N
Vendor security profile
nodemailer
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs21
Critical1
CISA KEV0
Public exploit11
Patch rate%57
Avg. CVSS7.5
12-month vulnerability rate
0
1
0
0
0
0
0
0
0
7
9
4
CVE KEV
CVE severity distribution
21toplam CVE
Critical1 (5%)
High12 (57%)
Medium8 (38%)
Patch and exploitation view
%57
Verified patch
%0
CISA KEV
%52
Public exploit
5Patch available
7Partial
0Workaround
0Vendor: no patch
9Unknown
Latest vulnerabilities
8.2
CVE-2026-110872
Nodemailer 3.0.0 before 10.0.10 Denial of Service via SMTP Reply Parsing
N
Patch status unknown
7.1
CVE-2026-110871
Nodemailer 3.0.0 before 10.0.10 Quadratic DKIM Header Unfolding Denial of Service
N
Patch status unknown
6.9
CVE-2026-110870
Nodemailer before 10.0.13 Improper Input Validation via Angle-Bracket Address Comments
N
Patch status unknown
8.7
CVE-2026-110869
Nodemailer 3.0.0 before 10.0.13 ReDoS via SMTP AUTH Mechanism Detection Regexes
N
Patch status unknown
8.2
CVE-2026-100702
Nodemailer before 10.0.2 Stack Exhaustion via Nested Recipient Arrays
N
Patch status unknownEPSS %0
6.0
CVE-2026-100701
Nodemailer 5.0.0 through 10.0.1 TLS servername Cache Confusion
N
Patch status unknownEPSS %0
8.7
CVE-2026-100700
nodemailer before 10.0.6 Denial of Service via addressparser
N
Patch status unknownEPSS %0
6.9
CVE-2026-100699
Nodemailer before 10.0.9 Malformed Envelope Recipient via RFC 5322 Comment
N
Patch status unknownEPSS %0
8.3
CVE-2026-92598
Nodemailer before 9.1.0 IDN/Punycode Domain Allow-list Bypass
N
Patch verifiedEPSS %0
8.3
CVE-2026-92597
Nodemailer before 9.1.0 Email Domain Validation Bypass via RFC 5322 Comment
N
Patch verifiedEPSS %0