{ "@id": "urn:uuid:1c19d0da-fc0e-43c6-b86f-9167c112371e", "role": "Document Creator", "author": "https://tuxcare.com", "version": 37, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-10T17:44:32.491493+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.1.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.1.0" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2020-7769 affects version 9.1.0 of nodemailer.", "vulnerability": { "name": "CVE-2020-7769" }, "action_statement": "Vulnerability CVE-2020-7769 affects version 9.1.0 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.1.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.1.0" } } ], "timestamp": "2026-11-03T17:16:29.149062+00:00", "status_notes": "Vulnerability CVE-2021-23400 does not affect version 9.1.0 of nodemailer. not_affected \u2014 CVE-2021-23400 (HTTP Header Injection via newlines/carriage returns in email addresses) is NOT present in nodemailer 9.1.0-tuxcare.8. The vulnerability was fixed in upstream version 6.6.1 (commit 7e02648, May 2021) by stripping control characters from email addresses. This fix shipped in the upstream release that TuxCare onboarded, confirmed by verifying the fix commit (authored by andris@kreat...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2021-23400" }, "impact_statement": "not_affected \u2014 CVE-2021-23400 (HTTP Header Injection via newlines/carriage returns in email addresses) is NOT present in nodemailer 9.1.0-tuxcare.8. The vulnerability was fixed in upstream version 6.6.1 (commit 7e02648, May 2021) by stripping control characters from email addresses. This fix shipped in the upstream release that TuxCare onboarded, confirmed by verifying the fix commit (authored by andris@kreat..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.1.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.1.0" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2025-13033 affects version 9.1.0 of nodemailer.", "vulnerability": { "name": "CVE-2025-13033" }, "action_statement": "Vulnerability CVE-2025-13033 affects version 9.1.0 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.1.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.1.0" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2025-14874 affects version 9.1.0 of nodemailer.", "vulnerability": { "name": "CVE-2025-14874" }, "action_statement": "Vulnerability CVE-2025-14874 affects version 9.1.0 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.1.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.1.0" } } ], "timestamp": "2026-10-01T11:11:44.028700+00:00", "status_notes": "Vulnerability CVE-2026-100699 affects version 9.1.0 of nodemailer, and is fixed in 9.1.0-tuxcare.4.", "vulnerability": { "name": "CVE-2026-100699" }, "action_statement": "Vulnerability CVE-2026-100699 affects version 9.1.0 of nodemailer, and is fixed in 9.1.0-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.1.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.1.0" } } ], "timestamp": "2026-10-01T13:26:37.692920+00:00", "status_notes": "Vulnerability CVE-2026-100700 affects version 9.1.0 of nodemailer, and is fixed in 9.1.0-tuxcare.5.", "vulnerability": { "name": "CVE-2026-100700" }, "action_statement": "Vulnerability CVE-2026-100700 affects version 9.1.0 of nodemailer, and is fixed in 9.1.0-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.1.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.1.0" } } ], "timestamp": "2026-09-29T21:49:02.334395+00:00", "status_notes": "Vulnerability CVE-2026-100702 affects version 9.1.0 of nodemailer, and is fixed in 9.1.0-tuxcare.3.", "vulnerability": { "name": "CVE-2026-100702" }, "action_statement": "Vulnerability CVE-2026-100702 affects version 9.1.0 of nodemailer, and is fixed in 9.1.0-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.1.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.1.0" } } ], "timestamp": "2026-10-20T05:15:06.966747+00:00", "status_notes": "Vulnerability CVE-2026-110869 affects version 9.1.0 of nodemailer, and is fixed in 9.1.0-tuxcare.6.", "vulnerability": { "name": "CVE-2026-110869" }, "action_statement": "Vulnerability CVE-2026-110869 affects version 9.1.0 of nodemailer, and is fixed in 9.1.0-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.1.