StackRadar

CVE-2026-92597

Medium

Advisory

Published 8 Sept 2026In the index since 18 Sept 2026
Severity
Medium
worst across findings
CVSS
6.5
base score, highest
EPSS
0.003
17th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
96
of 17,803 indexed, latest versions
Container images
85
deployed by those charts
Fix available
1 of 1
affected package

Nodemailer: Recipient-domain validation bypass via RFC 5322 comment mis-parsing leads to email delivery to an attacker-controlled domain

Carried by container images the latest versions of 96 of 17,803 indexed charts deploy, on 85 images.

Affected packageAffected versionsFixed inImages
nodemailernpm6.9.16, 6.10.0, 6.10.1, 7.0.3+16 more9.1.085
OSV records
GHSA-cc9r-2j5m-2m83

Charts affected

96 by stars
ChartLatestAffected imagesRadar Score
immichhelmforgeVerified publisher1.2.81 of 5See more

immich helmforge 1.2.8

1 of the 5 container images this version deploys carry CVE-2026-92597.

Container imageDigestPackageFixed in
ghcr.io/immich-app/immich-server:v3.1.0b434cb9287ee
nodemailer@9.0.3
9.1.0

Open the chart page →

11,268
paprahelmforgeVerified publisher1.0.01 of 1See more

papra helmforge 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-92597.

Container imageDigestPackageFixed in
ghcr.io/papra-hq/papra:26.6.2-rootlessa281cb44176d
nodemailer@9.0.1
9.1.0

Open the chart page →

2,601
strapihelmforgeVerified publisher2.3.141 of 3See more

strapi helmforge 2.3.14

1 of the 3 container images this version deploys carry CVE-2026-92597.

Container imageDigestPackageFixed in
helmforge/strapi-base:5.52.270e9143d6d92
nodemailer@9.0.1
9.1.0

Open the chart page →

2,133
twentyhelmforgeVerified publisher1.0.11 of 5See more

twenty helmforge 1.0.1

1 of the 5 container images this version deploys carry CVE-2026-92597.

Container imageDigestPackageFixed in
twentycrm/twenty:v2.40.06e3b2e68ad78
nodemailer@9.0.1
9.1.0

Open the chart page →

3,717
self-learning-platformhelm-self-learning-platformVerified publisher1.1.01 of 1See more

self-learning-platform helm-self-learning-platform 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-92597.

Container imageDigestPackageFixed in
devopsiaci/self-learning-platform:1.1.3d9441c931f75
nodemailer@8.0.1
9.1.0

Open the chart page →

1,480
bluesky-pdsijmacd1.0.01 of 2See more

bluesky-pds ijmacd 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-92597.

Container imageDigestPackageFixed in
ghcr.io/bluesky-social/pds:0.4d95725b24dbe
nodemailer@6.10.1
9.1.0

Open the chart page →

9,200
infisicalinfisical-charts0.4.21 of 3See more

infisical infisical-charts 0.4.2

1 of the 3 container images this version deploys carry CVE-2026-92597.

Container imageDigestPackageFixed in
infisical/infisical:latest02082bf13163
nodemailer@8.0.11
9.1.0

Open the chart page →

3,085
nocodbinseefrlab0.2.01 of 1See more

nocodb inseefrlab 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-92597.

Container imageDigestPackageFixed in
nocodb/nocodb:latest4b760f0d2547
nodemailer@9.0.5
9.1.0

Open the chart page →

786
ghostjanip81-helm-chartsVerified publisher0.1.21 of 1See more

ghost janip81-helm-charts 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-92597.

Container imageDigestPackageFixed in
library/ghost:6.37.01ef2e532ca4d
nodemailer@8.0.5
9.1.0

Open the chart page →

3,496
ghostk8s-home-lab-repo4.1.01 of 1See more

ghost k8s-home-lab-repo 4.1.0

1 of the 1 container images this version deploys carry CVE-2026-92597.

Container imageDigestPackageFixed in
library/ghost:6.41.129773d6be407
nodemailer@8.0.5
9.1.0

Open the chart page →

3,151
kenerkener-chart0.0.71 of 1See more

kener kener-chart 0.0.7

1 of the 1 container images this version deploys carry CVE-2026-92597.

