StackRadar

GHSA-cc9r-2j5m-2m83

Medium

Advisory

Published 8 Sept 2026In the index since 9 Sept 2026
Severity
Medium
worst across findings
CVSS
6.5
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
95
of 17,781 indexed, latest versions
Container images
84
deployed by those charts
Fix available
1 of 1
affected package

Nodemailer: Recipient-domain validation bypass via RFC 5322 comment mis-parsing leads to email delivery to an attacker-controlled domain

Carried by container images the latest versions of 95 of 17,781 indexed charts deploy, on 84 images.

Affected packageAffected versionsFixed inImages
nodemailernpm6.9.16, 6.10.0, 6.10.1, 7.0.3+16 more9.1.084
OSV records
GHSA-cc9r-2j5m-2m83

Charts affected

95 by stars
ChartLatestAffected imagesRadar Score
n8ncommunity-chartsVerified publisher1.24.401 of 1See more

n8n community-charts 1.24.40

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
n8nio/n8n:2.38.45d9f0cc5672b
nodemailer@8.0.10
9.1.0

Open the chart page →

772
n8nopen-8gears2.1.11 of 1See more

n8n open-8gears 2.1.1

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
n8nio/n8n:2.36.8cfe2704ff858
nodemailer@8.0.10
9.1.0

Open the chart page →

1,038
uptime-kumauptime-kumaVerified publisher4.2.01 of 1See more

uptime-kuma uptime-kuma 4.2.0

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.5.0a8610b3b4c38
nodemailer@7.0.13
9.1.0

Open the chart page →

30,159
unleashunleash5.6.81 of 2See more

unleash unleash 5.6.8

1 of the 2 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
unleashorg/unleash-server:7.5.09adb37e399ba
nodemailer@7.0.11
9.1.0

Open the chart page →

2,059
outlinekubitodevVerified publisher1.2.21 of 4See more

outline kubitodev 1.2.2

1 of the 4 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
outlinewiki/outline:0.82.0494dfb9249a6
nodemailer@6.10.0
9.1.0

Open the chart page →

5,352
servarrkubitodevVerified publisher1.5.21 of 10See more

servarr kubitodev 1.5.2

1 of the 10 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:latestf4768de5f616
nodemailer@6.9.16
9.1.0

Open the chart page →

3,004
wekanwekanVerified publisher11.76.01 of 3See more

wekan wekan 11.76.0

1 of the 3 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
ghcr.io/wekan/wekan:v11.764a9601847dfd
nodemailer@8.0.11
9.1.0

Open the chart page →

1,576
budibasebudibase0.0.0-master2 of 7See more

budibase budibase 0.0.0-master

2 of the 7 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
budibase/apps:3.41.344fe6feab985
nodemailer@9.0.1
9.1.0
budibase/worker:3.41.3de5e2e560ce8
nodemailer@9.0.3
9.1.0

Open the chart page →

10,775
n8nhelmforgeVerified publisher2.0.01 of 2See more

n8n helmforge 2.0.0

1 of the 2 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
n8nio/n8n:2.38.45d9f0cc5672b
nodemailer@8.0.10
9.1.0

Open the chart page →

863
docmosthelmforgeVerified publisher1.2.111 of 4See more

docmost helmforge 1.2.11

1 of the 4 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
docmost/docmost:0.95.041c8d777cf23
nodemailer@9.0.1
9.1.0

Open the chart page →

5,564
backstagerhdh-chartVerified publisher4.0.11 of 2See more

backstage rhdh-chart 4.0.1

1 of the 2 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
quay.io/rhdh/rhdh-hub-rhel9:latest0b26358f5793
nodemailer@7.0.13
9.1.0

Open the chart page →

1,339
kuttchristianhuthVerified publisher9.10.11 of 3See more

kutt christianhuth 9.10.1

1 of the 3 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
kutt/kutt:v3.2.6fa3d24a89b04
nodemailer@9.0.3
9.1.0

Open the chart page →

454
karakeephelmforgeVerified publisher1.2.91 of 3See more

karakeep helmforge 1.2.9

1 of the 3 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.33.2b069e4307dec
nodemailer@7.0.13
9.1.0

Open the chart page →

9,460
ghostcloudpirates-ghostVerified publisher0.20.221 of 3See more

ghost cloudpirates-ghost 0.20.22

1 of the 3 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
library/ghost:6.63.0e05bc1169fb2
nodemailer@8.0.11
9.1.0

