{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f95254a7-4853-5fd4-8952-3ef3d7ed5512", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "nodemailer", "purl": "pkg:npm/nodemailer@6.10.1-tuxcare.5", "type": "library", "bom-ref": "pkg:npm/nodemailer@6.10.1-tuxcare.5", "version": "6.10.1-tuxcare.5", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-13033", "affects": [ { "ref": "pkg:npm/nodemailer@6.10.1-tuxcare.5" } ], "bom-ref": "urn:uuid:6f8e9a00-7c7e-5f39-a760-45f93f8bd1e0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-13033 is fixed in version 6.10.1-tuxcare.5 of nodemailer." } }, { "id": "CVE-2025-14874", "affects": [ { "ref": "pkg:npm/nodemailer@6.10.1-tuxcare.5" } ], "bom-ref": "urn:uuid:fa2aa0b6-5528-54b5-b48e-108f88b55750", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-14874 is fixed in version 6.10.1-tuxcare.5 of nodemailer." } }, { "id": "CVE-2026-82659", "affects": [ { "ref": "pkg:npm/nodemailer@6.10.1-tuxcare.5" } ], "bom-ref": "urn:uuid:d87d32a8-5a64-59ba-83a4-931e01ce1871", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-82659 affects version 6.10.1-tuxcare.5 of nodemailer, and is fixed in 6.10.1-tuxcare.9." } }, { "id": "CVE-2026-82660", "affects": [ { "ref": "pkg:npm/nodemailer@6.10.1-tuxcare.5" } ], "bom-ref": "urn:uuid:6d30ef0a-670b-50e9-8aef-2b9a14d17221", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-82660 affects version 6.10.1-tuxcare.5 of nodemailer, and is fixed in 6.10.1-tuxcare.9." } }, { "id": "CVE-2026-82661", "affects": [ { "ref": "pkg:npm/nodemailer@6.10.1-tuxcare.5" } ], "bom-ref": "urn:uuid:7314d282-ed27-5dcb-be2e-2badd452d062", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-82661 affects version 6.10.1-tuxcare.5 of nodemailer, and is fixed in 6.10.1-tuxcare.9." } }, { "id": "CVE-2026-82662", "affects": [ { "ref": "pkg:npm/nodemailer@6.10.1-tuxcare.5" } ], "bom-ref": "urn:uuid:79a3bb92-a2b3-57de-ba95-b86c3bc89dea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-82662 affects version 6.10.1-tuxcare.5 of nodemailer, and is fixed in 6.10.1-tuxcare.9." } }, { "id": "CVE-2026-82853", "affects": [ { "ref": "pkg:npm/nodemailer@6.10.1-tuxcare.5" } ], "bom-ref": "urn:uuid:5c6b32b9-be0b-5682-b79c-98563b15a029", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-82853 affects version 6.10.1-tuxcare.5 of nodemailer, and is fixed in 6.10.1-tuxcare.9." } }, { "id": "CVE-2026-82854", "affects": [ { "ref": "pkg:npm/nodemailer@6.10.1-tuxcare.5" } ], "bom-ref": "urn:uuid:ffad611d-eeba-506c-b92c-dc7eacf5a2b1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-82854 affects version 6.10.1-tuxcare.5 of nodemailer, and is fixed in 6.10.1-tuxcare.9." } }, { "id": "GHSA-268h-hp4c-crq3", "affects": [ { "ref": "pkg:npm/nodemailer@6.10.1-tuxcare.5" } ], "bom-ref": "urn:uuid:88c93cf0-e237-53c6-8917-d9672d7777d3", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-268h-hp4c-crq3 affects version 6.10.1-tuxcare.5 of nodemailer, and is fixed in 6.10.1-tuxcare.8." } }, { "id": "GHSA-2x7j-588g-ccc2", "affects": [ { "ref": "pkg:npm/nodemailer@6.10.1-tuxcare.5" } ], "bom-ref": "urn:uuid:256e20e2-0296-5028-b33c-b40e263bc65c", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-2x7j-588g-ccc2 affects version 6.10.1-tuxcare.5 of nodemailer, and is fixed in 6.10.1-tuxcare.8." } }, { "id": "GHSA-46j5-6fg5-4gv3", "affects": [ { "ref": "pkg:npm/nodemailer@6.10.1-tuxcare.5" } ], "bom-ref": "urn:uuid:7441a217-eb73-5cea-8ba4-a15ccba52b09", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-46j5-6fg5-4gv3 is a false positive for nodemailer 6.10.1-tuxcare.5." } }, { "id": "GHSA-8m3c-c648-2xjj", "affects": [ { "ref": "pkg:npm/nodemailer@6.10.1-tuxcare.5" } ], "bom-ref": "urn:uuid:ca27f6ac-711d-5e32-8755-b6149f0d8f3f", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-8m3c-c648-2xjj affects version 6.10.1-tuxcare.5 of nodemailer." } }, { "id": "GHSA-c7w3-x93f-qmm8", "affects": [ { "ref": "pkg:npm/nodemailer@6.10.1-tuxcare.5" } ], "bom-ref": "urn:uuid:59b63c06-935b-5ae1-98c9-87efe50c1759", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-c7w3-x93f-qmm8 affects version 6.10.1-tuxcare.5 of nodemailer, and is fixed in 6.10.1-tuxcare.6." } }, { "id": "GHSA-cc9r-2j5m-2m83", "affects": [ { "ref": "pkg:npm/nodemailer@6.10.1-tuxcare.5" } ], "bom-ref": "urn:uuid:c90ffb99-1732-535c-a6d0-f685a7ca4357", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-cc9r-2j5m-2m83 affects version 6.10.1-tuxcare.5 of nodemailer, and is fixed in 6.10.1-tuxcare.8." } }, { "id": "GHSA-h3hj-cmcx-xc66", "affects": [ { "ref": "pkg:npm/nodemailer@6.10.1-tuxcare.5" } ], "bom-ref": "urn:uuid:54c1e9b9-59ef-5c72-a46e-abc0b18854be", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-h3hj-cmcx-xc66 is a false positive for nodemailer 6.10.1-tuxcare.5." } }, { "id": "GHSA-jj37-3377-m6vv", "affects": [ { "ref": "pkg:npm/nodemailer@6.10.1-tuxcare.5" } ], "bom-ref": "urn:uuid:4eab6c89-bbf4-59c3-8022-193f9b6c6f5f", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-jj37-3377-m6vv is a false positive for nodemailer 6.10.1-tuxcare.5." } }, { "id": "GHSA-mm7p-fcc7-pg87", "affects": [ { "ref": "pkg:npm/nodemailer@6.10.1-tuxcare.5" } ], "bom-ref": "urn:uuid:c13e44dd-f7c6-591e-95a0-9ed421ff8d3e", "analysis": { "state": "not_affected", "detail": "Vulnerability GHSA-mm7p-fcc7-pg87 does not affect version 6.10.1-tuxcare.5 of nodemailer. already_fixed \u2014 The target repository (nodemailer 6.10.1-tuxcare.3) already contains the complete security fix for CVE-2025-13033/GHSA-mm7p-fcc7-pg87. The fix was backported by TuxCare on December 9, 2025 via commit 189d7aa. The vulnerability involved incorrect parsing of quoted local-parts containing @ symbols, which could cause email misrouting to attacker-controlled domains. The fix adds quote state trackin...", "justification": "code_not_present" } }, { "id": "GHSA-p6gq-j5cr-w38f", "affects": [ { "ref": "pkg:npm/nodemailer@6.10.1-tuxcare.5" } ], "bom-ref": "urn:uuid:a1ed8918-4737-55a4-93e4-38350ad320f5", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-p6gq-j5cr-w38f is fixed in version 6.10.1-tuxcare.5 of nodemailer." } }, { "id": "GHSA-r7g4-qg5f-qqm2", "affects": [ { "ref": "pkg:npm/nodemailer@6.10.1-tuxcare.5" } ], "bom-ref": "urn:uuid:67d38812-0a89-5d2e-b96c-31de18929b24", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-r7g4-qg5f-qqm2 affects version 6.10.1-tuxcare.5 of nodemailer, and is fixed in 6.10.1-tuxcare.6." } }, { "id": "GHSA-vvjj-xcjg-gr5g", "affects": [ { "ref": "pkg:npm/nodemailer@6.10.1-tuxcare.5" } ], "bom-ref": "urn:uuid:e117079a-08e9-57e4-a938-5bce17148e5e", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-vvjj-xcjg-gr5g is fixed in version 6.10.1-tuxcare.5 of nodemailer." } }, { "id": "GHSA-wmmp-3585-3rmp", "affects": [ { "ref": "pkg:npm/nodemailer@6.10.1-tuxcare.5" } ], "bom-ref": "urn:uuid:26aaff11-d479-53c3-8753-12eff832103c", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-wmmp-3585-3rmp affects version 6.10.1-tuxcare.5 of nodemailer, and is fixed in 6.10.1-tuxcare.8." } }, { "id": "GHSA-wqvq-jvpq-h66f", "affects": [ { "ref": "pkg:npm/nodemailer@6.10.1-tuxcare.5" } ], "bom-ref": "urn:uuid:c1c720ce-5970-5f37-ad5a-b38509821ad7", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-wqvq-jvpq-h66f is fixed in version 6.10.1-tuxcare.5 of nodemailer." } } ], "dependencies": [ { "ref": "pkg:npm/nodemailer@6.10.1-tuxcare.5" } ] }