N
Vendor security profile
nodemailer
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs17
Critical1
CISA KEV0
Public exploit11
Patch rate%71
Avg. CVSS7.4
12-month vulnerability rate
0
1
0
0
0
0
0
0
0
7
9
0
CVE KEV
CVE severity distribution
17toplam CVE
Critical1 (6%)
High9 (53%)
Medium7 (41%)
Patch and exploitation view
%71
Verified patch
%0
CISA KEV
%65
Public exploit
5Patch available
7Partial
0Workaround
0Vendor: no patch
5Unknown
Latest vulnerabilities
8.2
CVE-2026-100702
Nodemailer before 10.0.2 Stack Exhaustion via Nested Recipient Arrays
N
Patch status unknownEPSS %0
6.0
CVE-2026-100701
Nodemailer 5.0.0 through 10.0.1 TLS servername Cache Confusion
N
Patch status unknownEPSS %0
8.7
CVE-2026-100700
nodemailer before 10.0.6 Denial of Service via addressparser
N
Patch status unknownEPSS %0
6.9
CVE-2026-100699
Nodemailer before 10.0.9 Malformed Envelope Recipient via RFC 5322 Comment
N
Patch status unknownEPSS %0
8.3
CVE-2026-92598
Nodemailer before 9.1.0 IDN/Punycode Domain Allow-list Bypass
N
Patch verifiedEPSS %0
8.3
CVE-2026-92597
Nodemailer before 9.1.0 Email Domain Validation Bypass via RFC 5322 Comment
N
Patch verifiedEPSS %0
8.7
CVE-2026-92596
Nodemailer before 9.1.0 Denial of Service via addressparser
N
Patch verifiedEPSS %1
6.0
CVE-2026-92595
Nodemailer before 9.1.1 Security Sandbox Bypass via resolveContent
N
Patch status unknownEPSS %0
8.7
CVE-2026-90776
Nodemailer 9.1.0 through 10.0.4 Denial of Service via Quadratic Address Parsing
N
Patch verifiedEPSS %1
9.3
CVE-2026-82854
Nodemailer before 8.0.3 SMTP Command Injection via envelope.size
N
Partial patchEPSS %2