CVE-2020-7769: Nodemailer

Critical severity, CVSS 9.8. EPSS: 2.3% chance of exploitation in the next 30 days.

This affects the package nodemailer before 6.4.16. Use of crafted recipient email addresses may result in arbitrary command flag injection in sendmail transport for sending mails.

Affected products

• Nodemailer Nodemailer: before 6.4.16 (fixed in 6.4.16)

Published 2020-11-12. Last modified 2026-06-17.