed in 9.0.6-tuxcare.7." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.6" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-h3hj-cmcx-xc66 is a false positive for nodemailer 9.0.6.", "vulnerability": { "name": "GHSA-h3hj-cmcx-xc66" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.6" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-jj37-3377-m6vv is a false positive for nodemailer 9.0.6.", "vulnerability": { "name": "GHSA-jj37-3377-m6vv" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.6" } } ], "timestamp": "2026-10-27T14:03:00.454707+00:00", "status_notes": "Vulnerability GHSA-m943-m63m-w62w affects version 9.0.6 of nodemailer, and is fixed in 9.0.6-tuxcare.6.", "vulnerability": { "name": "GHSA-m943-m63m-w62w" }, "action_statement": "Vulnerability GHSA-m943-m63m-w62w affects version 9.0.6 of nodemailer, and is fixed in 9.0.6-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.6" } } ], "timestamp": "2026-10-12T12:02:05.374422+00:00", "status_notes": "Vulnerability GHSA-v53p-9fqp-m79j affects version 9.0.6 of nodemailer, and is fixed in 9.0.6-tuxcare.1.", "vulnerability": { "name": "GHSA-v53p-9fqp-m79j" }, "action_statement": "Vulnerability GHSA-v53p-9fqp-m79j affects version 9.0.6 of nodemailer, and is fixed in 9.0.6-tuxcare.1." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.6" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-vm5r-23w9-m8hx is a false positive for nodemailer 9.0.6.", "vulnerability": { "name": "GHSA-vm5r-23w9-m8hx" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.6" } } ], "timestamp": "2026-11-03T17:17:53.657243+00:00", "status_notes": "Vulnerability GHSA-vvjj-xcjg-gr5g does not affect version 9.0.6 of nodemailer. not_affected \u2014 Target nodemailer 9.0.6-tuxcare.7 is NOT AFFECTED. The SMTP command injection vulnerability (GHSA-vvjj-xcjg-gr5g) via CRLF sequences in the transport `name` option was fixed by upstream vendor Andris Reinman in commit 0a43876 on 2026-04-07. The fix sanitizes `this.name` at assignment (line 121) with `.toString().replace(/[\\r\\n]+/g, '')`, protecting all five SMTP command construction points (EHL...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-vvjj-xcjg-gr5g" }, "impact_statement": "not_affected \u2014 Target nodemailer 9.0.6-tuxcare.7 is NOT AFFECTED. The SMTP command injection vulnerability (GHSA-vvjj-xcjg-gr5g) via CRLF sequences in the transport `name` option was fixed by upstream vendor Andris Reinman in commit 0a43876 on 2026-04-07. The fix sanitizes `this.name` at assignment (line 121) with `.toString().replace(/[\\r\\n]+/g, '')`, protecting all five SMTP command construction points (EHL..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.6" } } ], "timestamp": "2026-10-12T12:02:05.374422+00:00", "status_notes": "Vulnerability GHSA-wmmp-3585-3rmp affects version 9.0.6 of nodemailer, and is fixed in 9.0.6-tuxcare.1.", "vulnerability": { "name": "GHSA-wmmp-3585-3rmp" }, "action_statement": "Vulnerability GHSA-wmmp-3585-3rmp affects version 9.0.6 of nodemailer, and is fixed in 9.0.6-tuxcare.1." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.6" } } ], "timestamp": "2026-11-03T17:22:22.486046+00:00", "status_notes": "Vulnerability GHSA-wqvq-jvpq-h66f does not affect version 9.0.6 of nodemailer. not_affected \u2014 The target nodemailer 9.0.6-tuxcare.7 is NOT AFFECTED by GHSA-wqvq-jvpq-h66f. The vulnerability (jsonTransport bypassing disableFileAccess/disableUrlAccess security flags) was fixed in upstream commit 5f694977 by the upstream maintainer Andris Reinman, and this fix was already included in the upstream v9.0.6 release that TuxCare onboarded. All three components of the fix are present: (1) lib/sh...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wqvq-jvpq-h66f" }, "impact_statement": "not_affected \u2014 The target nodemailer 9.0.6-tuxcare.7 is NOT AFFECTED by GHSA-wqvq-jvpq-h66f. The vulnerability (jsonTransport bypassing disableFileAccess/disableUrlAccess security flags) was fixed in upstream commit 5f694977 by the upstream maintainer Andris Reinman, and this fix was already included in the upstream v9.0.6 release that TuxCare onboarded. All three components of the fix are present: (1) lib/sh..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.0.6", "identifiers": { "purl": "pkg:npm/nodemailer@9.0.6" } } ], "timestamp": "2026-10-22T17:05:00.556684+00:00", "status_notes": "Vulnerability GHSA-wxxx-r42m-9rp8 is a false positive for nodemailer 9.0.6.", "vulnerability": { "name": "GHSA-wxxx-r42m-9rp8" }, "impact_statement": "The vulnerability has been withdrawn." } ] }