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.1.0" } } ], "timestamp": "2026-10-28T09:48:17.847708+00:00", "status_notes": "Vulnerability CVE-2026-110870 affects version 9.1.0 of nodemailer, and is fixed in 9.1.0-tuxcare.8.", "vulnerability": { "name": "CVE-2026-110870" }, "action_statement": "Vulnerability CVE-2026-110870 affects version 9.1.0 of nodemailer, and is fixed in 9.1.0-tuxcare.8." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.1.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.1.0" } } ], "timestamp": "2026-10-20T05:15:06.966747+00:00", "status_notes": "Vulnerability CVE-2026-110871 affects version 9.1.0 of nodemailer, and is fixed in 9.1.0-tuxcare.6.", "vulnerability": { "name": "CVE-2026-110871" }, "action_statement": "Vulnerability CVE-2026-110871 affects version 9.1.0 of nodemailer, and is fixed in 9.1.0-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.1.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.1.0" } } ], "timestamp": "2026-10-20T05:15:06.966747+00:00", "status_notes": "Vulnerability CVE-2026-110872 affects version 9.1.0 of nodemailer, and is fixed in 9.1.0-tuxcare.6.", "vulnerability": { "name": "CVE-2026-110872" }, "action_statement": "Vulnerability CVE-2026-110872 affects version 9.1.0 of nodemailer, and is fixed in 9.1.0-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.1.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.1.0" } } ], "timestamp": "2026-11-07T16:44:00.030636+00:00", "status_notes": "Vulnerability CVE-2026-121424 affects version 9.1.0 of nodemailer, and is fixed in 9.1.0-tuxcare.7.", "vulnerability": { "name": "CVE-2026-121424" }, "action_statement": "Vulnerability CVE-2026-121424 affects version 9.1.0 of nodemailer, and is fixed in 9.1.0-tuxcare.7." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.1.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.1.0" } } ], "timestamp": "2026-11-07T16:44:00.030636+00:00", "status_notes": "Vulnerability CVE-2026-121425 affects version 9.1.0 of nodemailer, and is fixed in 9.1.0-tuxcare.7.", "vulnerability": { "name": "CVE-2026-121425" }, "action_statement": "Vulnerability CVE-2026-121425 affects version 9.1.0 of nodemailer, and is fixed in 9.1.0-tuxcare.7." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.1.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.1.0" } } ], "timestamp": "2026-11-07T16:44:00.030636+00:00", "status_notes": "Vulnerability CVE-2026-121426 affects version 9.1.0 of nodemailer, and is fixed in 9.1.0-tuxcare.7.", "vulnerability": { "name": "CVE-2026-121426" }, "action_statement": "Vulnerability CVE-2026-121426 affects version 9.1.0 of nodemailer, and is fixed in 9.1.0-tuxcare.7." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.1.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.1.0" } } ], "timestamp": "2026-11-10T17:44:32.491493+00:00", "status_notes": "Vulnerability CVE-2026-125755 affects version 9.1.0 of nodemailer, and is fixed in 9.1.0-tuxcare.9.", "vulnerability": { "name": "CVE-2026-125755" }, "action_statement": "Vulnerability CVE-2026-125755 affects version 9.1.0 of nodemailer, and is fixed in 9.1.0-tuxcare.9." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.1.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.1.0" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2026-82659 affects version 9.1.0 of nodemailer.", "vulnerability": { "name": "CVE-2026-82659" }, "action_statement": "Vulnerability CVE-2026-82659 affects version 9.1.0 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.1.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.1.0" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability CVE-2026-82662 affects version 9.1.0 of nodemailer.", "vulnerability": { "name": "CVE-2026-82662" }, "action_statement": "Vulnerability CVE-2026-82662 affects version 9.1.0 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.1.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.1.0" } } ], "timestamp": "2026-11-03T22:35:17.003324+00:00", "status_notes": "Vulnerability CVE-2026-82854 does not affect version 9.1.0 of nodemailer. not_affected \u2014 CVE-2026-82854 describes an SMTP command injection vulnerability through unsanitized envelope.size parameter in Nodemailer before 8.0.4. The target repository (nodemailer 9.1.0-tuxcare.8) contains the upstream fix commit 2d7b9710 by Andris Reinman that sanitizes envelope.size by converting it to a Number before concatenation into SMTP commands. This fix was already present in the upstream relea...