nodemailer

Easy as cake e-mail sending from your Node.js applications

Latest 10.1.2

92%

Total Score

healthy

Long-lived project with frequent releases and current repository activity; workflow pinning is the main hygiene concern.

Are you affected? Scan for Free

Health Score Breakdown

Lifecycle scripts

A prepare lifecycle script runs during installation or package preparation. This is an additional execution step for consumers, though the other signals show a structured, actively maintained project.

Repo tooling

The repository uses TypeScript and npm build tooling, but no security scanning tool was detected. The missing scanner is a modest hygiene gap, partly offset by the repository's security policy and provenance.

Workflow audit

All three workflows were analyzed with no untrusted checkouts or script injection, and the only audit finding was low-confidence cache-poisoning hygiene. However, 11 of 11 action references are unpinned and two workflows have top-level write permissions, creating a real but non-severe maintenance and supply-chain hygiene concern.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-804227 nodemailer is vulnerable to Regular Expression Denial of Service (ReDoS) in versions 3.0.0 - 10.0.12.	3.0.0 - 10.0.12	Medium
AIKIDO-2026-306294 nodemailer is vulnerable to Improper Input Validation in versions 3.0.0 - 10.0.12.	3.0.0 - 10.0.12	Medium
AIKIDO-2026-284931 nodemailer is vulnerable to Denial of Service (DoS) in versions 0.0.1 - 10.0.9.	0.0.1 - 10.0.9	Medium
AIKIDO-2026-810392 nodemailer is vulnerable to Denial of Service (DoS) in versions 3.0.0 - 10.0.9.	3.0.0 - 10.0.9	Medium
AIKIDO-2026-612508 nodemailer is vulnerable to Regular Expression Denial of Service (ReDoS) in versions 3.0.0 - 10.0.5.	3.0.0 - 10.0.5	High