Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

3 records

Vendor: nodemailer Component: Nodemailer Clear all filters
TI-2021-06093 CVE-2021-23400 · GHSA-hwqf-gcqm-7353

HTTP Header Injection

Priority MEDIUM 41

The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain newlines and carriage returns is passed into an address object.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01392 Published 2021-06-29 Fixed in 6.6.1 CWE-74
TI-2020-06286 CVE-2020-7769 · GHSA-48ww-j4fc-435p

Command injection in nodemailer

Priority MEDIUM 46

This affects the package nodemailer before 6.4.16.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02303 Published 2020-11-12 Fixed in 6.4.16 CWE-88