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-82854" }, "impact_statement": "not_affected \u2014 CVE-2026-82854 describes an SMTP command injection vulnerability through unsanitized envelope.size parameter in Nodemailer before 8.0.4. The target repository (nodemailer 9.1.0-tuxcare.8) contains the upstream fix commit 2d7b9710 by Andris Reinman that sanitizes envelope.size by converting it to a Number before concatenation into SMTP commands. This fix was already present in the upstream relea..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.1.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.1.0" } } ], "timestamp": "2026-10-01T11:11:44.028700+00:00", "status_notes": "Vulnerability CVE-2026-90776 affects version 9.1.0 of nodemailer, and is fixed in 9.1.0-tuxcare.4.", "vulnerability": { "name": "CVE-2026-90776" }, "action_statement": "Vulnerability CVE-2026-90776 affects version 9.1.0 of nodemailer, and is fixed in 9.1.0-tuxcare.4." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.1.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.1.0" } } ], "timestamp": "2026-11-03T17:12:26.130269+00:00", "status_notes": "Vulnerability GHSA-268h-hp4c-crq3 does not affect version 9.1.0 of nodemailer. not_affected \u2014 The target repository (nodemailer 9.1.0-tuxcare.8 at SHA 41916f8e) is NOT AFFECTED by GHSA-268h-hp4c-crq3. The CRLF injection vulnerability in List-* header comments was fixed by upstream commit 5f69497 (authored by Andris Reinman on 2026-05-26), which strips CR/LF from list.*.comment fields before inserting them into prepared headers. This upstream fix was already present in the nodemailer 9.1...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-268h-hp4c-crq3" }, "impact_statement": "not_affected \u2014 The target repository (nodemailer 9.1.0-tuxcare.8 at SHA 41916f8e) is NOT AFFECTED by GHSA-268h-hp4c-crq3. The CRLF injection vulnerability in List-* header comments was fixed by upstream commit 5f69497 (authored by Andris Reinman on 2026-05-26), which strips CR/LF from list.*.comment fields before inserting them into prepared headers. This upstream fix was already present in the nodemailer 9.1..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.1.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.1.0" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-2x7j-588g-ccc2 affects version 9.1.0 of nodemailer.", "vulnerability": { "name": "GHSA-2x7j-588g-ccc2" }, "action_statement": "Vulnerability GHSA-2x7j-588g-ccc2 affects version 9.1.0 of nodemailer." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.1.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.1.0" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-46j5-6fg5-4gv3 is a false positive for nodemailer 9.1.0.", "vulnerability": { "name": "GHSA-46j5-6fg5-4gv3" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.1.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.1.0" } } ], "timestamp": "2026-10-27T15:13:32.414812+00:00", "status_notes": "Vulnerability GHSA-4ffr-jq9g-5ffx affects version 9.1.0 of nodemailer.", "vulnerability": { "name": "GHSA-4ffr-jq9g-5ffx" }, "action_statement": "Vulnerability GHSA-4ffr-jq9g-5ffx affects version 9.1.0 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.1.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.1.0" } } ], "timestamp": "2026-10-27T15:13:32.414812+00:00", "status_notes": "Vulnerability GHSA-4g23-2xm8-66gc affects version 9.1.0 of nodemailer.", "vulnerability": { "name": "GHSA-4g23-2xm8-66gc" }, "action_statement": "Vulnerability GHSA-4g23-2xm8-66gc affects version 9.1.0 of nodemailer." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.1.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.1.0" } } ], "timestamp": "2026-09-29T09:02:14.420070+00:00", "status_notes": "Vulnerability GHSA-6vj9-mwq6-2f5v affects version 9.1.0 of nodemailer, and is fixed in 9.1.0-tuxcare.2.", "vulnerability": { "name": "GHSA-6vj9-mwq6-2f5v" }, "action_statement": "Vulnerability GHSA-6vj9-mwq6-2f5v affects version 9.1.0 of nodemailer, and is fixed in 9.1.0-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.1.