StackRadar

CVE-2021-23400

Medium

Advisory

Published 10 Dec 2021In the index since 6 Sept 2026
Severity
Medium
worst across findings
CVSS
6.3
base score, highest
EPSS
0.014
71st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
21
of 17,781 indexed, latest versions
Container images
21
deployed by those charts
Fix available
1 of 1
affected package

Header injection in nodemailer

Carried by container images the latest versions of 21 of 17,781 indexed charts deploy, on 21 images.

Affected packageAffected versionsFixed inImages
nodemailernpm1.11.0, 2.7.2, 4.0.1, 4.6.8+10 more6.6.121
OSV records
GHSA-hwqf-gcqm-7353

Charts affected

21 by stars
ChartLatestAffected imagesRadar Score
netris-controllernetrisai2.8.21 of 14See more

netris-controller netrisai 2.8.2

1 of the 14 container images this version deploys carry CVE-2021-23400.

Container imageDigestPackageFixed in
netrisai/controller-web-service-backend:4.6.0-0086e865080e86c
nodemailer@2.7.2
6.6.1

Open the chart page →

30,326
wikijsgeek-cookbookVerified publisher6.4.21 of 1See more

wikijs geek-cookbook 6.4.2

1 of the 1 container images this version deploys carry CVE-2021-23400.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/wikijs:version-2.5.20158d377933678
nodemailer@6.4.14
6.6.1

Open the chart page →

5,946
kongakonga1.1.01 of 1See more

konga konga 1.1.0

1 of the 1 container images this version deploys carry CVE-2021-23400.

Container imageDigestPackageFixed in
pantsel/konga:latestc8172b75607d
nodemailer@4.7.0
6.6.1

Open the chart page →

5,209
soarv113assist-iot-cybersecurity-monitoring-soar0.1.31 of 5See more

soarv113 assist-iot-cybersecurity-monitoring-soar 0.1.3

1 of the 5 container images this version deploys carry CVE-2021-23400.

Container imageDigestPackageFixed in
assistiot/cybersecurity-monitoring_ir-kbn:latest0570b27bb7c2
nodemailer@6.4.16
6.6.1

Open the chart page →

17,896
data-fairdata354-helmVerified publisher1.1.21 of 12See more

data-fair data354-helm 1.1.2

1 of the 12 container images this version deploys carry CVE-2021-23400.

Container imageDigestPackageFixed in
ghcr.io/data-fair/simple-directory:438a4f32fad82
nodemailer@5.0.0
6.6.1

Open the chart page →

38,346
overseerrgeek-cookbookVerified publisher5.4.21 of 1See more

overseerr geek-cookbook 5.4.2

1 of the 1 container images this version deploys carry CVE-2021-23400.

Container imageDigestPackageFixed in
ghcr.io/sct/overseerr:1.26.1254d16af8f71
nodemailer@6.6.0
6.6.1

Open the chart page →

3,444
openhab-cloudandibraeuVerified publisher1.2.61 of 1See more

openhab-cloud andibraeu 1.2.6

1 of the 1 container images this version deploys carry CVE-2021-23400.

Container imageDigestPackageFixed in
openhab/openhab-cloud:a8138a329dd2bac8c4b
nodemailer@6.4.18
6.6.1

Open the chart page →

3,437
openapiassist-iot-open-api-management0.2.21 of 6See more

openapi assist-iot-open-api-management 0.2.2

1 of the 6 container images this version deploys carry CVE-2021-23400.

Container imageDigestPackageFixed in
pantsel/konga:latestc8172b75607d
nodemailer@4.7.0
6.6.1

Open the chart page →

18,277
node-redcloudnativeapp1.2.21 of 1See more

node-red cloudnativeapp 1.2.2

1 of the 1 container images this version deploys carry CVE-2021-23400.

Container imageDigestPackageFixed in
nodered/node-red-docker:0.19.6-v8070643219ea2
nodemailer@1.11.0
6.6.1

Open the chart page →

4,790
maildevcnieg1.1.11 of 1See more

maildev cnieg 1.1.1

1 of the 1 container images this version deploys carry CVE-2021-23400.

Container imageDigestPackageFixed in
cnieg/maildev:v1.1.998ee05668915
nodemailer@5.0.0
6.6.1

Open the chart page →

2,449
kongacreate-databases0.1.01 of 1See more

konga create-databases 0.1.0

1 of the 1 container images this version deploys carry CVE-2021-23400.

Container imageDigestPackageFixed in
pantsel/konga:latestc8172b75607d
nodemailer@4.7.0
6.6.1

Open the chart page →

5,209
Governify-Bluejaygovernify0.1.01 of 12See more

Governify-Bluejay governify 0.1.0

1 of the 12 container images this version deploys carry CVE-2021-23400.

Container imageDigestPackageFixed in
governify/registry:v3.4.0d3f37f4f8168
nodemailer@6.6.0
6.6.1

Open the chart page →

22,512
Governify-Falcongovernify0.1.01 of 10See more

Governify-Falcon governify 0.1.0

1 of the 10 container images this version deploys carry CVE-2021-23400.

Container imageDigestPackageFixed in
governify/registry:v3.4.0d3f37f4f8168
nodemailer@6.6.0
6.6.1

Open the chart page →

24,319
iofoghelm-chartsVerified publisher0.1.11 of 3See more

iofog helm-charts 0.1.1

1 of the 3 container images this version deploys carry CVE-2021-23400.

