nodemailer vulnerabilities

CVEs per yearBy the year they were published

1. 20252
2. 202623

Newest CVEs

• CVE-2026-121426

  Nodemailer 3.0.0 before 10.1.4 Recipient Domain Confusion via addressparser

  nodemailer · nodemailer

  High8.3
• CVE-2026-121425

  Nodemailer 3.0.0 before 10.1.4 Recipient Injection via addressparser Group Parsing

  nodemailer · nodemailer

  High8.3
• CVE-2026-121424

  Nodemailer 3.0.0 before 10.1.4 Address Parsing Bypass via Nested Comments

  nodemailer · nodemailer

  High8.3
• CVE-2026-110872

  Nodemailer 3.0.0 before 10.0.10 Denial of Service via SMTP Reply Parsing

  nodemailer · nodemailer

  High8.2
• CVE-2026-110871

  Nodemailer 3.0.0 before 10.0.10 Quadratic DKIM Header Unfolding Denial of Service

  nodemailer · nodemailer

  High7.1
• CVE-2026-110870

  Nodemailer before 10.0.13 Improper Input Validation via Angle-Bracket Address Comments

  nodemailer · nodemailer

  Medium6.9
• CVE-2026-110869

  Nodemailer 3.0.0 before 10.0.13 ReDoS via SMTP AUTH Mechanism Detection Regexes

  nodemailer · nodemailer

  High8.7
• CVE-2026-100702

  Nodemailer before 10.0.2 Stack Exhaustion via Nested Recipient Arrays

  nodemailer · nodemailer

  High8.2
• CVE-2026-100701

  Nodemailer 5.0.0 through 10.0.1 TLS servername Cache Confusion

  nodemailer · nodemailer

  Medium6.0
• CVE-2026-100700

  nodemailer before 10.0.6 Denial of Service via addressparser

  nodemailer · nodemailer

  High8.7