Read the docs

nodemailer

Records28All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high17CVSS 7.0–8.9

Exploited now

nodemailer records in CISA KEV

No nodemailer vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Nodemailer 3 records HIGH Mailparser 1 record MEDIUM

Records

1 record in Mailparser · all components

TI-2026-02976 CVE-2026-3455 · GHSA-7gmj-h9xc-mcxc

Cross-site scripting in mailparser

Priority MEDIUM 56

Versions of the package mailparser before 3.9.3 are vulnerable to Cross-site Scripting (XSS) via the textToHtml() function due to the improper sanitisation of URLs in the email content.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00363 Published 2026-03-03 Fixed in 3.9.3 CWE-79
Open these records in search →