en
Nodemailer is an open-source Node.js email-sending library maintained by the Nodemailer project community. Its primary purpose is composing and delivering email through SMTP, LMTP, sendmail, and related transports, with capabilities for message formatting, address parsing, authentication, attachments, and DKIM. It is deployed as a software dependency in server-side JavaScript applications used by organizations and developers worldwide.
As of 10/23/2026, nodemailer recorded 20 security vulnerabilities in the last 90 days across 1 products, including 12 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, nodemailer had the most security vulnerabilities in the nodemailer ecosystem, with 20 vulnerabilities—approximately 100% of the provider's total vulnerabilities during this period.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-110872Nodemailer 3.0.0 before 10.0.10 Denial of Service via SMTP Reply ParsingCVE-2026-110871Nodemailer 3.0.0 before 10.0.10 Quadratic DKIM Header Unfolding Denial of ServiceCVE-2026-110870Nodemailer before 10.0.13 Improper Input Validation via Angle-Bracket Address CommentsCVE-2026-110869Nodemailer 3.0.0 before 10.0.13 ReDoS via SMTP AUTH Mechanism Detection RegexesCVE-2026-100702Nodemailer before 10.0.2 Stack Exhaustion via Nested Recipient Arrays| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-110872Nodemailer 3.0.0 before 10.0.10 Denial of Service via SMTP Reply Parsing | Exploitation statusActively exploited | FixYes |
| Published10/14/2026 |
| SeverityHigh |
CVE-2026-110871Nodemailer 3.0.0 before 10.0.10 Quadratic DKIM Header Unfolding Denial of Service | Exploitation statusActively exploited | FixYes | Affected productnodemailer | Published10/14/2026 | SeverityHigh |
|---|
CVE-2026-110870Nodemailer before 10.0.13 Improper Input Validation via Angle-Bracket Address Comments | Exploitation statusNot confirmed | FixYes | Affected productnodemailer | Published10/14/2026 | SeverityMedium |
|---|
CVE-2026-110869Nodemailer 3.0.0 before 10.0.13 ReDoS via SMTP AUTH Mechanism Detection Regexes | Exploitation statusActively exploited | FixYes | Affected productnodemailer | Published10/14/2026 | SeverityHigh |
|---|
CVE-2026-100702Nodemailer before 10.0.2 Stack Exhaustion via Nested Recipient Arrays | Exploitation statusNot exploited | FixYes | Affected productnodemailer | Published09/26/2026 | SeverityHigh |
|---|
CVE-2026-100701Nodemailer 5.0.0 through 10.0.1 TLS servername Cache Confusion | Exploitation statusNot exploited | FixYes | Affected productnodemailer | Published09/26/2026 | SeverityMedium |
|---|
CVE-2026-100700nodemailer before 10.0.6 Denial of Service via addressparser | Exploitation statusActively exploited | FixYes | Affected productnodemailer | Published09/26/2026 | SeverityHigh |
|---|
CVE-2026-100699Nodemailer before 10.0.9 Malformed Envelope Recipient via RFC 5322 Comment | Exploitation statusActively exploited | FixYes | Affected productnodemailer | Published09/26/2026 | SeverityMedium |
|---|
CVE-2026-92598Nodemailer before 9.1.0 IDN/Punycode Domain Allow-list Bypass | Exploitation statusActively exploited | FixYes | Affected productnodemailer | Published09/16/2026 | SeverityHigh |
|---|
CVE-2026-92597Nodemailer before 9.1.0 Email Domain Validation Bypass via RFC 5322 Comment | Exploitation statusNot exploited | FixYes | Affected productnodemailer | Published09/16/2026 | SeverityHigh |
|---|
25 Results | Page 1 of 3