StackPrism

npm package

nodemailer vulnerabilities by version

The latest release, 10.1.2 (Oct 16, 2026), has no known vulnerabilities. 61% of last week’s 25.7M downloads went to versions with known vulnerabilities. OSV.dev lists 20 advisories for nodemailer; the newest was published on Sep 30, 2026.

npm (opens in a new tab) describes it as “Easy as cake e-mail sending from your Node.js applications”

Latest release
10.1.2
Oct 16, 2026, no known vulnerabilities
Downloads last week
25.7M
All versions, from npm
Advisories on OSV.dev
20
Newest Sep 30, 2026
Licence
MIT-0
OpenSSF Scorecard
5.7/10
nodemailer/nodemailer (opens in a new tab)

Most-downloaded versions last week

From npm’s per-version download counts for the last 7 days, each checked against OSV.dev. Open a version for its advisories and what to upgrade to.

VersionKnown vulnerabilitiesDownloads
10.0.13Sep 30, 2026No known vulnerabilities2.3M
10.0.10Sep 14, 2026No known vulnerabilities2.2M
6.10.1Apr 13, 202515 known vulnerabilities, worst rated critical2.2M
9.1.1Sep 1, 20265 known vulnerabilities, worst rated critical1.7M
7.0.13Jan 27, 202613 known vulnerabilities, worst rated critical1.5M
9.0.3Jun 30, 20267 known vulnerabilities, worst rated critical1.3M
10.0.12Sep 28, 2026No known vulnerabilities1.1M
10.0.16Oct 7, 2026No known vulnerabilities1M

Who is still on a vulnerable nodemailer

61% of last week’s 25.7M nodemailer downloads went to versions with known vulnerabilities.

From npm’s per-version download counts for the last 7 days, each version checked against OSV.dev. The versions checked cover over 99% of downloads.

Release lines

The newest release of each major line, from the registry. nodemailer doesn’t publish support dates we can check.

LineNewest releaseReleased
1010.1.2Oct 16, 2026
99.1.1Sep 1, 2026
88.0.11Jun 10, 2026
77.0.13Jan 27, 2026
66.10.1Apr 13, 2025
55.1.1Jan 9, 2019

Newest advisories

The 5 most recently published, with the versions each one affects.

  1. CriticalCVE-2026-90776 on OSV.dev (opens in a new tab)GHSA-prgh-xp8r-p3m5

    Nodemailer addressparser: O(n^2) on comment-joined addresses enables a remote DoS (reachable via mailparser)

    Affects >= 9.1.0, < 10.0.5. Published Sep 30, 2026.

  2. WarningCVE-2026-100699 on OSV.dev (opens in a new tab)GHSA-g57g-f23g-4646

    Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing

    Affects >= 9.1.0, < 10.0.9. Published Sep 29, 2026.

  3. CriticalCVE-2026-100700 on OSV.dev (opens in a new tab)GHSA-v53p-9fqp-m79j

    Nodemailer: Quadratic backtracking in the addressparser free-text fallback allows remote denial of service

    Affects < 10.0.6. Published Sep 29, 2026.

  4. WarningCVE-2026-100702 on OSV.dev (opens in a new tab)GHSA-8vvx-rff5-p5rq

    Nodemailer: Nested structured recipient arrays bypass the parser depth limit and cause stack exhaustion DoS

    Affects < 10.0.2. Published Sep 29, 2026.

  5. WarningCVE-2026-100701 on OSV.dev (opens in a new tab)GHSA-6vj9-mwq6-2f5v

    Nodemailer: Process-global DNS cache reuses TLS `servername` across transports, enabling cross-tenant SMTP credential disclosure

    Affects >= 5.0.0, < 10.0.2. Published Sep 28, 2026.

All 20 advisories are on OSV.dev (opens in a new tab).

Which nodemailer do you have?

Paste a public GitHub repo or drop your package.json and see every vulnerable, end-of-life or deprecated dependency, with one fix task for your coding agent. Free, no sign-up.

Check your whole repo

How this page is checked

StackPrism reads every OSV.dev advisory for nodemailer, merges duplicates filed under several ids, and asks OSV.dev which ones affect each version listed. Releases and their dates come from deps.dev, downloads from npm. No AI writes this page: every sentence comes from that data, refreshed every few hours.

Last checked against OSV.dev, CISA KEV, npm and deps.dev.