CVE-2026-100699
1 advisory.
npm/nodemailer CVE-2026-100699: medium 5.3
Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing
Action: Upgrade nodemailer to 10.0.9 or later.
npm i nodemailer@10.0.9Affected
| introduced | fixed | last affected |
|---|---|---|
| 9.1.0 | 10.0.9 | - |
Fixed versions
| 10.0.9 |
Sources
- osv: GHSA-g57g-f23g-4646
- https://github.com/nodemailer/nodemailer/security/advisories/GHSA-g57g-f23g-4646
- https://github.com/nodemailer/nodemailer/commit/2f36eb1aa1dd33e312411dc9b888548e14db54ee
- https://github.com/nodemailer/nodemailer
- https://github.com/nodemailer/nodemailer/releases/tag/v10.0.9
CVE-2026-100699 · published · modified · JSON