Nodemailer

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:nodemailer:nodemailer:*:*:*:*:*:node.js:*:*

part: a version: * update: *

VendorNodemailer (2076d413-a4ed-5cf8-8b45-ca08a6e3bfde)
ProductNodemailer (1c678aaa-3f98-56cd-95dd-8db4c12d71dc)
Edition*
Language*
Software edition*
Target softwarenode.js
Target hardware*
Other*
NotesImported from gcve-enriched-dumps CVE data

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2025-14874 vulnerable 2026-06-08 07:06:35.284142 Nodemailer: nodemailer: denial of service via crafted email address header
HIGH (7.5)
A flaw was found in Nodemailer. This vulnerability allows a denial of service (DoS) via a crafted email address header that triggers infinite recursion in the address parser.
Published: 2025-12-18T08:40:31.916Z
Updated: 2026-01-08T02:59:52.145Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-23400 vulnerable 2026-06-08 05:30:02.862244 HTTP Header Injection
MEDIUM (6.3)
The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain newlines and carriage returns is passed into an address object.
Published: 2021-06-29T11:45:11.775Z
Updated: 2024-09-16T22:56:23.040Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2020-7769 vulnerable 2026-06-08 05:27:14.219923 Command Injection
HIGH (8.6)
This affects the package nodemailer before 6.4.16. Use of crafted recipient email addresses may result in arbitrary command flag injection in sendmail transport for sending mails.
Published: 2020-11-12T08:30:17.442Z
Updated: 2024-09-16T18:50:22.395Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.