Newly released CVEs across every platform — sleek to read, verbose on demand, and served raw as markdown for AI and agent ingestion. Severity reads as depth: the deeper the contact, the graver the threat.
Depth = severity + exploitation
CVE-2026-121424Medium· 6.5Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that allows remote attackers to redirect recipients by ending nested RFC 5322 comments at the first closing parenthesis. Attackers can submit …
CVE-2026-121425Medium· 6.5PoCNodemailer from 3.0.0 before 10.1.4 contains a parsing flaw in addressparser that ends an RFC 5322 group at a semicolon inside quoted display names or comments. Attackers can submit crafted group addresses that conformant validators appr…
CVE-2026-121426Medium· 6.5Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that ends an angle-addr at a '>' inside a quoted local part, comment or domain literal. Attackers can submit addresses that validate as an all…
GHSA-4g23-2xm8-66gcMedium· 5.9Nodemailer: Quadratic (O(n^2)) SMTP client reply parsing lets a malicious server or MITM cause a pre-auth remote denial of service
GHSA-g73g-hqqh-jr95Medium· 5.3Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped
GHSA-4ffr-jq9g-5ffxMedium· 5.9Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service
GHSA-85x2-q946-cp5hMedium· 6.5Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name
GHSA-m943-m63m-w62wMedium· 6.5Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient
GHSA-8c8m-p3m8-cjg8Medium· 6.5Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient
GHSA-wxxx-r42m-9rp8High· 6.5Duplicate Advisory: Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signing
CVE-2026-110872Medium· 5.9PoCNodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP client reply parser in SMTPConnection._onData and isPartialResponse. A malicious SMTP server or on-path attacker can stream …
CVE-2026-110871Medium· 6.5PoCNodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that allows users to exhaust CPU through quadratic header unfolding. Attackers can supply large recipient lists or long headers…
CVE-2026-110870Medium· 5.3PoCNodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322 comments inside angle-bracket addresses. Attackers can supply recipients like a display name with…
CVE-2026-110869High· 7.5PoCNodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection._actionEHLO, whose four AUTH mechanism detection regexes contain overlapping whitespace sub-patterns that backtrack quadratically. A malicious o…
GHSA-prgh-xp8r-p3m5High· 7.5Nodemailer addressparser: O(n^2) on comment-joined addresses enables a remote DoS (reachable via mailparser)
GHSA-v53p-9fqp-m79jHigh· 7.5Nodemailer: Quadratic backtracking in the addressparser free-text fallback allows remote denial of service
GHSA-g57g-f23g-4646Medium· 5.3Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing
GHSA-8vvx-rff5-p5rqMedium· 5.9Nodemailer: Nested structured recipient arrays bypass the parser depth limit and cause stack exhaustion DoS
GHSA-6vj9-mwq6-2f5vMedium· 5.9Nodemailer: Process-global DNS cache reuses TLS `servername` across transports, enabling cross-tenant SMTP credential disclosure
CVE-2026-100702Medium· 5.9Nodemailer before 10.0.2 fails to properly flatten deeply nested arrays in recipient fields such as to, cc, and bcc, allowing attackers to cause stack exhaustion. Attackers can supply a deeply nested JSON recipient array that triggers re…
CVE-2026-100701Medium· 5.9Nodemailer versions 5.0.0 through 10.0.1 use a process-global DNS cache that is keyed only by the DNS host, while each cache entry also stores the caller-specific TLS servername. When two direct TLS/SMTPS transports (secure: true) resolv…
CVE-2026-100699Medium· 5.3PoCNodemailer is a Node.js email-sending library. In versions >= 9.1.0 and < 10.0.9, the address parser (src/addressparser) mishandles addresses whose local-part is a quoted string and that are followed by RFC 5322 comments, allowing traili…
CVE-2026-100700High· 7.5PoCnodemailer before 10.0.6 contains a denial of service vulnerability in the addressparser free-text fallback regex pattern that exhibits quadratic backtracking behavior. Attackers can supply crafted email header values with long whitespac…
CVE-2026-92595Medium· 5.9PoCNodemailer (npm package `nodemailer`) versions 9.1.0 and earlier do not honor the `disableFileAccess` and `disableUrlAccess` sandbox options when message content is resolved through the public plugin API `MailMessage.resolveContent()` us…
CVE-2026-92597Medium· 6.5Nodemailer versions >= 6.9.16 and < 9.1.0 mis-parse RFC 5322 comments in email addresses: in lib/addressparser, a comment closed immediately before a non-break character causes the tokenizer to concatenate the atoms surrounding the comme…
The beta is over. VulnSea now runs at vulnsea.com, every old beta link redirects to the same page, and your account, API keys and watchlists came with it. Plus a round of hardening, faster pages, and new request limits agents should know about.
A summary of everything that shipped over the last two weeks — the whole corpus is open, agents get change feeds, alias resolution and EPSS movers, and the data now includes CVE.org, vendor CSAF, aggregated exploits and per-source scores.
A step-by-step guide to plugging VulnSea into automated and agentic workflows — poll the delta, triage without burning tokens, match an SBOM, and let an MCP-native model do the reasoning.