Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
nodemailer may let email data be altered
published 16 days ago
Summary
The nodemailer library used in GitHub Actions and the @rootio version can be tricked into changing email contents without permission. This could let attackers modify messages or insert unwanted content. Update to the latest secured version of nodemailer as soon as possible.
What to do
- Update GitHub Actions nodemailer to version 9.1.1-aikido.4.
- Update rootio @rootio/nodemailer to version 9.1.1-root.io.4.
- Update nodemailer to version 9.1.1-aikido.5.
- Update rootio @rootio/nodemailer to version 9.1.1-root.io.5.
- Update nodemailer to version 9.1.1-aikido.6.
- Update rootio @rootio/nodemailer to version 9.1.1-root.io.6.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Root:npm | GitHub Actions | nodemailer |
< 9.1.1-aikido.4 Fix: upgrade to 9.1.1-aikido.4
|
| Root:npm | rootio | @rootio/nodemailer |
< 9.1.1-root.io.4 < 9.1.1-root.io.5 < 9.1.1-root.io.6 Fix: upgrade to 9.1.1-root.io.4
|
| Root:npm | – | nodemailer |
< 9.1.1-aikido.5 < 9.1.1-aikido.6 Fix: upgrade to 9.1.1-aikido.5
|
Original advisory text
GHSA-prgh-xp8r-p3m5 in nodemailer - Patched by Root
Root has patched GHSA-prgh-xp8r-p3m5 in the nodemailer package for Root:npm. Multiple fixed versions available.
Timeline
Published19 Oct 2026
Updated21 Oct 2026
First seen8 Oct 2026
Sources
Track software like this
Free during beta