Open the chart page →

7,146
ghost-on-kubernetesghost-on-kubernetes-helmVerified publisher1.1.21 of 3See more

ghost-on-kubernetes ghost-on-kubernetes-helm 1.1.2

1 of the 3 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
ghcr.io/sredevopsorg/ghost-on-kubernetes:maindd991bafa85e
nodemailer@9.0.1
9.1.0

Open the chart page →

1,447
nocodbzekker6Verified publisher1.10.01 of 1See more

nocodb zekker6 1.10.0

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
nocodb/nocodb:0.301.5d9516f0bf546
nodemailer@7.0.13
9.1.0

Open the chart page →

4,016
seerrbdclark-helm-chartsVerified publisher0.1.51 of 1See more

seerr bdclark-helm-charts 0.1.5

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:v3.4.1f4768de5f616
nodemailer@6.9.16
9.1.0

Open the chart page →

1,991
data-fairdata354-helmVerified publisher1.1.21 of 12See more

data-fair data354-helm 1.1.2

1 of the 12 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
ghcr.io/data-fair/portals:18b621866ceb2
nodemailer@6.10.1
9.1.0

Open the chart page →

38,346
directusdirectus-io2.1.01 of 3See more

directus directus-io 2.1.0

1 of the 3 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
directus/directus:12.0.29c8470ea465c
nodemailer@8.0.5
9.1.0

Open the chart page →

7,473
enbuildenbuildVerified publisher0.0.501 of 6See more

enbuild enbuild 0.0.50

1 of the 6 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer:1.0.310e3cd8c7776d
nodemailer@6.10.1
9.1.0

Open the chart page →

31,510
ghostgroundhog2k0.212.121 of 1See more

ghost groundhog2k 0.212.12

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
library/ghost:6.63.0e05bc1169fb2
nodemailer@8.0.11
9.1.0

Open the chart page →

2,000
growthbookgrowthbook5.0.11 of 2See more

growthbook growthbook 5.0.1

1 of the 2 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
growthbook/growthbook:5.0.1f53ead646b5f
nodemailer@9.0.1
9.1.0

Open the chart page →

709
immichimmich-helm0.3.01 of 4See more

immich immich-helm 0.3.0

1 of the 4 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
ghcr.io/immich-app/immich-server:v2.3.1f8d06a32b1b2
nodemailer@7.0.10
9.1.0

Open the chart page →

15,712
kenerkenerVerified publisher0.2.01 of 1See more

kener kener 0.2.0

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
rajnandan1/kener:3.2.1930407afca731
nodemailer@6.10.0
9.1.0

Open the chart page →

5,228
n8nn8n-helm2.25.71 of 1See more

n8n n8n-helm 2.25.7

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
n8nio/n8n:2.25.7761374d4eb84
nodemailer@7.0.11
9.1.0

Open the chart page →

2,575
kuttone-acre-fundVerified publisher0.2.51 of 1See more

kutt one-acre-fund 0.2.5

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
kutt/kutt:latestfa3d24a89b04
nodemailer@9.0.3
9.1.0

Open the chart page →

454
uptime-kumapascaliskeVerified publisher3.0.01 of 1See more

uptime-kuma pascaliske 3.0.0

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.0.2-slim-rootless9865163f92c1
nodemailer@6.9.16
9.1.0

Open the chart page →

6,883
peertubepeertubeVerified publisher0.1.31 of 1See more

peertube peertube 0.1.3

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
chocobozzz/peertube:v8.1.5052712130691
nodemailer@7.0.13
9.1.0

Open the chart page →

7,035
rocketadminrocketadminOfficialVerified publisher1.0.421 of 1See more

rocketadmin rocketadmin 1.0.42

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
rocketadmin/rocketadmin:1.17.710955ef540b9
nodemailer@8.0.5
9.1.0

Open the chart page →

5,482
jellyseerrrtomik-helm-chartsVerified publisher0.0.11 of 1See more

jellyseerr rtomik-helm-charts 0.0.1

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
ghcr.io/fallenbagel/jellyseerr:2.5.22a611369ad1d
nodemailer@6.9.16
9.1.0

