Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:npm/nodemailer@6.4.7
purl pkg:npm/nodemailer@6.4.7
Next non-vulnerable version 6.6.1
Latest non-vulnerable version 8.0.5
Risk 4.5
Vulnerabilities affecting this package (2)
Vulnerability Summary Fixed by
VCID-5va3-b6xm-s3dt
Aliases:
CVE-2020-7769
GHSA-48ww-j4fc-435p
Injection Vulnerability Use of crafted recipient email addresses may result in arbitrary command flag injection in sendmail transport for sending emails.
6.4.16
Affected by 1 other vulnerability.
VCID-ggzv-yq4b-4qdk
Aliases:
CVE-2021-23400
GHSA-hwqf-gcqm-7353
Injection Vulnerability The package nodemailer is vulnerable to HTTP Header Injection if unsanitized user input that may contain newlines and carriage returns is passed into an address object.
6.6.1
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-06-06T00:47:17.701452+00:00 GitLab Importer Affected by VCID-ggzv-yq4b-4qdk https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/nodemailer/CVE-2021-23400.yml 38.6.0
2026-06-04T20:40:57.653210+00:00 GitLab Importer Affected by VCID-5va3-b6xm-s3dt https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/nodemailer/CVE-2020-7769.yml 38.6.0