StackRadar

CVE-2026-92596

High

Advisory

Published 8 Sept 2026In the index since 18 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.005
39th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
188
of 17,803 indexed, latest versions
Container images
174
deployed by those charts
Fix available
1 of 1
affected package

Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address list

Carried by container images the latest versions of 188 of 17,803 indexed charts deploy, on 174 images.

Affected packageAffected versionsFixed inImages
nodemailernpm1.11.0, 2.7.2, 4.0.1, 4.6.8+49 more9.1.0174
OSV records
GHSA-2x7j-588g-ccc2

Charts affected

188 by stars
ChartLatestAffected imagesRadar Score
n8nopenshift1.18.01 of 1See more

n8n openshift 1.18.0

1 of the 1 container images this version deploys carry CVE-2026-92596.

Container imageDigestPackageFixed in
n8nio/n8n:2.36.714c4285bc303
nodemailer@8.0.10
9.1.0

Open the chart page →

1,050
xyopsquench-xyopsVerified publisher0.0.121 of 1See more

xyops quench-xyops 0.0.12

1 of the 1 container images this version deploys carry CVE-2026-92596.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/xyopsdigest-pinneddd7d8bf3b654
nodemailer@9.0.1
9.1.0

Open the chart page →

79
etherpadredhat-cop0.0.81 of 1See more

etherpad redhat-cop 0.0.8

1 of the 1 container images this version deploys carry CVE-2026-92596.

Container imageDigestPackageFixed in
etherpad/etherpad:latest6020e7b57f4b
nodemailer@9.0.3
9.1.0

Open the chart page →

908
claude-relayrevolution10.1.371 of 4See more

claude-relay revolution1 0.1.37

1 of the 4 container images this version deploys carry CVE-2026-92596.

Container imageDigestPackageFixed in
ghcr.io/wei-shaw/claude-relay-service:v1.1.292398c34934453
nodemailer@7.0.6
9.1.0

Open the chart page →

4,808
kresusrm3lVerified publisher0.2.11 of 3See more

kresus rm3l 0.2.1

1 of the 3 container images this version deploys carry CVE-2026-92596.

Container imageDigestPackageFixed in
bnjbvr/kresus:0.22.137e216b182c8
nodemailer@6.9.16
9.1.0

Open the chart page →

15,770
devtron-enterpriseromholdings48.0.01 of 28See more

devtron-enterprise romholdings 48.0.0

1 of the 28 container images this version deploys carry CVE-2026-92596.

Container imageDigestPackageFixed in
quay.io/devtron/notifier:9804331c-372-39294709c7da19c5a
nodemailer@7.0.13
9.1.0

Open the chart page →

69,552
routr-connectroutr0.4.35 of 10See more

routr-connect routr 0.4.3

5 of the 10 container images this version deploys carry CVE-2026-92596.

Container imageDigestPackageFixed in
fonoster/routr-connect:2.13.6e8c84b5eaa67
nodemailer@6.9.15
9.1.0
fonoster/routr-dispatcher:2.13.65f8f380dc174
nodemailer@6.9.15
9.1.0
fonoster/routr-location:2.13.6051ba9c34ef5
nodemailer@6.9.15
9.1.0
fonoster/routr-pgdata:2.13.6e4d5f5ff1945
nodemailer@6.9.15
9.1.0
fonoster/routr-registry:2.13.6e27001f2813c
nodemailer@6.9.15
9.1.0

Open the chart page →

11,072
karakeeprtomik-helm-chartsVerified publisher0.0.11 of 3See more

karakeep rtomik-helm-charts 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-92596.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.26.0f575a34ed3f8
nodemailer@7.0.4
9.1.0

Open the chart page →

5,359
audiobookshelfrubxkubeVerified publisher0.1.31 of 1See more

audiobookshelf rubxkube 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-92596.

Container imageDigestPackageFixed in
ghcr.io/advplyr/audiobookshelf:2.36.0180acad33d69
nodemailer@6.9.13
9.1.0

Open the chart page →

1,734
joplinrubxkubeVerified publisher1.3.11 of 2See more

joplin rubxkube 1.3.1

1 of the 2 container images this version deploys carry CVE-2026-92596.

