Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
nodemailer could let attackers send forged emails
published 7 days ago
Summary
The nodemailer email‑sending library contains a flaw that could be exploited to make it send messages that appear to come from someone else. This can undermine trust in communications sent from your applications. Upgrade to version 9.0.1‑tuxcare.6 as soon as possible to close the risk.
What to do
- Update GitHub Actions nodemailer to version 9.0.1-tuxcare.6.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:npm | GitHub Actions | nodemailer |
>= 9.0.1-tuxcare.0, < 9.0.1-tuxcare.6 Fix: upgrade to 9.0.1-tuxcare.6
|
Original advisory text
TuxCare security update for nodemailer (1 CVE)
TuxCare rebuilt nodemailer to address 1 CVE. Fixed in 9.0.1-tuxcare.6.
Timeline
Published28 Oct 2026
Updated29 Oct 2026
First seen29 Oct 2026
Sources
CLSA-2026-1793215120 · OSV
Track software like this
Free during beta