nodemailer
Page établie d’après les avis qui citent ce paquet : ses métadonnées de registre (versions, licence, dépendances) n’ont pas encore été récupérées par ce service.
En bref
- Écosystème
- npm
- État de vulnérabilité
- 27 avis sans verdict
Avis (27)
| Avis | Versions affectées | Dernière version |
|---|---|---|
| GHSA-268h-hp4c-crq3 Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message header injection | < 8.0.9 | Indéterminé |
| GHSA-2x7j-588g-ccc2 Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address list | < 9.1.0 | Indéterminé |
| GHSA-39m8-27wv-hr27 Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signing | 3.0.0 – < 10.0.10 | Indéterminé |
| GHSA-48ww-j4fc-435p Command injection in nodemailer | < 6.4.16 | Indéterminé |
| GHSA-4ffr-jq9g-5ffx Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service | 3.0.0 – < 10.0.13 | Indéterminé |
| GHSA-4g23-2xm8-66gc Nodemailer: Quadratic (O(n^2)) SMTP client reply parsing lets a malicious server or MITM cause a pre-auth remote denial of service | 3.0.0 – < 10.0.10 | Indéterminé |
| GHSA-6vj9-mwq6-2f5v Nodemailer: Process-global DNS cache reuses TLS `servername` across transports, enabling cross-tenant SMTP credential disclosure | 5.0.0 – < 10.0.2 | Indéterminé |
| GHSA-85x2-q946-cp5h Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name | 3.0.0 – < 10.1.4 | Indéterminé |
| GHSA-8c8m-p3m8-cjg8 Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient | 3.0.0 – < 10.1.4 | Indéterminé |
| GHSA-8m3c-c648-2xjj Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disableUrlAccess when called with the legacy signature | < 9.1.1 | Indéterminé |
| GHSA-8vvx-rff5-p5rq Nodemailer: Nested structured recipient arrays bypass the parser depth limit and cause stack exhaustion DoS | < 10.0.2 | Indéterminé |
| GHSA-9h6g-pr28-7cqp nodemailer ReDoS when trying to send a specially crafted email | < 6.9.9 | Indéterminé |
| GHSA-c7w3-x93f-qmm8 Nodemailer has SMTP command injection due to unsanitized `envelope.size` parameter | < 8.0.4 | Indéterminé |
| GHSA-cc9r-2j5m-2m83 Nodemailer: Recipient-domain validation bypass via RFC 5322 comment mis-parsing leads to email delivery to an attacker-controlled domain | 6.9.16 – < 9.1.0 | Indéterminé |
| GHSA-g57g-f23g-4646 Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing | 9.1.0 – < 10.0.9 | Indéterminé |
| GHSA-g73g-hqqh-jr95 Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped | 3.0.0 – < 10.0.13 | Indéterminé |
| GHSA-hwqf-gcqm-7353 Header injection in nodemailer | < 6.6.1 | Indéterminé |
| GHSA-m943-m63m-w62w Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient | 3.0.0 – < 10.1.4 | Indéterminé |
| GHSA-mm7p-fcc7-pg87 Nodemailer: Email to an unintended domain can occur due to Interpretation Conflict | < 7.0.7 | Indéterminé |
| GHSA-p6gq-j5cr-w38f Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered message | < 9.0.1 | Indéterminé |
| GHSA-prgh-xp8r-p3m5 Nodemailer addressparser: O(n^2) on comment-joined addresses enables a remote DoS (reachable via mailparser) | 9.1.0 – < 10.0.5 | Indéterminé |
| GHSA-r7g4-qg5f-qqm2 Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interception | < 8.0.8 | Indéterminé |
| GHSA-rcmh-qjqh-p98v Nodemailer’s addressparser is vulnerable to DoS caused by recursive calls | 3.0.0 – < 7.0.11 | Indéterminé |
| GHSA-v53p-9fqp-m79j Nodemailer: Quadratic backtracking in the addressparser free-text fallback allows remote denial of service | < 10.0.6 | Indéterminé |
| GHSA-vvjj-xcjg-gr5g Nodemailer Vulnerable to SMTP Command Injection via CRLF in Transport name Option (EHLO/HELO) | < 8.0.5 | Indéterminé |
| GHSA-wmmp-3585-3rmp Nodemailer: IDN/Punycode domain allow-list bypass leads to email delivery to an attacker-controlled domain | < 9.1.0 | Indéterminé |
| GHSA-wqvq-jvpq-h66f Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess during message normalization | < 8.0.9 | Indéterminé |
Avis retirés (6)
Retirés par leur éditeur : ils ne concernent aucune version et ne sont pas comptés ci-dessus.
- GHSA-46j5-6fg5-4gv3 Duplicate Advisory: Nodemailer is vulnerable to DoS through Uncontrolled Recursion · retiré le
- GHSA-frj6-5rhh-vwfw Duplicate Advisory: Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interception · retiré le
- GHSA-h3hj-cmcx-xc66 Duplicate Advisory: Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered message · retiré le
- GHSA-jj37-3377-m6vv Duplicate Advisory: Nodemailer: Email to an unintended domain can occur due to Interpretation Conflict · retiré le
- GHSA-vm5r-23w9-m8hx Duplicate Advisory: Nodemailer addressparser: O(n^2) on comment-joined addresses enables a remote DoS (reachable via mailparser) · retiré le
- GHSA-wxxx-r42m-9rp8 Duplicate Advisory: Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signing · retiré le
Sources
| Source | Licence |
|---|