Container imageDigestPackageFixed in
ghcr.io/rajnandan1/kener:3.2.182b993cb232eb
nodemailer@6.10.0
9.1.0

Open the chart page →

5,282
keycloak-multi-client-notifierkeycloak-multi-client-notifier2.1.21 of 2See more

keycloak-multi-client-notifier keycloak-multi-client-notifier 2.1.2

1 of the 2 container images this version deploys carry CVE-2026-92597.

Container imageDigestPackageFixed in
ghcr.io/blessingnator/keycloak-mcn-backend:2.0.5967470f05472
nodemailer@7.0.13
9.1.0

Open the chart page →

1,634
pangolinkrzwiatrzyk0.11.01 of 1See more

pangolin krzwiatrzyk 0.11.0

1 of the 1 container images this version deploys carry CVE-2026-92597.

Container imageDigestPackageFixed in
fosrl/pangolin:1.13.0c32ad797ab96
nodemailer@7.0.11
9.1.0

Open the chart page →

3,452
ghostkubernetes-homelab-helm-chartsVerified publisher0.1.21 of 2See more

ghost kubernetes-homelab-helm-charts 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-92597.

Container imageDigestPackageFixed in
library/ghost:6.39.0-alpine77196da4b0df
nodemailer@8.0.5
9.1.0

Open the chart page →

2,769
portfolio-trackerkubernetes-homelab-helm-chartsVerified publisher0.1.01 of 3See more

portfolio-tracker kubernetes-homelab-helm-charts 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-92597.

Container imageDigestPackageFixed in
ghcr.io/harish2k01/portfolio-tracker:0.1.056efa3085895
nodemailer@7.0.13
9.1.0

Open the chart page →

1,511
seerrkubernetes-homelab-helm-chartsVerified publisher0.1.21 of 1See more

seerr kubernetes-homelab-helm-charts 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-92597.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:v3.2.0c4cbd5121236
nodemailer@6.10.0
9.1.0

Open the chart page →

2,564
uptime-kumakubernetes-homelab-helm-chartsVerified publisher0.1.21 of 1See more

uptime-kuma kubernetes-homelab-helm-charts 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-92597.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.2.1-slim059b49d64739
nodemailer@7.0.13
9.1.0

Open the chart page →

6,408
kube-mailkubernetes-replicator0.11.11 of 3See more

kube-mail kubernetes-replicator 0.11.1

1 of the 3 container images this version deploys carry CVE-2026-92597.

Container imageDigestPackageFixed in
quay.io/mittwald/kube-mail:latest04f1099241fc
nodemailer@7.0.3
9.1.0

Open the chart page →

2,570
jellyseerrlbenicio-communityVerified publisher0.1.01 of 1See more

jellyseerr lbenicio-community 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-92597.

Container imageDigestPackageFixed in
fallenbagel/jellyseerr:latest4538137bc5af
nodemailer@6.10.0
9.1.0

Open the chart page →

3,571
uptime-kumalbenicio-communityVerified publisher0.1.11 of 1See more

uptime-kuma lbenicio-community 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-92597.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.3.29aeb4e51d038
nodemailer@7.0.13
9.1.0

Open the chart page →

33,731
uptime-kumaloeken-at-homeVerified publisher2.3.21 of 1See more

uptime-kuma loeken-at-home 2.3.2

1 of the 1 container images this version deploys carry CVE-2026-92597.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.3.29aeb4e51d038
nodemailer@7.0.13
9.1.0

Open the chart page →

33,731
logtidelogtideVerified publisher2.1.142 of 4See more

logtide logtide 2.1.14

2 of the 4 container images this version deploys carry CVE-2026-92597.

Container imageDigestPackageFixed in
ghcr.io/logtide-dev/logtide-backend:1.0.265463e02f887
nodemailer@9.0.1
9.1.0
ghcr.io/logtide-dev/logtide-frontend:1.0.22a7da1451f86
nodemailer@9.0.1
9.1.0

Open the chart page →

2,961
lynxpromptlynxpromptVerified publisher0.1.21 of 3See more

lynxprompt lynxprompt 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-92597.

