p PatchFirst

PatchFirst · Aktuelle Sicherheitslücken

Sicherheitslücken in nodemailer

In den letzten 30 Tagen veröffentlichte Sicherheitslücken für nodemailer: 8. Davon im KEV-Katalog: 0.

RSS ↗
Sicherheitslücken filtern
Filter zurücksetzen

Sicherheitslücken: 24

  1. GHSA-8c8m-p3m8-cjg8

    Mittel · CVSS 6.5Korrektur verfügbar

    Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient

    ### Vulnerability summary RFC 5322 comments nest. addressparser ended a comment at the first `)`, including the one that closes a nested comment, and parsed the rest of the outer comment as header text. `Victim (x(y) <[email protected]>) <[email protected]>` names `[email protected]` with `x(y) <[email protected]>` as a comment, and Nodemailer read it as the address `[email protected]`. This is the same shape as the escaped parenthesis fixed in 10.1.2, reached through nesting instead of a quoted-pair. Affected: 3.0.0 through 10.1.3. ### Attacker capabilities The attacker controls the text of an address that an application passes to Nodemailer, or the From or To

    nodemailerNode.js
    • Auf 10.1.4 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  2. GHSA-m943-m63m-w62w

    Mittel · CVSS 6.5Korrektur verfügbar

    Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient

    ### Vulnerability summary addressparser ends an RFC 5322 group at the first `;`, including one inside a quoted display name or a comment. The text after it is parsed again as top level recipients with the quoting flipped, so text that every conformant parser reads as a display name or comment becomes a live address. `G: (a; <[email protected]>) <[email protected]>;` names only `[email protected]`, and Nodemailer read it as the single recipient `[email protected]`. Affected: 3.0.0 through 10.1.3. ### Attacker capabilities The attacker controls the text of an address field that an application passes to Nodemailer, or the header of an inbound message parsed wi

    nodemailerNode.js
    • Auf 10.1.4 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  3. GHSA-85x2-q946-cp5h

    Mittel · CVSS 6.5Korrektur verfügbar

    Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name

    ### Vulnerability summary addressparser ends an angle-addr at the first `>` it sees, including one inside a quoted local part, a comment or a domain literal. The domain is then read off the text in front of that `>`. `<"[email protected]>"@good.com>` is the mailbox `"[email protected]>"@good.com` under RFC 5322, and Nodemailer read it as an address at `evil.com`. The unbracketed spelling of the same value was already read correctly. Affected: 3.0.0 through 10.1.3. ### Attacker capabilities The attacker controls the text of a recipient or sender address that an application passes to Nodemailer, for example a To value entered in a contact or invite form,

    nodemailerNode.js
    • Auf 10.1.4 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  4. CVE-2026-110871

    Hoch · CVSS 7.1EPSS 0,25%Öffentlicher ExploitKorrektur verfügbar

    Nodemailer 3.0.0 before 10.0.10 Quadratic DKIM Header Unfolding Denial of Service

    Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that allows users to exhaust CPU through quadratic header unfolding. Attackers can supply large recipient lists or long headers that fold into tens of thousands of continuation lines, blocking the Node.js event loop during DKIM signing.

    nodemailerNode.js
    • Auf 10.0.10 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  5. CVE-2026-100702

    Hoch · CVSS 8.2EPSS 0,25%Korrektur verfügbar

    Nodemailer before 10.0.2 Stack Exhaustion via Nested Recipient Arrays

    Nodemailer before 10.0.2 fails to properly flatten deeply nested arrays in recipient fields such as to, cc, and bcc, allowing attackers to cause stack exhaustion. Attackers can supply a deeply nested JSON recipient array that triggers recursive Array.toString() conversion, exhausting the call stack and terminating the Node.js process.

    nodemailerNode.js
    • Auf 10.0.2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  6. CVE-2026-100701

    Mittel · CVSS 6EPSS 0,11%Korrektur verfügbar

    Nodemailer 5.0.0 through 10.0.1 TLS servername Cache Confusion

    Nodemailer versions 5.0.0 through 10.0.1 use a process-global DNS cache that is keyed only by the DNS host, while each cache entry also stores the caller-specific TLS servername. When two direct TLS/SMTPS transports (secure: true) resolve the same non-IP host with different tls.servername values, the first transport's servername is returned on the cache hit and overwrites the second transport's explicitly configured value, so Nodemailer sends the wrong SNI value and validates the peer certificate against the wrong identity. In multi-tenant services or SNI-routed SMTP gateways, an attacker who can prime the cache can cause a victim transport t

    nodemailerNode.js
    • Auf 10.0.2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  7. CVE-2026-100700

