Homepage

org.webjars.npm:nodemailer@6.10.1

  • latest version

    6.10.1

  • first published

    8 years ago

  • latest version published

    6 months ago

  • licenses detected

  • package registry

    View on Maven Central Repository
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the org.webjars.npm:nodemailer package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Server-side Request Forgery (SSRF)

    org.webjars.npm:nodemailer is an Easy as cake e-mail sending from your Node.js applications

    Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the message-level raw option bypassing disableFileAccess and disableUrlAccess flags. An attacker can access arbitrary local files or perform server-side request forgery by supplying crafted input to the raw field, which bypasses intended access restrictions and results in sensitive data being sent to an attacker-controlled recipient.

    How to fix Server-side Request Forgery (SSRF)?

    A fix was pushed into the master branch but not yet published.

    [0,)
    • H
    CRLF Injection

    org.webjars.npm:nodemailer is an Easy as cake e-mail sending from your Node.js applications

    Affected versions of this package are vulnerable to CRLF Injection via the comment field in the list message option. An attacker can inject arbitrary headers into generated email messages by supplying crafted input containing CRLF sequences.

    How to fix CRLF Injection?

    A fix was pushed into the master branch but not yet published.

    [0,)
    • M
    Missing Authorization

    org.webjars.npm:nodemailer is an Easy as cake e-mail sending from your Node.js applications

    Affected versions of this package are vulnerable to Missing Authorization in the jsonTransport message, which fails to enforce file and URL access restrictions during message normalization. An attacker can access local files or trigger outbound HTTP requests by supplying crafted message content fields such as attachment path or text.href.

    How to fix Missing Authorization?

    Upgrade org.webjars.npm:nodemailer to version 8.0.9 or higher.

    [,8.0.9)
    • M
    Improper Certificate Validation

    org.webjars.npm:nodemailer is an Easy as cake e-mail sending from your Node.js applications

    Affected versions of this package are vulnerable to Improper Certificate Validation due to the use of rejectUnauthorized: false in the internal HTTPS client, which disables TLS certificate verification during OAuth2 token retrieval. An attacker can intercept sensitive OAuth2 credentials and tokens by performing a machine-in-the-middle attack on the HTTPS connection.

    How to fix Improper Certificate Validation?

    Upgrade org.webjars.npm:nodemailer to version 8.0.8 or higher.

    [,8.0.8)
    • M
    CRLF Injection

    org.webjars.npm:nodemailer is an Easy as cake e-mail sending from your Node.js applications

    Affected versions of this package are vulnerable to CRLF Injection via the name configuration configuration option. An attacker can inject arbitrary SMTP commands by supplying carriage return and line feed sequences, enabling unauthorized email sending, sender spoofing, and phishing attacks before authentication occurs.

    How to fix CRLF Injection?

    A fix was pushed into the master branch but not yet published.

    [0,)
    • L
    CRLF Injection

    org.webjars.npm:nodemailer is an Easy as cake e-mail sending from your Node.js applications

    Affected versions of this package are vulnerable to CRLF Injection via the envelope.size parameter in the sendMail function. An attacker can inject arbitrary SMTP commands by supplying CRLF characters in the size property, which are concatenated directly into the SMTP command stream. This can result in unauthorized recipients being added to outgoing emails or other SMTP commands being executed.

    Note:

    This is only exploitable if the application explicitly passes a custom envelope object with a user-controlled size property to the mail sending process.

    How to fix CRLF Injection?

    A fix was pushed into the master branch but not yet published.

    [0,)
    • H
    Uncontrolled Recursion

    org.webjars.npm:nodemailer is an Easy as cake e-mail sending from your Node.js applications

    Affected versions of this package are vulnerable to Uncontrolled Recursion in the addressparser function. An attacker can cause the process to terminate immediately by sending an email address header containing deeply nested groups, separated by many :s.

    How to fix Uncontrolled Recursion?

    A fix was pushed into the master branch but not yet published.

    [0,)
    • M
    Interpretation Conflict

    org.webjars.npm:nodemailer is an Easy as cake e-mail sending from your Node.js applications

    Affected versions of this package are vulnerable to Interpretation Conflict due to improper handling of quoted local-parts containing @. An attacker can cause emails to be sent to unintended external recipients or bypass domain-based access controls by crafting specially formatted email addresses with quoted local-parts containing the @ character.

    How to fix Interpretation Conflict?

    A fix was pushed into the master branch but not yet published.

    [0,)
    • H
    Command Injection

    org.webjars.npm:nodemailer is an Easy as cake e-mail sending from your Node.js applications

    Affected versions of this package are vulnerable to Command Injection. Use of crafted recipient email addresses may result in arbitrary command flag injection in sendmail transport for sending mails.

    PoC

    -bi@example.com (-bi Initialize the alias database.)
-d0.1a@example.com (The option -d0.1 prints the version of sendmail and the options it was compiled with.)
-Dfilename@example.com (Debug output ffile)

    How to fix Command Injection?

    There is no fixed version for org.webjars.npm:nodemailer.

    [0.0.0,)
    Go back to all versions of this package