Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
GitHub Actions nodemailer could let attackers send fake emails
published 1 month ago
Summary
The nodemailer component used in GitHub Actions can be tricked into sending forged messages, which could be used for phishing or fraud. The issue has been fixed in the updated version 0.7.1‑tuxcare.2. Upgrade to this version as soon as possible to protect your email communications.
What to do
- Update GitHub Actions nodemailer to version 0.7.1-tuxcare.2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:npm | GitHub Actions | nodemailer |
>= 0.7.1-tuxcare.0, < 0.7.1-tuxcare.2 Fix: upgrade to 0.7.1-tuxcare.2
|
Original advisory text
TuxCare security update for nodemailer (3 CVEs)
TuxCare rebuilt nodemailer to address 3 CVEs. Fixed in 0.7.1-tuxcare.2.
Timeline
Published9 Sep 2026
Updated15 Oct 2026
First seen15 Oct 2026
Sources
CLSA-2026-1788976685 · OSV
Track software like this
Free during beta