Container imageDigestPackageFixed in
drumsergio/lynxprompt:2.0.75c6afb6679301
nodemailer@8.0.7
9.1.0

Open the chart page →

1,867
ghostmt1905028.25.11 of 3See more

ghost mt190502 8.25.1

1 of the 3 container images this version deploys carry CVE-2026-92597.

Container imageDigestPackageFixed in
library/ghost:6.25.12654b1e90413
nodemailer@6.10.1
9.1.0

Open the chart page →

5,032
n8nn8n-openshiftVerified publisher1.18.01 of 1See more

n8n n8n-openshift 1.18.0

1 of the 1 container images this version deploys carry CVE-2026-92597.

Container imageDigestPackageFixed in
n8nio/n8n:2.36.714c4285bc303
nodemailer@8.0.10
9.1.0

Open the chart page →

1,050
uptime-kumancsaVerified publisher1.7.21 of 1See more

uptime-kuma ncsa 1.7.2

1 of the 1 container images this version deploys carry CVE-2026-92597.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.5.4917318f9d7be
nodemailer@7.0.13
9.1.0

Open the chart page →

30,514
bluesky-pdsnerkho-helm-charts0.4.21 of 1See more

bluesky-pds nerkho-helm-charts 0.4.2

1 of the 1 container images this version deploys carry CVE-2026-92597.

Container imageDigestPackageFixed in
ghcr.io/bluesky-social/pds:0.4.204cbc6e3ea157d
nodemailer@6.10.1
9.1.0

Open the chart page →

2,398
nocodbone-acre-fundVerified publisher0.4.61 of 3See more

nocodb one-acre-fund 0.4.6

1 of the 3 container images this version deploys carry CVE-2026-92597.

Container imageDigestPackageFixed in
nocodb/nocodb:0.258.06779a4ddedf2
nodemailer@6.9.16
9.1.0

Open the chart page →

4,241
n8nopenshift1.18.01 of 1See more

n8n openshift 1.18.0

1 of the 1 container images this version deploys carry CVE-2026-92597.

Container imageDigestPackageFixed in
n8nio/n8n:2.36.714c4285bc303
nodemailer@8.0.10
9.1.0

Open the chart page →

1,050
xyopsquench-xyopsVerified publisher0.0.121 of 1See more

xyops quench-xyops 0.0.12

1 of the 1 container images this version deploys carry CVE-2026-92597.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/xyopsdigest-pinneddd7d8bf3b654
nodemailer@9.0.1
9.1.0

Open the chart page →

79
etherpadredhat-cop0.0.81 of 1See more

etherpad redhat-cop 0.0.8

1 of the 1 container images this version deploys carry CVE-2026-92597.

Container imageDigestPackageFixed in
etherpad/etherpad:latest6020e7b57f4b
nodemailer@9.0.3
9.1.0

Open the chart page →

908
claude-relayrevolution10.1.371 of 4See more

claude-relay revolution1 0.1.37

1 of the 4 container images this version deploys carry CVE-2026-92597.

Container imageDigestPackageFixed in
ghcr.io/wei-shaw/claude-relay-service:v1.1.292398c34934453
nodemailer@7.0.6
9.1.0

Open the chart page →

4,808
kresusrm3lVerified publisher0.2.11 of 3See more

kresus rm3l 0.2.1

1 of the 3 container images this version deploys carry CVE-2026-92597.

Container imageDigestPackageFixed in
bnjbvr/kresus:0.22.137e216b182c8
nodemailer@6.9.16
9.1.0

Open the chart page →

15,770
devtron-enterpriseromholdings48.0.01 of 28See more

devtron-enterprise romholdings 48.0.0

1 of the 28 container images this version deploys carry CVE-2026-92597.

