Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: nodemailer 10.0.13 Clear all filters
TI-2026-74560 CVE-2026-110870

Nodemailer address parser passes illegal characters to SMTP envelope

Priority HIGH 70

Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322 comments inside angle-bracket addresses.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00266 Published 2026-10-14 Partial fix · 10.0.13 CWE-20
TI-2026-74559 CVE-2026-110869

ReDoS in Nodemailer SMTP AUTH mechanism detection regexes

Priority HIGH 77

Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection._actionEHLO, whose four AUTH mechanism detection regexes contain overlapping whitespace sub-patterns that backtrack quadratical…

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00367 Published 2026-10-14 Partial fix · 10.0.13 CWE-1333