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.1.0" } } ], "timestamp": "2026-10-27T11:57:00.035223+00:00", "status_notes": "Vulnerability GHSA-85x2-q946-cp5h affects version 9.1.0 of nodemailer, and is fixed in 9.1.0-tuxcare.7.", "vulnerability": { "name": "GHSA-85x2-q946-cp5h" }, "action_statement": "Vulnerability GHSA-85x2-q946-cp5h affects version 9.1.0 of nodemailer, and is fixed in 9.1.0-tuxcare.7." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.1.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.1.0" } } ], "timestamp": "2026-10-27T11:57:00.035223+00:00", "status_notes": "Vulnerability GHSA-8c8m-p3m8-cjg8 affects version 9.1.0 of nodemailer, and is fixed in 9.1.0-tuxcare.7.", "vulnerability": { "name": "GHSA-8c8m-p3m8-cjg8" }, "action_statement": "Vulnerability GHSA-8c8m-p3m8-cjg8 affects version 9.1.0 of nodemailer, and is fixed in 9.1.0-tuxcare.7." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.1.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.1.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-8m3c-c648-2xjj affects version 9.1.0 of nodemailer, and is fixed in 9.1.0-tuxcare.1.", "vulnerability": { "name": "GHSA-8m3c-c648-2xjj" }, "action_statement": "Vulnerability GHSA-8m3c-c648-2xjj affects version 9.1.0 of nodemailer, and is fixed in 9.1.0-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.1.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.1.0" } } ], "timestamp": "2026-09-29T21:49:02.334395+00:00", "status_notes": "Vulnerability GHSA-8vvx-rff5-p5rq affects version 9.1.0 of nodemailer, and is fixed in 9.1.0-tuxcare.3.", "vulnerability": { "name": "GHSA-8vvx-rff5-p5rq" }, "action_statement": "Vulnerability GHSA-8vvx-rff5-p5rq affects version 9.1.0 of nodemailer, and is fixed in 9.1.0-tuxcare.3." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.1.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.1.0" } } ], "timestamp": "2026-11-03T17:26:04.028386+00:00", "status_notes": "Vulnerability GHSA-9h6g-pr28-7cqp does not affect version 9.1.0 of nodemailer. not_affected \u2014 The target nodemailer v9.1.0-tuxcare.8 is not affected by GHSA-9h6g-pr28-7cqp (ReDoS vulnerability in data URI parsing). Both vulnerable code paths have been fixed by upstream commits that were already present in the upstream release before TuxCare onboarding. The fixes eliminate catastrophic regex backtracking by: (1) replacing unbounded regex parsing with deterministic string operations (inde...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-9h6g-pr28-7cqp" }, "impact_statement": "not_affected \u2014 The target nodemailer v9.1.0-tuxcare.8 is not affected by GHSA-9h6g-pr28-7cqp (ReDoS vulnerability in data URI parsing). Both vulnerable code paths have been fixed by upstream commits that were already present in the upstream release before TuxCare onboarding. The fixes eliminate catastrophic regex backtracking by: (1) replacing unbounded regex parsing with deterministic string operations (inde..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.1.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.1.0" } } ], "timestamp": "2026-11-03T17:26:52.290543+00:00", "status_notes": "Vulnerability GHSA-c7w3-x93f-qmm8 does not affect version 9.1.0 of nodemailer. not_affected \u2014 The SMTP command injection vulnerability via unsanitized CRLF in envelope.size (GHSA-c7w3-x93f-qmm8) is NOT present in nodemailer 9.1.0-tuxcare.8. The upstream maintainer Andris Reinman applied the fix in commit 2d7b971 (March 2026), which shipped in v8.0.4 and all subsequent releases including v9.1.0. The target contains the fixed code at lib/smtp-connection/index.js:1349-1354 that casts envel...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-c7w3-x93f-qmm8" }, "impact_statement": "not_affected \u2014 The SMTP command injection vulnerability via unsanitized CRLF in envelope.size (GHSA-c7w3-x93f-qmm8) is NOT present in nodemailer 9.1.0-tuxcare.8. The upstream maintainer Andris Reinman applied the fix in commit 2d7b971 (March 2026), which shipped in v8.0.4 and all subsequent releases including v9.1.0. The target contains the fixed code at lib/smtp-connection/index.js:1349-1354 that casts envel..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.1.