GHSA-jj37-3377-m6vv
High · 7.5CVSS
7.5
EPSS
—
Published
Nov 14, 2025
CISA due date
—
The record
Duplicate Advisory: Nodemailer: Email to an unintended domain can occur due to Interpretation Conflict
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | nodemailer | 0 | 7.0.7 |
Related vulnerabilities
- GHSA-p6gq-j5cr-w38f Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess… Also affects nodemailer
- GHSA-268h-hp4c-crq3 Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message… Also affects nodemailer
- GHSA-wqvq-jvpq-h66f Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess during message… Also affects nodemailer
- GHSA-r7g4-qg5f-qqm2 Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential… Also affects nodemailer
- GHSA-vvjj-xcjg-gr5g Nodemailer Vulnerable to SMTP Command Injection via CRLF in Transport name Option… Also affects nodemailer
- GHSA-c7w3-x93f-qmm8 Nodemailer has SMTP command injection due to unsanitized `envelope.size` parameter Also affects nodemailer
- GHSA-46j5-6fg5-4gv3 Duplicate Advisory: Nodemailer is vulnerable to DoS through Uncontrolled Recursion Also affects nodemailer
- CVE-2025-14874 Nodemailer is vulnerable to DoS through Uncontrolled Recursion Also affects nodemailer