Open the chart page →

2,823
uptime-kumasb-helm-charts0.4.01 of 1See more

uptime-kuma sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.0.24c364ef96aad
nodemailer@6.9.16
9.1.0

Open the chart page →

38,107
immichsecustorVerified publisher2.0.41 of 1See more

immich secustor 2.0.4

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
ghcr.io/immich-app/immich-server:v3.2.0ae13784ffcfc
nodemailer@9.0.5
9.1.0

Open the chart page →

3,059
karakeepself-hosters-by-nightVerified publisher2.5.11 of 1See more

karakeep self-hosters-by-night 2.5.1

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.27.1abd7d6b11b1b
nodemailer@7.0.4
9.1.0

Open the chart page →

5,213
activepiecesadnoctemVerified publisher0.5.01 of 1See more

activepieces adnoctem 0.5.0

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
activepieces/activepieces:0.90.430c10a04fe3d
nodemailer@9.0.1
9.1.0

Open the chart page →

1,055
linkwardenadnoctemVerified publisher0.5.11 of 2See more

linkwarden adnoctem 0.5.1

1 of the 2 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
ghcr.io/linkwarden/linkwarden:v2.16.30664c28a039b
nodemailer@9.0.4
9.1.0

Open the chart page →

3,820
outlineadnoctemVerified publisher0.1.21 of 1See more

outline adnoctem 0.1.2

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
outlinewiki/outline:1.10.1832051f039b4
nodemailer@9.0.5
9.1.0

Open the chart page →

1,216
uptime-kumaadnoctemVerified publisher0.4.11 of 1See more

uptime-kuma adnoctem 0.4.1

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.5.4917318f9d7be
nodemailer@7.0.13
9.1.0

Open the chart page →

30,028
bluesky-pdsbear0.4.2081 of 1See more

bluesky-pds bear 0.4.208

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
ghcr.io/bluesky-social/pds:0.4.208637083d9369d
nodemailer@6.10.1
9.1.0

Open the chart page →

2,136
ghostchart-ghost0.1.51 of 2See more

ghost chart-ghost 0.1.5

1 of the 2 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
library/ghost:6.22.0-alpine3.23ac533a6988ee
nodemailer@6.10.1
9.1.0

Open the chart page →

4,083
devtron-enterprisedevtron48.0.01 of 28See more

devtron-enterprise devtron 48.0.0

1 of the 28 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
quay.io/devtron/notifier:9804331c-372-39294709c7da19c5a
nodemailer@7.0.13
9.1.0

Open the chart page →

68,240
devtron-enterprisedevtron-labs48.0.01 of 28See more

devtron-enterprise devtron-labs 48.0.0

1 of the 28 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
quay.io/devtron/notifier:9804331c-372-39294709c7da19c5a
nodemailer@7.0.13
9.1.0

Open the chart page →

68,240
uptime-kumaegebackVerified publisher2.0.121 of 1See more

uptime-kuma egeback 2.0.12

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.5.0a8610b3b4c38
nodemailer@7.0.13
9.1.0

Open the chart page →

30,159
consent-managerfiware0.1.21 of 1See more

consent-manager fiware 0.1.2

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
quay.io/wi_stefan/consent-manager:0.0.656399619568b
nodemailer@6.10.1
9.1.0

Open the chart page →

1,847
onboarding-portalfiware1.4.31 of 1See more

onboarding-portal fiware 1.4.3

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
quay.io/seamware/onboarding:0.2.2b406475f9f00
nodemailer@7.0.12
9.1.0

Open the chart page →

1,489
uptime-kumafluent-operatorVerified publisher0.1.01 of 1See more

uptime-kuma fluent-operator 0.1.0

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
louislam/uptime-kuma:13d632903e6af
nodemailer@6.9.16
9.1.0

Open the chart page →

3,474
affinehelmforgeVerified publisher1.0.01 of 3See more

affine helmforge 1.0.0

1 of the 3 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
ghcr.io/toeverything/affine:0.27.4b649f5ce2384
nodemailer@9.0.1
9.1.0

Open the chart page →

4,018
croniclehelmforgeVerified publisher1.1.101 of 1See more

cronicle helmforge 1.1.10

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
soulteary/cronicle:0.9.80ac2512fa6e39
nodemailer@6.10.0
9.1.0