Container imageDigestPackageFixed in
quay.io/ctrontesting/iofog-controller:latest10df27bc5560
nodemailer@5.1.1
6.6.1

Open the chart page →

24,161
streamsheetshelm-chartsVerified publisher0.2.34 of 8See more

streamsheets helm-charts 0.2.3

4 of the 8 container images this version deploys carry CVE-2021-23400.

Container imageDigestPackageFixed in
ghcr.io/ctron/streamsheets-gateway:2.4.00635f17c9d2c
nodemailer@4.6.8
6.6.1
ghcr.io/ctron/streamsheets-service-graphs:2.4.0e34964e336c1
nodemailer@6.1.1
6.6.1
ghcr.io/ctron/streamsheets-service-machines:2.4.00c5a3398d1e4
nodemailer@6.1.1
6.6.1
ghcr.io/ctron/streamsheets-service-streams:2.4.08ba040e79ca0
nodemailer@6.1.1
6.6.1

Open the chart page →

89,959
wikijshomeenterpriseinc1.4.01 of 1See more

wikijs homeenterpriseinc 1.4.0

1 of the 1 container images this version deploys carry CVE-2021-23400.

Container imageDigestPackageFixed in
requarks/wiki:canary-2.5.2438b5865a7386c
nodemailer@6.4.14
6.6.1

Open the chart page →

4,253
ibm-microclimateibm-charts0.1.01 of 8See more

ibm-microclimate ibm-charts 0.1.0

1 of the 8 container images this version deploys carry CVE-2021-23400.

Container imageDigestPackageFixed in
ibmcom/microclimate-portal:latested5505e5c7ec
nodemailer@2.7.2
6.6.1

Open the chart page →

57,669
yapijoelee2012Verified publisher0.2.01 of 1See more

yapi joelee2012 0.2.0

1 of the 1 container images this version deploys carry CVE-2021-23400.

Container imageDigestPackageFixed in
jayfong/yapi:1.10.2163e5d621910
nodemailer@4.0.1
6.6.1

Open the chart page →

6,454
ferdi-serverobeoneVerified publisher1.0.31 of 2See more

ferdi-server obeone 1.0.3

1 of the 2 container images this version deploys carry CVE-2021-23400.

Container imageDigestPackageFixed in
getferdi/ferdi-server:1.3.26e620b85afaa
nodemailer@4.7.0
6.6.1

Open the chart page →

1,866
flomesh-consoleopenshift0.70.0-30-ubi81 of 2See more

flomesh-console openshift 0.70.0-30-ubi8

1 of the 2 container images this version deploys carry CVE-2021-23400.

Container imageDigestPackageFixed in
quay.io/flomesh/flomesh-console-ubi8:0.70.0-30ce6938ff6709
nodemailer@6.5.0
6.6.1

Open the chart page →

9,968
wekanschmitzis1.1.11 of 1See more

wekan schmitzis 1.1.1

1 of the 1 container images this version deploys carry CVE-2021-23400.

Container imageDigestPackageFixed in
quay.io/wekan/wekan:v5.65cb17600883a3
nodemailer@6.4.6
6.6.1

Open the chart page →

3,638

Container images carrying it

21 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
pantsel/konga:latestc8172b75607d
nodemailer@4.7.0
6.6.1
3
governify/registry:v3.4.0d3f37f4f8168
nodemailer@6.6.0
6.6.1
2
assistiot/cybersecurity-monitoring_ir-kbn:latest0570b27bb7c2
nodemailer@6.4.16
6.6.1
1
cnieg/maildev:v1.1.998ee05668915
nodemailer@5.0.0
6.6.1
1
getferdi/ferdi-server:1.3.26e620b85afaa
nodemailer@4.7.0
6.6.1
1
ibmcom/microclimate-portal:latested5505e5c7ec
nodemailer@2.7.2
6.6.1
1
jayfong/yapi:1.10.2163e5d621910
nodemailer@4.0.1
6.6.1
1
netrisai/controller-web-service-backend:4.6.0-0086e865080e86c
nodemailer@2.7.2
6.6.1
1
nodered/node-red-docker:0.19.6-v8070643219ea2
nodemailer@1.11.0
6.6.1
1
openhab/openhab-cloud:a8138a329dd2bac8c4b
nodemailer@6.4.18
6.6.1
1
requarks/wiki:canary-2.5.2438b5865a7386c
nodemailer@6.4.14
6.6.1
1
ghcr.io/ctron/streamsheets-gateway:2.4.00635f17c9d2c
nodemailer@4.6.8
6.6.1
1
ghcr.io/ctron/streamsheets-service-graphs:2.4.0e34964e336c1
nodemailer@6.1.1
6.6.1
1
ghcr.io/ctron/streamsheets-service-machines:2.4.00c5a3398d1e4
nodemailer@6.1.1
6.6.1
1
ghcr.io/ctron/streamsheets-service-streams:2.4.08ba040e79ca0
nodemailer@6.1.1
6.6.1
1
ghcr.io/data-fair/simple-directory:438a4f32fad82
nodemailer@5.0.0
6.6.1
1
ghcr.io/linuxserver/wikijs:version-2.5.20158d377933678
nodemailer@6.4.14
6.6.1
1
ghcr.io/sct/overseerr:1.26.1254d16af8f71
nodemailer@6.6.0
6.6.1
1
quay.io/ctrontesting/iofog-controller:latest10df27bc5560
nodemailer@5.1.1
6.6.1
1
quay.io/flomesh/flomesh-console-ubi8:0.70.0-30ce6938ff6709
nodemailer@6.5.0
6.6.1
1
quay.io/wekan/wekan:v5.65cb17600883a3
nodemailer@6.4.6
6.6.1
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.