Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
GitHub Actions nodemailer may allow unauthorized email sending
published today
Summary
The nodemailer package used in GitHub Actions can be tricked into sending email messages that the attacker controls. This could let malicious messages be delivered from your systems, potentially spreading spam or phishing. Update to version 2.7.2‑tuxcare.10 as soon as possible to fix the problem.
What to do
- Update GitHub Actions nodemailer to version 2.7.2-tuxcare.10.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:npm | GitHub Actions | nodemailer |
>= 2.7.2-tuxcare.0, < 2.7.2-tuxcare.10 Fix: upgrade to 2.7.2-tuxcare.10
|
Original advisory text
TuxCare security update for nodemailer (2 CVEs)
TuxCare rebuilt nodemailer to address 2 CVEs. Fixed in 2.7.2-tuxcare.10.
Timeline
Published4 Nov 2026
Updated4 Nov 2026
First seen4 Nov 2026
Sources
CLSA-2026-1793790053 · OSV
Track software like this
Free during beta