Container imageDigestPackageFixed in
joplin/server:3.0-beta52af57880c0e
nodemailer@6.9.13
9.1.0

Open the chart page →

7,500
uptime-kumarubxkubeVerified publisher1.2.11 of 1See more

uptime-kuma rubxkube 1.2.1

1 of the 1 container images this version deploys carry CVE-2026-92596.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.4.091e963bfda56
nodemailer@7.0.13
9.1.0

Open the chart page →

30,706
uptime-kumasarab97Verified publisher0.1.51 of 1See more

uptime-kuma sarab97 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-92596.

Container imageDigestPackageFixed in
louislam/uptime-kuma:1.22.10b55bcb83a1c
nodemailer@6.6.5
9.1.0

Open the chart page →

4,794
rsshubsb-helm-charts0.3.01 of 1See more

rsshub sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-92596.

Container imageDigestPackageFixed in
diygod/rsshub:2025-11-097a6312cac0d5
nodemailer@7.0.10
9.1.0

Open the chart page →

4,745
outlineschmitzis0.0.81 of 4See more

outline schmitzis 0.0.8

1 of the 4 container images this version deploys carry CVE-2026-92596.

Container imageDigestPackageFixed in
outlinewiki/outline:0.69.1d060dcd8f9aa
nodemailer@6.9.1
9.1.0

Open the chart page →

4,444
wekanschmitzis1.1.11 of 1See more

wekan schmitzis 1.1.1

1 of the 1 container images this version deploys carry CVE-2026-92596.

Container imageDigestPackageFixed in
quay.io/wekan/wekan:v5.65cb17600883a3
nodemailer@6.4.6
9.1.0

Open the chart page →

3,661
seerr-chartseerr-chartVerified publisher3.9.11 of 1See more

seerr-chart seerr-chart 3.9.1

1 of the 1 container images this version deploys carry CVE-2026-92596.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:v3.4.1f4768de5f616
nodemailer@6.9.16
9.1.0

Open the chart page →

2,005
infisicalsinextraVerified publisher0.6.01 of 1See more

infisical sinextra 0.6.0

1 of the 1 container images this version deploys carry CVE-2026-92596.

Container imageDigestPackageFixed in
infisical/infisical:v0.165.602082bf13163
nodemailer@8.0.11
9.1.0

Open the chart page →

3,085
speckle-server-branch-hotfix-2.19.1speckleVerified publisher2.19.2-branch.hotfix-2.19.1.124125-665e7e11 of 5See more

speckle-server-branch-hotfix-2.19.1 speckle 2.19.2-branch.hotfix-2.19.1.124125-665e7e1

1 of the 5 container images this version deploys carry CVE-2026-92596.

Container imageDigestPackageFixed in
speckle/speckle-server:2.19.2-branch.hotfix-2.19.1.124125-665e7e14b6a0750d5aa
nodemailer@6.9.9
9.1.0

Open the chart page →

16,564
speckle-server-branch-hotfix-2.20.2speckleVerified publisher2.20.3-branch.hotfix-2.20.2.149555-37ea0cb1 of 5See more

speckle-server-branch-hotfix-2.20.2 speckle 2.20.3-branch.hotfix-2.20.2.149555-37ea0cb

1 of the 5 container images this version deploys carry CVE-2026-92596.

Container imageDigestPackageFixed in
speckle/speckle-server:2.20.3-branch.hotfix-2.20.2.149555-37ea0cb52f8eabf5cea
nodemailer@6.9.9
9.1.0

Open the chart page →

16,597
speckle-server-branch-testingspeckleVerified publisher2.17.14-branch.testing.72707.921a5f81 of 5See more

speckle-server-branch-testing speckle 2.17.14-branch.testing.72707.921a5f8

1 of the 5 container images this version deploys carry CVE-2026-92596.

Container imageDigestPackageFixed in
speckle/speckle-server:2.17.14-branch.testing.72707.921a5f849d10dcdfb91
nodemailer@6.7.5
9.1.0

Open the chart page →

14,827
speckle-server-branch-testing1speckleVerified publisher2.20.6-branch.testing1.154030-9b091141 of 5See more

speckle-server-branch-testing1 speckle 2.20.6-branch.testing1.154030-9b09114

1 of the 5 container images this version deploys carry CVE-2026-92596.