    Hoch · CVSS 8.7EPSS 0,28%Korrektur verfügbar

    nodemailer before 10.0.6 Denial of Service via addressparser

    nodemailer before 10.0.6 contains a denial of service vulnerability in the addressparser free-text fallback regex pattern that exhibits quadratic backtracking behavior. Attackers can supply crafted email header values with long whitespace-free runs to block the Node.js event loop for tens of seconds, causing service unavailability.

    nodemailerNode.js
    • Auf 10.0.6 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  8. CVE-2026-100699

    Mittel · CVSS 6.9EPSS 0,19%Korrektur verfügbar

    Nodemailer before 10.0.9 Malformed Envelope Recipient via RFC 5322 Comment

    Nodemailer is a Node.js email-sending library. In versions >= 9.1.0 and < 10.0.9, the address parser (src/addressparser) mishandles addresses whose local-part is a quoted string and that are followed by RFC 5322 comments, allowing trailing comment-separated domain atoms to be retained in the normalized address. For example, the input "user"@example.com(x)evil.com is parsed to the address value '[email protected] evil.com', which contains additional attacker-controlled domain text separated by a literal space. This parsed value is used without further strict recipient validation when the message envelope is built (envelope.to in src/mime-node),

    nodemailerNode.js
    • Auf 10.0.9 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  9. CVE-2026-92598

    Hoch · CVSS 8.3EPSS 0,4%Korrektur verfügbar

    Nodemailer before 9.1.0 IDN/Punycode Domain Allow-list Bypass

    Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings that pass domain allow-list checks but are delivered to attacker-controlled domains via SMTP.

    nodemailerNode.js
    • Auf 9.1.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  10. CVE-2026-92597

    Hoch · CVSS 8.3EPSS 0,38%Korrektur verfügbar

    Nodemailer before 9.1.0 Email Domain Validation Bypass via RFC 5322 Comment

    Nodemailer versions >= 6.9.16 and < 9.1.0 mis-parse RFC 5322 comments in email addresses: in lib/addressparser, a comment closed immediately before a non-break character causes the tokenizer to concatenate the atoms surrounding the comment instead of treating the comment as folding whitespace that terminates the domain. A recipient address such as [email protected](x)evil.com is therefore read by Nodemailer as the single domain good-corp.comevil.com (registrable domain comevil.com, which an attacker can register) and used for both the SMTP envelope (RCPT TO) and the emitted To:/From: headers, while a conformant RFC 5322 parser terminates the

    nodemailerNode.js
    • Auf 9.1.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  11. CVE-2026-92596

    Hoch · CVSS 8.7EPSS 0,82%Korrektur verfügbar

    Nodemailer before 9.1.0 Denial of Service via addressparser

    Nodemailer before 9.1.0 contains a quadratic time complexity vulnerability in the addressparser component that allows remote attackers to cause denial of service by supplying a crafted comma-separated address list. Attackers can send a single email with a large number of addresses to block the Node.js event loop for extended periods, consuming 100% CPU and freezing the process.

    nodemailerNode.js
    • Auf 9.1.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  12. CVE-2026-92595

    Mittel · CVSS 6EPSS 0,29%Korrektur verfügbar

    Nodemailer before 9.1.1 Security Sandbox Bypass via resolveContent

    Nodemailer (npm package `nodemailer`) versions 9.1.0 and earlier do not honor the `disableFileAccess` and `disableUrlAccess` sandbox options when message content is resolved through the public plugin API `MailMessage.resolveContent()` using the documented legacy three-argument signature `resolveContent(data, key, callback)`. Because `shared.resolveContent()` normalizes the missing `options` argument to an empty object, the message-level flags copied into `mail.data` by the MailMessage constructor are discarded, and `resolveContentValue()` skips both access-control checks, reaching `nmfetch(url)` or `fs.createReadStream(path)`. As a result, pl

    nodemailerNode.js
    • Auf 9.1.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  13. CVE-2026-90776

