nodemailer (npm) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the npm package nodemailer, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (4)

• CVE-2020-7769 — CVSS 8.6 (high): This affects the package nodemailer before 6.4.16. Use of crafted recipient email addresses may result in arbitrary command flag injection…
• CVE-2025-13033 — CVSS 7.5 (high): A vulnerability was identified in the email parsing library due to improper handling of specially formatted recipient email addresses. An…
• CVE-2025-14874 — CVSS 7.5 (high): A flaw was found in Nodemailer. This vulnerability allows a denial of service (DoS) via a crafted email address header that triggers…
• CVE-2021-23400 — CVSS 6.3 (medium): The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain newlines and…