High
CVE-2026-90776
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 27
Reset filters
Medium
CVE-2026-100699
Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing
High
CVE-2026-100700
Nodemailer: Quadratic backtracking in the addressparser free-text fallback allows remote denial of service
Medium
CVE-2026-100702
Nodemailer: Nested structured recipient arrays bypass the parser depth limit and cause stack exhaustion DoS
Medium
CVE-2026-100701
Nodemailer: Process-global DNS cache reuses TLS `servername` across transports, enabling cross-tenant SMTP credential disclosure
Medium
CVE-2026-92598
Nodemailer: IDN/Punycode domain allow-list bypass leads to email delivery to an attacker-controlled domain
High
CVE-2026-92596
Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address list
Medium
CVE-2026-92597
Nodemailer: Recipient-domain validation bypass via RFC 5322 comment mis-parsing leads to email delivery to an attacker-controlled domain
Medium
CVE-2026-92595
Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disableUrlAccess when called with the legacy signature
High
CVE-2026-72766
n8n: Send Email Node Arbitrary File Read and SSRF via Nodemailer Content-Object Type Confusion
High
CVE-2026-82659
Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered message
Medium
CVE-2026-82661
Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message header injection
Medium
CVE-2026-82660
Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess during message normalization
High
CVE-2026-82662
Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interception
Medium
CVE-2026-82853
Nodemailer Vulnerable to SMTP Command Injection via CRLF in Transport name Option (EHLO/HELO)
Low
CVE-2026-82854
Nodemailer has SMTP command injection due to unsanitized `envelope.size` parameter
High
CVE-2025-14874
Nodemailer’s addressparser is vulnerable to DoS caused by recursive calls
Medium
ghsa-5jpx-9hw9-2fx4
NextAuthjs Email misdelivery Vulnerability
High
CVE-2025-62381
`sveltekit-superforms` has Prototype Pollution in `parseFormData` function of `formData.js`
Medium
CVE-2025-13033
Nodemailer: Email to an unintended domain can occur due to Interpretation Conflict
Medium
CVE-2024-58379
nodemailer ReDoS when trying to send a specially crafted email
Critical
CVE-2022-35924
NextAuth.js before 4.10.3 and 3.29.10 sending verification requests (magic link) to unwanted emails
Medium
CVE-2021-23400
Header injection in nodemailer
Medium
ghsa-wfrj-qqc2-83cm
Remote command injection when using sendmail email transport
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.