    Hoch · CVSS 8.7EPSS 0,68%Öffentlicher ExploitKorrektur verfügbar

    Nodemailer 9.1.0 through 10.0.4 Denial of Service via Quadratic Address Parsing

    Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability in the addressparser component when parsing email addresses with RFC 5322 comments. Attackers can craft malicious email headers with comment-separated atoms to consume excessive CPU and block the Node.js event loop for several seconds, causing denial of service.

    nodemailerNode.js
    • Auf 10.0.5 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  14. CVE-2026-82854

    Kritisch · CVSS 9.3EPSS 1,98%Korrektur verfügbar

    Nodemailer before 8.0.3 SMTP Command Injection via envelope.size

    Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.size parameter. When an application passes a custom envelope object with a size property containing CRLF characters to sendMail(), the value is concatenated into the SMTP MAIL FROM command (as SIZE=...) without sanitization, allowing injection of arbitrary SMTP commands such as RCPT TO to silently add attacker-controlled recipients. Exploitation requires the application to expose the envelope size to attacker-controlled input, as Nodemailer does not include size in the default auto-constructed envelope.

    nodemailerNode.js
    • Auf 8.0.4 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  15. CVE-2026-82853

    Mittel · CVSS 6.9EPSS 1,03%Korrektur verfügbar

    Nodemailer before 8.0.5 SMTP Command Injection via CRLF

    Nodemailer versions before 8.0.5 contain an SMTP command injection vulnerability in the transport name option used in EHLO/HELO commands. The name parameter is concatenated directly into SMTP commands without sanitizing carriage return and line feed characters, allowing attackers to inject arbitrary SMTP commands for email spoofing and phishing attacks.

    nodemailerNode.js
    • Auf 8.0.5 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  16. CVE-2026-82662

    Hoch · CVSS 8.3EPSS 0,19%Korrektur verfügbar

    Nodemailer before 8.0.8 TLS Certificate Validation Bypass

    Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false, allowing attackers to intercept OAuth2 token requests. Attackers in a machine-in-the-middle position can capture OAuth client secrets, refresh tokens, and access tokens transmitted over compromised HTTPS connections.

    nodemailerNode.js
    • Auf 8.0.8 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  17. CVE-2026-82661

    Mittel · CVSS 5.3EPSS 0,26%Korrektur verfügbar

    Nodemailer CRLF Injection via List-* Header Comments

    Nodemailer before 8.0.9 fails to sanitize carriage return and line feed characters in list comment fields, allowing attackers to inject arbitrary message headers. An attacker with control over list.*.comment parameters can inject CRLF sequences to create additional headers in generated RFC822 messages, altering mail client behavior and message semantics.

    nodemailerNode.js
    • Auf 8.0.9 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  18. CVE-2026-82660

    Mittel · CVSS 5.3EPSS 0,26%Korrektur verfügbar

    Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess

    Nodemailer before 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during message normalization in jsonTransport. Attackers can read local files or fetch URLs by supplying path or href values in message content fields, bypassing intended access controls.

    nodemailerNode.js
    • Auf 8.0.9 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  19. CVE-2026-82659

    Hoch · CVSS 7.1EPSS 0,35%Korrektur verfügbar

    nodemailer before 9.0.1 File Read and SSRF via raw option

    nodemailer before 9.0.1 fails to apply disableFileAccess and disableUrlAccess flags to message-level raw option, allowing authenticated attackers to read arbitrary files or perform server-side request forgery by supplying path or href properties. Attackers can exploit this by crafting raw messages with file paths or URLs that bypass the intended sandbox, with fetched content delivered in the outgoing message to attacker-controlled recipients.

    nodemailerNode.js
    • Auf 9.0.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  20. CVE-2024-58379

    Mittel · CVSS 6.9EPSS 0,3%Korrektur verfügbar

    nodemailer before 6.9.9 ReDoS via attachDataUrls parameter

    nodemailer before 6.9.9 contains a regular expression denial of service vulnerability in email parsing when attachDataUrls parameter is set or processing embedded file attachments. Attackers can send specially crafted emails with malicious data URLs or embedded attachments to cause the event loop to hang and deny service.

    nodemailerNode.js
    • Auf 6.9.9 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

Prüfen Sie Ihren Server

Gleichen Sie Ihren installierten Stack und seine Versionen mit den aktuellen Sicherheitsmeldungen ab.

Prüfen Sie Ihren Server →