Nodemailer

nodemailer

4 CVEs • 2 products

Products (2)

Click to collapse

Toggle

CVEs (4)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2026-3455 1Nodemailer 1Mailparser Jun 17, 2026 Mar 3, 2026 2.0 LOW· v4 6.1 MEDIUM· v3 N/A· v2 Versions of the package mailparser before 3.9.3 are vulnerable to Cross-site Scripting (XSS) via the textToHtml() function due to the improper sanitisation of URLs in the email content. An attacker can execute arbitrary...Show more Versions of the package mailparser before 3.9.3 are vulnerable to Cross-site Scripting (XSS) via the textToHtml() function due to the improper sanitisation of URLs in the email content. An attacker can execute arbitrary scripts in victim browsers by adding extra quote " to the URL with embedded malicious JavaScript code.Show less
CVE-2025-14874 2Nodemailer Redhat 4Advanced Cluster Management For Kubernetes Ceph StorageDeveloper Hub+1 more Jun 17, 2026 Dec 18, 2025 N/A· v4 7.5 HIGH· v3 N/A· v2 A flaw was found in Nodemailer. This vulnerability allows a denial of service (DoS) via a crafted email address header that triggers infinite recursion in the address parser.
CVE-2021-23400 1Nodemailer 1Nodemailer Jun 17, 2026 Jun 29, 2021 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain newlines and carriage returns is passed into an address object.
CVE-2020-7769 1Nodemailer 1Nodemailer Jun 17, 2026 Nov 12, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 This affects the package nodemailer before 6.4.16. Use of crafted recipient email addresses may result in arbitrary command flag injection in sendmail transport for sending mails.