PkgSeer

Vulnerabilities

Last updated 2 hours ago
Filters
Severity
Critical Severity
CVSS Score Range: 9.0–10.0
Critical severity vulnerabilities (CVSS 9.0–10.0). These represent the highest impact issues.
High Severity
CVSS Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
Medium Severity
CVSS Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
Low Severity
CVSS Score Range: < 4.0
Low severity vulnerabilities (CVSS < 4.0). Hygiene issues that can accumulate but pose lower immediate risk.
Unknown Severity
CVSS Score Range: No score
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
Package Summary Severity Published Modified
nodemailer Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient Medium Risk 6.5 11 days ago 8 hours ago
nodemailer Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name Medium Risk 6.5 11 days ago 8 hours ago
nodemailer Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient Medium Risk 6.5 11 days ago 8 hours ago
nodemailer Nodemailer: Quadratic (O(n^2)) SMTP client reply parsing lets a malicious server or MITM cause a pre-auth remote denial of service Medium Risk 5.9 7 days ago 7 days ago
nodemailer Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service Medium Risk 5.9 7 days ago 7 days ago
nodemailer Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped Medium Risk 5.3 7 days ago 7 days ago
nodemailer Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signing Medium Risk 6.5 12 days ago 12 days ago
nodemailer Nodemailer addressparser: O(n^2) on comment-joined addresses enables a remote DoS (reachable via mailparser) High Risk 7.5 1 month ago 29 days ago
nodemailer Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interception Medium Risk 6.5 4 months ago 29 days ago
nodemailer Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing Medium Risk 5.3 1 month ago 1 month ago
nodemailer Nodemailer: Quadratic backtracking in the addressparser free-text fallback allows remote denial of service High Risk 7.5 1 month ago 1 month ago
nodemailer Nodemailer: Nested structured recipient arrays bypass the parser depth limit and cause stack exhaustion DoS Medium Risk 5.9 1 month ago 1 month ago
nodemailer Nodemailer: Process-global DNS cache reuses TLS `servername` across transports, enabling cross-tenant SMTP credential disclosure Medium Risk 5.9 1 month ago 1 month ago
nodemailer Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address list High Risk 7.5 1 month ago 1 month ago
nodemailer Nodemailer: Recipient-domain validation bypass via RFC 5322 comment mis-parsing leads to email delivery to an attacker-controlled domain Medium Risk 6.5 1 month ago 1 month ago
nodemailer Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disableUrlAccess when called with the legacy signature Medium Risk 5.9 1 month ago 1 month ago
nodemailer Nodemailer: IDN/Punycode domain allow-list bypass leads to email delivery to an attacker-controlled domain Medium Risk 6.5 1 month ago 1 month ago
nodemailer Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered message High Risk 7.1 4 months ago 1 month ago
nodemailer Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message header injection Medium Risk 5.4 4 months ago 1 month ago
nodemailer Nodemailer Vulnerable to SMTP Command Injection via CRLF in Transport name Option (EHLO/HELO) Medium Risk 4.9 6 months ago 1 month ago
nodemailer Nodemailer’s addressparser is vulnerable to DoS caused by recursive calls High Risk 7.5 11 months ago 1 month ago
org.webjars.npm:nodemailer Nodemailer’s addressparser is vulnerable to DoS caused by recursive calls High Risk 7.5 11 months ago 1 month ago
nodemailer Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess during message normalization Medium Risk 5.4 4 months ago 1 month ago
nodemailer Nodemailer has SMTP command injection due to unsanitized `envelope.size` parameter Low Risk 3.0 7 months ago 1 month ago
nodemailer Nodemailer: Email to an unintended domain can occur due to Interpretation Conflict Medium Risk 6.0 1 year ago 1 month ago
fastnodemailer Malicious code in fastnodemailer (npm) Unknown 4 months ago 2 months ago
nodemailer nodemailer ReDoS when trying to send a specially crafted email Medium Risk 5.3 2 years ago 2 months ago
nodemailer-utils Malicious code in nodemailer-utils (npm) Unknown 1 year ago 1 year ago
nodemailer-enhancer Malicious code in nodemailer-enhancer (npm) Unknown 1 year ago 1 year ago
nodemailer-helper Malicious code in nodemailer-helper (npm) Unknown 1 year ago 1 year ago
nodemailer Header injection in nodemailer Medium Risk 6.3 4 years ago 1 year ago
nodemailer Command injection in nodemailer Critical 9.8 5 years ago 1 year ago
noirxnodemailer Malicious code in noirxnodemailer (npm) Unknown 1 year ago 1 year ago
nodemailer.js nodemailer.js is malware High Risk 7.5 8 years ago 2 years ago
nodemailer-js nodemailer-js is malware High Risk 7.5 8 years ago 2 years ago
Data courtesy of OSV.dev
Page 1