Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
GitHub Actions nodemailer could let attackers send forged emails
published 23 days ago
Summary
The nodemailer component used in GitHub Actions had two security weaknesses that could allow a malicious user to craft and send fake email messages. This could be used to deceive recipients or hide the source of the messages. Update to version 9.0.1-tuxcare.2 to resolve the issue.
What to do
- Update GitHub Actions nodemailer to version 9.0.1-tuxcare.2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:npm | GitHub Actions | nodemailer |
< 9.0.1-tuxcare.2 Fix: upgrade to 9.0.1-tuxcare.2
|
Original advisory text
TuxCare security update for nodemailer (2 CVEs)
TuxCare rebuilt nodemailer to address 2 CVEs. Fixed in 9.0.1-tuxcare.2.
Timeline
Published12 Oct 2026
Updated13 Oct 2026
First seen13 Oct 2026
Sources
CLSA-2026-1791846723 · OSV
Track software like this
Free during beta