Container imageDigestPackageFixed in
speckle/speckle-server:2.20.6-branch.testing1.154030-9b09114e8413f57b327
nodemailer@6.9.9
9.1.0

Open the chart page →

16,597
speckle-server-branch-testing2speckleVerified publisher2.18.11-branch.testing2.88634-335d4691 of 5See more

speckle-server-branch-testing2 speckle 2.18.11-branch.testing2.88634-335d469

1 of the 5 container images this version deploys carry CVE-2026-92596.

Container imageDigestPackageFixed in
speckle/speckle-server:2.18.11-branch.testing2.88634-335d469bf6a501b2210
nodemailer@6.9.9
9.1.0

Open the chart page →

14,369
speckle-server-branch-testing3speckleVerified publisher2.18.12-branch.testing3.88744-f55b3411 of 5See more

speckle-server-branch-testing3 speckle 2.18.12-branch.testing3.88744-f55b341

1 of the 5 container images this version deploys carry CVE-2026-92596.

Container imageDigestPackageFixed in
speckle/speckle-server:2.18.12-branch.testing3.88744-f55b34189a5872375f9
nodemailer@6.9.9
9.1.0

Open the chart page →

14,369
speckle-server-branch-testing4speckleVerified publisher2.20.2-branch.testing4.134160-9fad4b21 of 5See more

speckle-server-branch-testing4 speckle 2.20.2-branch.testing4.134160-9fad4b2

1 of the 5 container images this version deploys carry CVE-2026-92596.

Container imageDigestPackageFixed in
speckle/speckle-server:2.20.2-branch.testing4.134160-9fad4b2687f43ab16f3
nodemailer@6.9.9
9.1.0

Open the chart page →

16,216
speckle-server-branch-testing5speckleVerified publisher2.21.3-branch.testing5.219631-2153bef1 of 5See more

speckle-server-branch-testing5 speckle 2.21.3-branch.testing5.219631-2153bef

1 of the 5 container images this version deploys carry CVE-2026-92596.

Container imageDigestPackageFixed in
speckle/speckle-server:2.21.3-branch.testing5.219631-2153bef8fd157733393
nodemailer@6.9.9
9.1.0

Open the chart page →

15,814
speckle-server-branch-testing6speckleVerified publisher2.25.10-branch.testing6.645-b125c1e1 of 4See more

speckle-server-branch-testing6 speckle 2.25.10-branch.testing6.645-b125c1e

1 of the 4 container images this version deploys carry CVE-2026-92596.

Container imageDigestPackageFixed in
speckle/speckle-server:2.25.10-branch.testing6.645-b125c1e75cdf256067b
nodemailer@6.9.9
9.1.0

Open the chart page →

11,260
strapistrapi-xmv0.1.11 of 1See more

strapi strapi-xmv 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-92596.

Container imageDigestPackageFixed in
ghcr.io/xmv-solutions-gmbh/strapi:latesta288b4571142
nodemailer@8.0.11
9.1.0

Open the chart page →

689
trudesktechpreta1.0.01 of 3See more

trudesk techpreta 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-92596.

Container imageDigestPackageFixed in
polonel/trudesk:1.2.60cf6513f6fe3
nodemailer@6.7.3
9.1.0

Open the chart page →

4,037
joplintobiassackmann0.1.71 of 2See more

joplin tobiassackmann 0.1.7

1 of the 2 container images this version deploys carry CVE-2026-92596.

Container imageDigestPackageFixed in
joplin/server:latest3f7b852959aa
nodemailer@6.10.1
9.1.0

Open the chart page →

5,650
twentytwenty-crm0.1.111 of 4See more

twenty twenty-crm 0.1.11

1 of the 4 container images this version deploys carry CVE-2026-92596.

Container imageDigestPackageFixed in
twentycrm/twenty:v2.22.0e7d9948bf284
nodemailer@9.0.1
9.1.0

Open the chart page →

5,634
unleash-enterpriseunleash1.0.31 of 1See more

unleash-enterprise unleash 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-92596.

