Read the docs

nodemailer

Records28All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high17CVSS 7.0–8.9

Exploited now

nodemailer records in CISA KEV

No nodemailer vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Nodemailer 3 records HIGH Mailparser 1 record MEDIUM

Records

3 records in Nodemailer · all components

TI-2020-06286 CVE-2020-7769 · GHSA-48ww-j4fc-435p

Command injection in nodemailer

Priority MEDIUM 46

This affects the package nodemailer before 6.4.16.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02303 Published 2020-11-12 Fixed in 6.4.16 CWE-88
TI-2021-06093 CVE-2021-23400 · GHSA-hwqf-gcqm-7353

HTTP Header Injection

Priority MEDIUM 41

The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain newlines and carriage returns is passed into an address object.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01392 Published 2021-06-29 Fixed in 6.6.1 CWE-74
Open these records in search →