Packages / nodemailer / Security

CriticalVulnerabilityGHSA-48ww-j4fc-435pCVE-2020-7769Published 10 May 2021

Command injection in nodemailer

Your version

Affected releases · nodemailer

  • 6.x6.0.0 – 6.4.15Fixed in 6.4.16
  • 5.x and older0.1.1 – 5.1.1No fix, no longer updated

On 6.x, the newest line:

npm install nodemailer@6.4.16
Every release on a timeline
10.x

  1. Not affected

    10.0.0 – 10.2.1

    27 releases, latest

6.x

  1. Affected

    6.0.0 – 6.4.15

    21 releases

  2. Fixed

    6.4.16 – 6.10.1

    39 releases

5.x

  1. Affected

    5.0.0 – 5.1.1

    4 releases

4.x

  1. Affected

    4.0.0 – 4.7.0

    23 releases

3.x

  1. Affected

    3.0.0 – 3.1.8

    12 releases

2.x

  1. Affected

    2.0.0 – 2.7.2

    19 releases

1.x

  1. Affected

    1.0.0 – 1.11.0

    24 releases

0.x

  1. Affected

    0.1.1 – 0.7.1

    102 releases

305 stable releases of nodemailer, oldest to newest, one row per major.

What happens

This affects the package nodemailer before 6.4.16. Use of crafted recipient email addresses may result in arbitrary command flag injection in sendmail transport for sending mails.