Container imageDigestPackageFixed in
unleashorg/unleash-enterprise:7.5.0245aeba40053
nodemailer@7.0.13
9.1.0

Open the chart page →

2,041
kenerunxwaresVerified publisher2026.2.51 of 1See more

kener unxwares 2026.2.5

1 of the 1 container images this version deploys carry CVE-2026-92596.

Container imageDigestPackageFixed in
rajnandan1/kener:3.2.1930407afca731
nodemailer@6.10.0
9.1.0

Open the chart page →

5,282
devportalveecode-platform-nextVerified publisher0.1.231 of 1See more

devportal veecode-platform-next 0.1.23

1 of the 1 container images this version deploys carry CVE-2026-92596.

Container imageDigestPackageFixed in
veecode/devportaldigest-pinneda72cf5cb47b8
nodemailer@8.0.11
9.1.0

Open the chart page →

1,840
genievhdirkVerified publisher0.1.31 of 1See more

genie vhdirk 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-92596.

Container imageDigestPackageFixed in
stanfordoval/almond-server:latest1a63cdccedaf
nodemailer@6.7.2
9.1.0

Open the chart page →

3,142
colanodevictorlane0.3.31 of 3See more

colanode victorlane 0.3.3

1 of the 3 container images this version deploys carry CVE-2026-92596.

Container imageDigestPackageFixed in
ghcr.io/colanode/server:latest7006cac874fd
nodemailer@8.0.4
9.1.0

Open the chart page →

2,237
n8nvictorlane1.0.181 of 1See more

n8n victorlane 1.0.18

1 of the 1 container images this version deploys carry CVE-2026-92596.

Container imageDigestPackageFixed in
n8nio/n8n:1.115.1ed16e560c40e
nodemailer@6.9.9
9.1.0

Open the chart page →

6,485
wikiwikijs3.0.01 of 2See more

wiki wikijs 3.0.0

1 of the 2 container images this version deploys carry CVE-2026-92596.

Container imageDigestPackageFixed in
requarks/wiki:268f0d1848261
nodemailer@6.9.1
9.1.0

Open the chart page →

5,525
kibanawiremindVerified publisher8.5.231 of 2See more

kibana wiremind 8.5.23

1 of the 2 container images this version deploys carry CVE-2026-92596.

Container imageDigestPackageFixed in
library/kibana:8.18.004c0fc150f3a
nodemailer@6.9.15
9.1.0