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.1.0" } } ], "timestamp": "2026-11-03T17:09:06.581572+00:00", "status_notes": "Vulnerability GHSA-cc9r-2j5m-2m83 does not affect version 9.1.0 of nodemailer. not_affected \u2014 The RFC 5322 comment parsing vulnerability (GHSA-cc9r-2j5m-2m83) is NOT present in nodemailer 9.1.0-tuxcare.8. The upstream fix (commit 902b63e by andris@reinman.eu) was already included in the nodemailer 9.1.0 release that TuxCare onboarded. The vulnerable concatenation behavior across comment boundaries has been replaced with conditional joining logic that prevents domain manipulation attacks...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-cc9r-2j5m-2m83" }, "impact_statement": "not_affected \u2014 The RFC 5322 comment parsing vulnerability (GHSA-cc9r-2j5m-2m83) is NOT present in nodemailer 9.1.0-tuxcare.8. The upstream fix (commit 902b63e by andris@reinman.eu) was already included in the nodemailer 9.1.0 release that TuxCare onboarded. The vulnerable concatenation behavior across comment boundaries has been replaced with conditional joining logic that prevents domain manipulation attacks..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.1.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.1.0" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-frj6-5rhh-vwfw is a false positive for nodemailer 9.1.0.", "vulnerability": { "name": "GHSA-frj6-5rhh-vwfw" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.1.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.1.0" } } ], "timestamp": "2026-10-01T11:11:44.028700+00:00", "status_notes": "Vulnerability GHSA-g57g-f23g-4646 affects version 9.1.0 of nodemailer, and is fixed in 9.1.0-tuxcare.4.", "vulnerability": { "name": "GHSA-g57g-f23g-4646" }, "action_statement": "Vulnerability GHSA-g57g-f23g-4646 affects version 9.1.0 of nodemailer, and is fixed in 9.1.0-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.1.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.1.0" } } ], "timestamp": "2026-10-28T09:48:17.847708+00:00", "status_notes": "Vulnerability GHSA-g73g-hqqh-jr95 affects version 9.1.0 of nodemailer, and is fixed in 9.1.0-tuxcare.8.", "vulnerability": { "name": "GHSA-g73g-hqqh-jr95" }, "action_statement": "Vulnerability GHSA-g73g-hqqh-jr95 affects version 9.1.0 of nodemailer, and is fixed in 9.1.0-tuxcare.8." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.1.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.1.0" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-h3hj-cmcx-xc66 is a false positive for nodemailer 9.1.0.", "vulnerability": { "name": "GHSA-h3hj-cmcx-xc66" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.1.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.1.0" } } ], "timestamp": "2026-10-29T07:57:13.458746+00:00", "status_notes": "Vulnerability GHSA-jj37-3377-m6vv is a false positive for nodemailer 9.1.0.", "vulnerability": { "name": "GHSA-jj37-3377-m6vv" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.1.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.1.0" } } ], "timestamp": "2026-10-27T11:57:00.035223+00:00", "status_notes": "Vulnerability GHSA-m943-m63m-w62w affects version 9.1.0 of nodemailer, and is fixed in 9.1.0-tuxcare.7.", "vulnerability": { "name": "GHSA-m943-m63m-w62w" }, "action_statement": "Vulnerability GHSA-m943-m63m-w62w affects version 9.1.0 of nodemailer, and is fixed in 9.1.0-tuxcare.7." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.1.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.1.0" } } ], "timestamp": "2026-10-01T11:11:44.028700+00:00", "status_notes": "Vulnerability GHSA-prgh-xp8r-p3m5 affects version 9.1.0 of nodemailer, and is fixed in 9.1.0-tuxcare.4.", "vulnerability": { "name": "GHSA-prgh-xp8r-p3m5" }, "action_statement": "Vulnerability GHSA-prgh-xp8r-p3m5 affects version 9.1.0 of nodemailer, and is fixed in 9.1.0-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:npm/nodemailer@9.1.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.1.0" } } ], "timestamp": "2026-10-01T13:26:37.692920+00:00", "status_notes": "Vulnerability GHSA-v53p-9fqp-m79j affects version 9.1.0 of nodemailer, and is fixed in 9.1.0-tuxcare.5.", "vulnerability": { "name": "GHSA-v53p-9fqp-m79j" }, "action_statement": "Vulnerability GHSA-v53p-9fqp-m79j affects version 9.1.0 of nodemailer, and is fixed in 9.1.0-tuxcare.5." