Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: nodemailer 9.1.0 Clear all filters
TI-2026-62454 CVE-2026-92598 · GHSA-r7q5-h7cx-p54x

Nodemailer before 9.1.0 IDN/Punycode Domain Allow-list Bypass

Priority HIGH 69

Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers.

CVSS 4.0HIGH 8.3 Network No auth No interaction EPSS 0.00395 Published 2026-09-16 Partial fix · 9.1.0 CWE-436
TI-2026-62453 CVE-2026-92597 · GHSA-8pjj-q6q6-qm29

Nodemailer before 9.1.0 Email Domain Validation Bypass via RFC 5322 Comment

Priority LOW 36

Nodemailer versions >= 6.9.16 and < 9.1.0 mis-parse RFC 5322 comments in email addresses: in lib/addressparser, a comment closed immediately before a non-break character causes the tokenizer to concatenate the atoms surr…

CVSS 4.0HIGH 8.3 Network No auth No interaction EPSS 0.00382 Published 2026-09-16 Partial fix · 9.1.0 CWE-436
TI-2026-62452 CVE-2026-92596 · GHSA-v554-hhrr-96v5

Nodemailer before 9.1.0 Denial of Service via addressparser

Priority HIGH 77

Nodemailer before 9.1.0 contains a quadratic time complexity vulnerability in the addressparser component that allows remote attackers to cause denial of service by supplying a crafted comma-separated address list.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00824 Published 2026-09-16 Fixed in 9.1.0 CWE-400