Open the chart page →

6,350

Container images carrying it

174 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
louislam/uptime-kuma:2.5.4917318f9d7be
nodemailer@7.0.13
9.1.0
3
pantsel/konga:latestc8172b75607d
nodemailer@4.7.0
9.1.0
3
rcdelacruz/my-strapi-app:js-amd6438007f358355
nodemailer@6.9.1
9.1.0
3
ghcr.io/kamilkisiela/graphql-hive/app:59b64c36c866b3555c135c70de76a884e63f8619a4a3639899f7
nodemailer@6.8.0
9.1.0
3
ghcr.io/seerr-team/seerr:latest:v3.4.1f4768de5f616
nodemailer@6.9.16
9.1.0
3
quay.io/devtron/notifier:9804331c-372-39294709c7da19c5a
nodemailer@7.0.13
9.1.0
3
advplyr/audiobookshelf:2.36.13528a93b6442
nodemailer@6.9.13
9.1.0
2
governify/registry:v3.4.0d3f37f4f8168
nodemailer@6.6.0
9.1.0
2
hoppscotch/hoppscotch:2024.8.2f1da831950b7
nodemailer@6.9.14
9.1.0
2
infisical/infisical:latest:v0.165.602082bf13163
nodemailer@8.0.11
9.1.0
2
kutt/kutt:latest:v3.2.6fa3d24a89b04
nodemailer@9.0.3
9.1.0
2
library/ghost:6.63.0e05bc1169fb2
nodemailer@8.0.11
9.1.0
2
louislam/uptime-kuma:2.3.29aeb4e51d038
nodemailer@7.0.13
9.1.0
2
louislam/uptime-kuma:2.5.0a8610b3b4c38
nodemailer@7.0.13
9.1.0
2
moreillon/user-manager:v5.0.2e1c9bfab5c16
nodemailer@6.9.0
9.1.0
2
n8nio/n8n:2.36.714c4285bc303
nodemailer@8.0.10
9.1.0
2
outlinewiki/outline:0.69.1d060dcd8f9aa
nodemailer@6.9.1
9.1.0
2
rajnandan1/kener:3.2.1930407afca731
nodemailer@6.10.0
9.1.0
2
requarks/wiki:2:latest68f0d1848261
nodemailer@6.9.1
9.1.0
2
ghcr.io/advplyr/audiobookshelf:2.36.0180acad33d69
nodemailer@6.9.13
9.1.0
2
activepieces/activepieces:0.91.058414dfc94c4
nodemailer@9.0.1
9.1.0
1
activepieces/activepieces:0.23.0c26188b44e62
nodemailer@6.9.9
9.1.0
1
assistiot/cybersecurity-monitoring_ir-kbn:latest0570b27bb7c2
nodemailer@6.4.16
9.1.0
1
automatischio/automatisch:0.15.03bace7a12d5f
nodemailer@6.7.0
9.1.0
1
bnjbvr/kresus:0.22.137e216b182c8
nodemailer@6.9.16
9.1.0
1
budibase/apps:3.41.344fe6feab985
nodemailer@9.0.1
9.1.0
1
budibase/worker:3.41.3de5e2e560ce8
nodemailer@9.0.3
9.1.0
1
chocobozzz/peertube:v8.1.5052712130691
nodemailer@7.0.13
9.1.0
1
cnieg/maildev:v1.1.998ee05668915
nodemailer@5.0.0
9.1.0
1
countly/api:25.05.4f4cc7447c4f5
nodemailer@6.9.13
9.1.0
1
countly/countly-server:25.05.4e3c238248f99
nodemailer@6.9.13
9.1.0
1
countly/frontend:25.05.42acbc11499b6
nodemailer@6.9.13
9.1.0
1
devopsiaci/self-learning-platform:1.1.3d9441c931f75
nodemailer@8.0.1
9.1.0
1
directus/directus:12.0.29c8470ea465c
nodemailer@8.0.5
9.1.0
1
directus/directus:11.1.0e3c8bb975350
nodemailer@6.9.14
9.1.0
1
diygod/rsshub:2025-11-097a6312cac0d5
nodemailer@7.0.10
9.1.0
1
docmost/docmost:0.96.0b56947fcfd08
nodemailer@9.0.1
9.1.0
1
drumsergio/lynxprompt:2.0.75c6afb6679301
nodemailer@8.0.7
9.1.0
1
etherpad/etherpad:latest6020e7b57f4b
nodemailer@9.0.3
9.1.0
1
fallenbagel/jellyseerr:latest4538137bc5af
nodemailer@6.10.0
9.1.0
1
fallenbagel/jellyseerr:1.7.06dcdb5ba5091
nodemailer@6.9.3
9.1.0
1
fiware/idm:8.3.3a1b6ed4ae84f
nodemailer@6.7.8
9.1.0
1
fonoster/routr-connect:2.13.6e8c84b5eaa67
nodemailer@6.9.15
9.1.0
1
fonoster/routr-dispatcher:2.13.65f8f380dc174
nodemailer@6.9.15
9.1.0
1
fonoster/routr-location:2.13.6051ba9c34ef5
nodemailer@6.9.15
9.1.0
1
fonoster/routr-pgdata:2.13.6e4d5f5ff1945
nodemailer@6.9.15
9.1.0
1
fonoster/routr-registry:2.13.6e27001f2813c
nodemailer@6.9.15
9.1.0
1
fosrl/pangolin:1.13.0c32ad797ab96
nodemailer@7.0.11
9.1.0
1
growthbook/growthbook:5.0.1f53ead646b5f
nodemailer@9.0.1
9.1.0
1
helmforge/strapi-base:5.52.270e9143d6d92
nodemailer@9.0.1
9.1.0
1

syft 1.42.1 · advisories as of 18 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.