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.1.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.1.0" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-vm5r-23w9-m8hx is a false positive for nodemailer 9.1.0.", "vulnerability": { "name": "GHSA-vm5r-23w9-m8hx" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.1.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.1.0" } } ], "timestamp": "2026-11-03T17:19:24.126381+00:00", "status_notes": "Vulnerability GHSA-vvjj-xcjg-gr5g does not affect version 9.1.0 of nodemailer. not_affected \u2014 GHSA-vvjj-xcjg-gr5g (SMTP command injection via CRLF in transport `name` option) is NOT present in nodemailer 9.1.0-tuxcare.8. The vulnerability allowed attackers to inject arbitrary SMTP commands by including `\\r\\n` sequences in the `name` configuration option. The upstream fix (commit 0a43876 by andris@reinman.eu) sanitizes `name` at assignment by stripping all CR/LF characters: `this.name = ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-vvjj-xcjg-gr5g" }, "impact_statement": "not_affected \u2014 GHSA-vvjj-xcjg-gr5g (SMTP command injection via CRLF in transport `name` option) is NOT present in nodemailer 9.1.0-tuxcare.8. The vulnerability allowed attackers to inject arbitrary SMTP commands by including `\\r\\n` sequences in the `name` configuration option. The upstream fix (commit 0a43876 by andris@reinman.eu) sanitizes `name` at assignment by stripping all CR/LF characters: `this.name = ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.1.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.1.0" } } ], "timestamp": "2026-11-03T17:20:54.241430+00:00", "status_notes": "Vulnerability GHSA-wmmp-3585-3rmp does not affect version 9.1.0 of nodemailer. not_affected \u2014 The target nodemailer version 9.1.0-tuxcare.8 is NOT AFFECTED by GHSA-wmmp-3585-3rmp (IDN/Punycode parsing discrepancy). The vulnerability was fixed by upstream vendor in release v9.1.0 via commits 259c32d (UTS-46 mapping) and b212ac4 (URL parser hardening). The fix replaces raw RFC-3492 punycode encoding with UTS-46-conformant url.domainToASCII/domainToUnicode, ensuring domain resolution match...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wmmp-3585-3rmp" }, "impact_statement": "not_affected \u2014 The target nodemailer version 9.1.0-tuxcare.8 is NOT AFFECTED by GHSA-wmmp-3585-3rmp (IDN/Punycode parsing discrepancy). The vulnerability was fixed by upstream vendor in release v9.1.0 via commits 259c32d (UTS-46 mapping) and b212ac4 (URL parser hardening). The fix replaces raw RFC-3492 punycode encoding with UTS-46-conformant url.domainToASCII/domainToUnicode, ensuring domain resolution match..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.1.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.1.0" } } ], "timestamp": "2026-11-03T17:20:54.241430+00:00", "status_notes": "Vulnerability GHSA-wqvq-jvpq-h66f does not affect version 9.1.0 of nodemailer. not_affected \u2014 The vulnerability GHSA-wqvq-jvpq-h66f (jsonTransport disableFileAccess/disableUrlAccess bypass) is NOT present in nodemailer 9.1.0-tuxcare.8. The upstream vendor (Andris Reinman) fixed this vulnerability in commit 5f694977da2e0e13dc947037566e8e689a01217e, which was included in upstream release v8.0.9 (May 2026). This fix was already present when TuxCare onboarded version 9.1.0. The fix adds acc...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-wqvq-jvpq-h66f" }, "impact_statement": "not_affected \u2014 The vulnerability GHSA-wqvq-jvpq-h66f (jsonTransport disableFileAccess/disableUrlAccess bypass) is NOT present in nodemailer 9.1.0-tuxcare.8. The upstream vendor (Andris Reinman) fixed this vulnerability in commit 5f694977da2e0e13dc947037566e8e689a01217e, which was included in upstream release v8.0.9 (May 2026). This fix was already present when TuxCare onboarded version 9.1.0. The fix adds acc..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/nodemailer@9.1.0", "identifiers": { "purl": "pkg:npm/nodemailer@9.1.0" } } ], "timestamp": "2026-10-22T17:05:00.556684+00:00", "status_notes": "Vulnerability GHSA-wxxx-r42m-9rp8 is a false positive for nodemailer 9.1.0.", "vulnerability": { "name": "GHSA-wxxx-r42m-9rp8" }, "impact_statement": "The vulnerability has been withdrawn." } ] }