CompatHub
Check EOL

Package compatibility

Nodemailer 2

What Node.js versions does this Nodemailer version support?

Compatibility is derived from the declared Node.js version requirement (npm engines.node). CompatHub does not independently test every combination.

Declared Node.js requirement

engines.node
>=0.10.0
Tip version
2.7.2
Source
npm Registry (engines.node)

Node.js compatibility matrix

Evaluated against CompatHub Node.js VersionLines. Compatibility and lifecycle status are separate signals.

Other Nodemailer lines

Security

Advisories affecting Nodemailer 2 (OSV.dev evidence). Known exploited status, due dates, and ransomware use from CISA KEV when matched.

Known vulnerabilities
10
Known exploited
0
Highest CVSS
—
  • GHSA-p6gq-j5cr-w38f

    Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered message

    Affected:
    <9.0.1
    Fixed in:
    9.0.1
    Source:
    OSV source
  • GHSA-268h-hp4c-crq3

    Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message header injection

    Affected:
    <8.0.9
    Fixed in:
    8.0.9
    Source:
    OSV source
  • GHSA-wqvq-jvpq-h66f

    Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess during message normalization

    Affected:
    <8.0.9
    Fixed in:
    8.0.9
    Source:
    OSV source
  • GHSA-r7g4-qg5f-qqm2

    Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interception

    Affected:
    <8.0.8
    Fixed in:
    8.0.8
    Source:
    OSV source
  • GHSA-vvjj-xcjg-gr5g

    Nodemailer Vulnerable to SMTP Command Injection via CRLF in Transport name Option (EHLO/HELO)

    Affected:
    <8.0.5
    Fixed in:
    8.0.5
    Source:
    OSV source
  • GHSA-c7w3-x93f-qmm8

    Nodemailer has SMTP command injection due to unsanitized `envelope.size` parameter

    Affected:
    <8.0.4
    Fixed in:
    8.0.4
    Source:
    OSV source
  • CVE-2025-13033GHSA-mm7p-fcc7-pg87

    Nodemailer: Email to an unintended domain can occur due to Interpretation Conflict

    Affected:
    <7.0.7
    Fixed in:
    7.0.7
    Source:
    OSV source · Advisory
  • GHSA-9h6g-pr28-7cqp

    nodemailer ReDoS when trying to send a specially crafted email

    Affected:
    <6.9.9
    Fixed in:
    6.9.9
    Source:
    OSV source
  • CVE-2021-23400GHSA-hwqf-gcqm-7353

    Header injection in nodemailer

    Affected:
    <6.6.1
    Fixed in:
    6.6.1
    Source:
    OSV source · Advisory
  • CVE-2020-7769GHSA-48ww-j4fc-435p

    Command injection in nodemailer

    Affected:
    <6.4.16
    Fixed in:
    6.4.16
    Source:
    OSV source · Advisory