Summary
@payloadcms/email-nodemailer@3.84.1 pins nodemailer: 7.0.12 as an exact dependency. That version is vulnerable to two known advisories. The patched range is nodemailer >= 8.0.5.
Note: PR #16501 (chore: bump nodemailer minimum version to 8.0.5) by @abarani already proposes exactly this fix and was opened 2026-05-06. It's awaiting review (mergeable_state: blocked). Filing this issue to document downstream impact and add visibility — reviewing/merging that PR would close this.
Downstream consumers can't safely fix this without forcing the upgrade through a package-manager override, which is brittle and easy to miss.
Vulnerability details
| Severity |
Advisory |
Vulnerable |
Patched |
| Moderate |
GHSA-vvjj-xcjg-gr5g — SMTP command injection via CRLF in transport name (EHLO/HELO) |
<= 8.0.4 |
>= 8.0.5 |
| Low |
GHSA-c7w3-x93f-qmm8 — SMTP command injection via unsanitized envelope.size |
< 8.0.4 |
>= 8.0.4 |
Current pin
packages/email-nodemailer/package.json declares:
Reproduction
mkdir nodemailer-cve && cd nodemailer-cve
npm init -y
npm install @payloadcms/email-nodemailer@3.84.1
npm audit
Both advisories above appear.
Requested fix
Bump the declared dependency in @payloadcms/email-nodemailer from nodemailer: 7.0.12 to nodemailer: ^8.0.5 (or wider). The v7 → v8 surface area used by this adapter (transport creation + sendMail) is unchanged in practice.
PR #16501 already implements this — just needs a review.
Workaround used downstream
Pinned via pnpm override:
overrides:
nodemailer@<8.0.5: ">=8.0.5"
Related
Environment
payload: 3.84.1@payloadcms/email-nodemailer: 3.84.1- Node: 22+
- Package manager: pnpm 11
Summary
@payloadcms/email-nodemailer@3.84.1pinsnodemailer: 7.0.12as an exact dependency. That version is vulnerable to two known advisories. The patched range isnodemailer >= 8.0.5.Downstream consumers can't safely fix this without forcing the upgrade through a package-manager override, which is brittle and easy to miss.
Vulnerability details
name(EHLO/HELO)<= 8.0.4>= 8.0.5envelope.size< 8.0.4>= 8.0.4Current pin
packages/email-nodemailer/package.jsondeclares:Reproduction
Both advisories above appear.
Requested fix
Bump the declared dependency in
@payloadcms/email-nodemailerfromnodemailer: 7.0.12tonodemailer: ^8.0.5(or wider). The v7 → v8 surface area used by this adapter (transport creation +sendMail) is unchanged in practice.PR #16501 already implements this — just needs a review.
Workaround used downstream
Pinned via pnpm override:
Related
chore: bump nodemailer minimum version to 8.0.5— the proposed fix, awaiting reviewchore: bump nodemailer to 7.0.12 (security)— prior security bump (current pin)chore(email-nodemailer): bump nodemailer dependencies to latestchore(deps): bump nodemailerCVE-2024-53900 - Upgrade Mongoose to 8.8.3— same recurring "transitive dep is the latest CVE" patternEnvironment
payload: 3.84.1@payloadcms/email-nodemailer: 3.84.1