npm/nodemailer

Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message header injection

Modified: 9/10/2026

Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address list

Modified: 9/17/2026

Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signing

Modified: 10/22/2026

Command injection in nodemailer

Modified: 1/14/2025

Nodemailer: Process-global DNS cache reuses TLS `servername` across transports, enabling cross-tenant SMTP credential disclosure

Modified: 9/28/2026

Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disableUrlAccess when called with the legacy signature

Modified: 9/17/2026

Nodemailer: Nested structured recipient arrays bypass the parser depth limit and cause stack exhaustion DoS

Modified: 9/29/2026

nodemailer ReDoS when trying to send a specially crafted email

Modified: 9/1/2026

Nodemailer has SMTP command injection due to unsanitized `envelope.size` parameter

Modified: 9/10/2026

Nodemailer: Recipient-domain validation bypass via RFC 5322 comment mis-parsing leads to email delivery to an attacker-controlled domain

Modified: 9/17/2026

Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing

Modified: 9/30/2026

Header injection in nodemailer

Modified: 1/14/2025

Nodemailer: Email to an unintended domain can occur due to Interpretation Conflict

Modified: 9/10/2026

Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered message

Modified: 9/10/2026

Nodemailer addressparser: O(n^2) on comment-joined addresses enables a remote DoS (reachable via mailparser)

Modified: 10/5/2026

Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interception

Modified: 10/5/2026

Nodemailer’s addressparser is vulnerable to DoS caused by recursive calls

Modified: 9/10/2026

Nodemailer: Quadratic backtracking in the addressparser free-text fallback allows remote denial of service

Modified: 9/30/2026

Nodemailer Vulnerable to SMTP Command Injection via CRLF in Transport name Option (EHLO/HELO)

Modified: 9/10/2026

Nodemailer: IDN/Punycode domain allow-list bypass leads to email delivery to an attacker-controlled domain

Modified: 9/17/2026

Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess during message normalization

Modified: 9/10/2026