Container imageDigestPackageFixed in
quay.io/devtron/notifier:9804331c-372-39294709c7da19c5a
nodemailer@7.0.13
9.1.0

Open the chart page →

69,552
karakeeprtomik-helm-chartsVerified publisher0.0.11 of 3See more

karakeep rtomik-helm-charts 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-92597.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.26.0f575a34ed3f8
nodemailer@7.0.4
9.1.0

Open the chart page →

5,359
uptime-kumarubxkubeVerified publisher1.2.11 of 1See more

uptime-kuma rubxkube 1.2.1

1 of the 1 container images this version deploys carry CVE-2026-92597.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.4.091e963bfda56
nodemailer@7.0.13
9.1.0

Open the chart page →

30,706
rsshubsb-helm-charts0.3.01 of 1See more

rsshub sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-92597.

Container imageDigestPackageFixed in
diygod/rsshub:2025-11-097a6312cac0d5
nodemailer@7.0.10
9.1.0

Open the chart page →

4,745
seerr-chartseerr-chartVerified publisher3.9.11 of 1See more

seerr-chart seerr-chart 3.9.1

1 of the 1 container images this version deploys carry CVE-2026-92597.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:v3.4.1f4768de5f616
nodemailer@6.9.16
9.1.0

Open the chart page →

2,005
infisicalsinextraVerified publisher0.6.01 of 1See more

infisical sinextra 0.6.0

1 of the 1 container images this version deploys carry CVE-2026-92597.

Container imageDigestPackageFixed in
infisical/infisical:v0.165.602082bf13163
nodemailer@8.0.11
9.1.0

Open the chart page →

3,085
strapistrapi-xmv0.1.11 of 1See more

strapi strapi-xmv 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-92597.

Container imageDigestPackageFixed in
ghcr.io/xmv-solutions-gmbh/strapi:latesta288b4571142
nodemailer@8.0.11
9.1.0

Open the chart page →

689
joplintobiassackmann0.1.71 of 2See more

joplin tobiassackmann 0.1.7

1 of the 2 container images this version deploys carry CVE-2026-92597.

Container imageDigestPackageFixed in
joplin/server:latest3f7b852959aa
nodemailer@6.10.1
9.1.0

Open the chart page →

5,650
twentytwenty-crm0.1.111 of 4See more

twenty twenty-crm 0.1.11

1 of the 4 container images this version deploys carry CVE-2026-92597.

Container imageDigestPackageFixed in
twentycrm/twenty:v2.22.0e7d9948bf284
nodemailer@9.0.1
9.1.0

Open the chart page →

5,634
unleash-enterpriseunleash1.0.31 of 1See more

unleash-enterprise unleash 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-92597.

Container imageDigestPackageFixed in
unleashorg/unleash-enterprise:7.5.0245aeba40053
nodemailer@7.0.13
9.1.0

Open the chart page →

2,041
kenerunxwaresVerified publisher2026.2.51 of 1See more

kener unxwares 2026.2.5

1 of the 1 container images this version deploys carry CVE-2026-92597.

Container imageDigestPackageFixed in
rajnandan1/kener:3.2.1930407afca731
nodemailer@6.10.0
9.1.0

Open the chart page →

5,282
devportalveecode-platform-nextVerified publisher0.1.231 of 1See more

devportal veecode-platform-next 0.1.23

1 of the 1 container images this version deploys carry CVE-2026-92597.

Container imageDigestPackageFixed in
veecode/devportaldigest-pinneda72cf5cb47b8
nodemailer@8.0.11
9.1.0

Open the chart page →

1,840
colanodevictorlane0.3.31 of 3See more

colanode victorlane 0.3.3

1 of the 3 container images this version deploys carry CVE-2026-92597.

