Nodemailer vulnerabilities
We track 8 vulnerabilities in Nodemailer products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on October 14, 2026.
Latest Nodemailer vulnerabilities
- 7.5 High severity
nodemailer: Inefficient Regular Expression Complexity
Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection._actionEHLO, whose four AUTH mechanism detection regexes contain overlapping whitespace sub-patterns that backtrack quadratically. A malicious or man-in-the-middle SMT
- 7.5 High severity
nodemailer: Inefficient Algorithmic Complexity
nodemailer before 10.0.6 contains a denial of service vulnerability in the addressparser free-text fallback regex pattern that exhibits quadratic backtracking behavior. Attackers can supply crafted email header values with long whitespace-free runs to block th
- 7.5 High severity
nodemailer: Uncontrolled Resource Consumption
Nodemailer before 9.1.0 contains a quadratic time complexity vulnerability in the addressparser component that allows remote attackers to cause denial of service by supplying a crafted comma-separated address list. Attackers can send a single email with a larg
- 7.5 High severity
nodemailer: Inefficient Algorithmic Complexity
Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability in the addressparser component when parsing email addresses with RFC 5322 comments. Attackers can craft malicious email headers with comment-separated atoms to consume e
- 9.8 Critical severity
nodemailer: Improper Neutralization of CRLF Sequences
Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.size parameter. When an application passes a custom envelope object with a size property containing CRLF characters to sendMail(), the value is concatenated into t
- 7.1 High severity
nodemailer: External Control of File Name or Path
nodemailer before 9.0.1 fails to apply disableFileAccess and disableUrlAccess flags to message-level raw option, allowing authenticated attackers to read arbitrary files or perform server-side request forgery by supplying path or href properties. Attackers can
- 7.5 High severity
nodemailer: Improper Check or Handling of Exceptional Conditions
A flaw was found in Nodemailer. This vulnerability allows a denial of service (DoS) via a crafted email address header that triggers infinite recursion in the address parser.
- 7.5 High severity
nodemailer: Improper Validation of Syntactic Correctness of Input
A vulnerability was identified in the email parsing library due to improper handling of specially formatted recipient email addresses. An attacker can exploit this flaw by crafting a recipient address that embeds an external address within quotes. This causes