Homepage

nodemailer@6.7.8

Easy as cake e-mail sending from your Node.js applications

  • latest version

    9.0.3

  • latest non vulnerable version

    9.0.3

  • first published

    15 years ago

  • latest version published

    29 days ago

  • licenses detected

    • MIT
      >=0.1.1 <3.0.0; >=4.0.0 <6.9.3
  • View nodemailer package health on Snyk  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the nodemailer package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Server-side Request Forgery (SSRF)

    nodemailer is an Easy as cake e-mail sending from your Node.js applications

    Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the message-level raw option bypassing disableFileAccess and disableUrlAccess flags. An attacker can access arbitrary local files or perform server-side request forgery by supplying crafted input to the raw field, which bypasses intended access restrictions and results in sensitive data being sent to an attacker-controlled recipient.

    How to fix Server-side Request Forgery (SSRF)?

    Upgrade nodemailer to version 9.0.1 or higher.

    <9.0.1
    • M
    Missing Authorization

    nodemailer is an Easy as cake e-mail sending from your Node.js applications

    Affected versions of this package are vulnerable to Missing Authorization in the jsonTransport message, which fails to enforce file and URL access restrictions during message normalization. An attacker can access local files or trigger outbound HTTP requests by supplying crafted message content fields such as attachment path or text.href.

    How to fix Missing Authorization?

    Upgrade nodemailer to version 8.0.9 or higher.

    <8.0.9
    • H
    CRLF Injection

    nodemailer is an Easy as cake e-mail sending from your Node.js applications

    Affected versions of this package are vulnerable to CRLF Injection via the comment field in the list message option. An attacker can inject arbitrary headers into generated email messages by supplying crafted input containing CRLF sequences.

    How to fix CRLF Injection?

    Upgrade nodemailer to version 8.0.9 or higher.

    <8.0.9
    • M
    Improper Certificate Validation

    nodemailer is an Easy as cake e-mail sending from your Node.js applications

    Affected versions of this package are vulnerable to Improper Certificate Validation due to the use of rejectUnauthorized: false in the internal HTTPS client, which disables TLS certificate verification during OAuth2 token retrieval. An attacker can intercept sensitive OAuth2 credentials and tokens by performing a machine-in-the-middle attack on the HTTPS connection.

    How to fix Improper Certificate Validation?

    Upgrade nodemailer to version 8.0.8 or higher.

    <8.0.8
    • M
    CRLF Injection

    nodemailer is an Easy as cake e-mail sending from your Node.js applications

    Affected versions of this package are vulnerable to CRLF Injection via the name configuration configuration option. An attacker can inject arbitrary SMTP commands by supplying carriage return and line feed sequences, enabling unauthorized email sending, sender spoofing, and phishing attacks before authentication occurs.

    How to fix CRLF Injection?

    Upgrade nodemailer to version 8.0.5 or higher.

    <8.0.5
    • L
    CRLF Injection

    nodemailer is an Easy as cake e-mail sending from your Node.js applications

    Affected versions of this package are vulnerable to CRLF Injection via the envelope.size parameter in the sendMail function. An attacker can inject arbitrary SMTP commands by supplying CRLF characters in the size property, which are concatenated directly into the SMTP command stream. This can result in unauthorized recipients being added to outgoing emails or other SMTP commands being executed.

    Note:

    This is only exploitable if the application explicitly passes a custom envelope object with a user-controlled size property to the mail sending process.

    How to fix CRLF Injection?

    Upgrade nodemailer to version 8.0.4 or higher.

    <8.0.4
    • H
    Uncontrolled Recursion

    nodemailer is an Easy as cake e-mail sending from your Node.js applications

    Affected versions of this package are vulnerable to Uncontrolled Recursion in the addressparser function. An attacker can cause the process to terminate immediately by sending an email address header containing deeply nested groups, separated by many :s.

    How to fix Uncontrolled Recursion?

    Upgrade nodemailer to version 7.0.11 or higher.

    <7.0.11
    • M
    Interpretation Conflict

    nodemailer is an Easy as cake e-mail sending from your Node.js applications

    Affected versions of this package are vulnerable to Interpretation Conflict due to improper handling of quoted local-parts containing @. An attacker can cause emails to be sent to unintended external recipients or bypass domain-based access controls by crafting specially formatted email addresses with quoted local-parts containing the @ character.

    How to fix Interpretation Conflict?

    Upgrade nodemailer to version 7.0.7 or higher.

    <7.0.7
    • M
    Regular Expression Denial of Service (ReDoS)

    nodemailer is an Easy as cake e-mail sending from your Node.js applications

    Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the attachDataUrls parameter or when parsing attachments with an embedded file. An attacker can exploit this vulnerability by sending a specially crafted email that triggers inefficient regular expression evaluation, leading to excessive consumption of CPU resources.

    How to fix Regular Expression Denial of Service (ReDoS)?

    Upgrade nodemailer to version 6.9.9 or higher.

    <6.9.9
    Go back to all versions of this package