Container imageDigestPackageFixed in
ghcr.io/colanode/server:latest7006cac874fd
nodemailer@8.0.4
9.1.0

Open the chart page →

2,237

Container images carrying it

85 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
twentycrm/twenty:v2.22.0e7d9948bf284
nodemailer@9.0.1
9.1.0
1
unleashorg/unleash-enterprise:7.5.0245aeba40053
nodemailer@7.0.13
9.1.0
1
unleashorg/unleash-server:7.5.09adb37e399ba
nodemailer@7.0.11
9.1.0
1
veecode/devportala72cf5cb47b8
nodemailer@8.0.11
9.1.0
1
ghcr.io/blessingnator/keycloak-mcn-backend:2.0.5967470f05472
nodemailer@7.0.13
9.1.0
1
ghcr.io/bluesky-social/pds:0.4.208637083d9369d
nodemailer@6.10.1
9.1.0
1
ghcr.io/bluesky-social/pds:0.4.204cbc6e3ea157d
nodemailer@6.10.1
9.1.0
1
ghcr.io/bluesky-social/pds:0.4d95725b24dbe
nodemailer@6.10.1
9.1.0
1
ghcr.io/colanode/server:latest7006cac874fd
nodemailer@8.0.4
9.1.0
1
ghcr.io/data-fair/portals:18b621866ceb2
nodemailer@6.10.1
9.1.0
1
ghcr.io/fallenbagel/jellyseerr:2.5.22a611369ad1d
nodemailer@6.9.16
9.1.0
1
ghcr.io/harish2k01/portfolio-tracker:0.1.056efa3085895
nodemailer@7.0.13
9.1.0
1
ghcr.io/immich-app/immich-server:v3.2.279cc1623323d
nodemailer@9.0.5
9.1.0
1
ghcr.io/immich-app/immich-server:v3.1.0b434cb9287ee
nodemailer@9.0.3
9.1.0
1
ghcr.io/immich-app/immich-server:v2.3.1f8d06a32b1b2
nodemailer@7.0.10
9.1.0
1
ghcr.io/karakeep-app/karakeep:0.27.1abd7d6b11b1b
nodemailer@7.0.4
9.1.0
1
ghcr.io/karakeep-app/karakeep:0.33.2b069e4307dec
nodemailer@7.0.13
9.1.0
1
ghcr.io/karakeep-app/karakeep:0.26.0f575a34ed3f8
nodemailer@7.0.4
9.1.0
1
ghcr.io/linkwarden/linkwarden:v2.16.30664c28a039b
nodemailer@9.0.4
9.1.0
1
ghcr.io/logtide-dev/logtide-backend:1.0.265463e02f887
nodemailer@9.0.1
9.1.0
1
ghcr.io/logtide-dev/logtide-frontend:1.0.22a7da1451f86
nodemailer@9.0.1
9.1.0
1
ghcr.io/papra-hq/papra:26.6.2-rootlessa281cb44176d
nodemailer@9.0.1
9.1.0
1
ghcr.io/quenchworks/images/xyopsdd7d8bf3b654
nodemailer@9.0.1
9.1.0
1
ghcr.io/rajnandan1/kener:3.2.182b993cb232eb
nodemailer@6.10.0
9.1.0
1
ghcr.io/seerr-team/seerr:v3.2.0c4cbd5121236
nodemailer@6.10.0
9.1.0
1
ghcr.io/sredevopsorg/ghost-on-kubernetes:maindd991bafa85e
nodemailer@9.0.1
9.1.0
1
ghcr.io/toeverything/affine:0.27.4b649f5ce2384
nodemailer@9.0.1
9.1.0
1
ghcr.io/wei-shaw/claude-relay-service:v1.1.292398c34934453
nodemailer@7.0.6
9.1.0
1
ghcr.io/wekan/wekan:v11.85ed8127814484
nodemailer@8.0.11
9.1.0
1
ghcr.io/xmv-solutions-gmbh/strapi:latesta288b4571142
nodemailer@8.0.11
9.1.0
1
quay.io/mittwald/kube-mail:latest04f1099241fc
nodemailer@7.0.3
9.1.0
1
quay.io/rhdh/rhdh-hub-rhel9:latest0b26358f5793
nodemailer@7.0.13
9.1.0
1
quay.io/seamware/onboarding:0.2.2b406475f9f00
nodemailer@7.0.12
9.1.0
1
quay.io/wi_stefan/consent-manager:0.0.656399619568b
nodemailer@6.10.1
9.1.0
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer:1.0.310e3cd8c7776d
nodemailer@6.10.1
9.1.0
1

syft 1.42.1 · advisories as of 18 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.