Open the chart page →

1,271
ghosthelmforgeVerified publisher1.2.61 of 3See more

ghost helmforge 1.2.6

1 of the 3 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
library/ghost:6.62.0a7a268bbfb7f
nodemailer@8.0.11
9.1.0

Open the chart page →

2,463
hoppscotchhelmforgeVerified publisher1.1.111 of 2See more

hoppscotch helmforge 1.1.11

1 of the 2 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
hoppscotch/hoppscotch:2026.8.0d50725df661f
nodemailer@9.0.1
9.1.0

Open the chart page →

2,046
immichhelmforgeVerified publisher1.2.81 of 5See more

immich helmforge 1.2.8

1 of the 5 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
ghcr.io/immich-app/immich-server:v3.1.0b434cb9287ee
nodemailer@9.0.3
9.1.0

Open the chart page →

11,042

Container images carrying it

84 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
unleashorg/unleash-enterprise:7.5.0245aeba40053
nodemailer@7.0.13
9.1.0
1
unleashorg/unleash-server:7.5.09adb37e399ba
nodemailer@7.0.11
9.1.0
1
veecode/devportalc443520aebf7
nodemailer@8.0.11
9.1.0
1
ghcr.io/blessingnator/keycloak-mcn-backend:2.0.5967470f05472
nodemailer@7.0.13
9.1.0
1
ghcr.io/bluesky-social/pds:0.4.208637083d9369d
nodemailer@6.10.1
9.1.0
1
ghcr.io/bluesky-social/pds:0.4.204cbc6e3ea157d
nodemailer@6.10.1
9.1.0
1
ghcr.io/bluesky-social/pds:0.4d95725b24dbe
nodemailer@6.10.1
9.1.0
1
ghcr.io/colanode/server:latest7006cac874fd
nodemailer@8.0.4
9.1.0
1
ghcr.io/data-fair/portals:18b621866ceb2
nodemailer@6.10.1
9.1.0
1
ghcr.io/fallenbagel/jellyseerr:2.5.22a611369ad1d
nodemailer@6.9.16
9.1.0
1
ghcr.io/harish2k01/portfolio-tracker:0.1.056efa3085895
nodemailer@7.0.13
9.1.0
1
ghcr.io/immich-app/immich-server:v3.2.0ae13784ffcfc
nodemailer@9.0.5
9.1.0
1
ghcr.io/immich-app/immich-server:v3.1.0b434cb9287ee
nodemailer@9.0.3
9.1.0
1
ghcr.io/immich-app/immich-server:v2.3.1f8d06a32b1b2
nodemailer@7.0.10
9.1.0
1
ghcr.io/karakeep-app/karakeep:0.27.1abd7d6b11b1b
nodemailer@7.0.4
9.1.0
1
ghcr.io/karakeep-app/karakeep:0.33.2b069e4307dec
nodemailer@7.0.13
9.1.0
1
ghcr.io/karakeep-app/karakeep:0.26.0f575a34ed3f8
nodemailer@7.0.4
9.1.0
1
ghcr.io/linkwarden/linkwarden:v2.16.30664c28a039b
nodemailer@9.0.4
9.1.0
1
ghcr.io/logtide-dev/logtide-backend:1.0.265463e02f887
nodemailer@9.0.1
9.1.0
1
ghcr.io/logtide-dev/logtide-frontend:1.0.22a7da1451f86
nodemailer@9.0.1
9.1.0
1
ghcr.io/papra-hq/papra:26.6.2-rootlessa281cb44176d
nodemailer@9.0.1
9.1.0
1
ghcr.io/quenchworks/images/xyopsdd7d8bf3b654
nodemailer@9.0.1
9.1.0
1
ghcr.io/rajnandan1/kener:3.2.182b993cb232eb
nodemailer@6.10.0
9.1.0
1
ghcr.io/seerr-team/seerr:v3.2.0c4cbd5121236
nodemailer@6.10.0
9.1.0
1
ghcr.io/sredevopsorg/ghost-on-kubernetes:maindd991bafa85e
nodemailer@9.0.1
9.1.0
1
ghcr.io/toeverything/affine:0.27.4b649f5ce2384
nodemailer@9.0.1
9.1.0
1
ghcr.io/wei-shaw/claude-relay-service:v1.1.292398c34934453
nodemailer@7.0.6
9.1.0
1
ghcr.io/wekan/wekan:v11.764a9601847dfd
nodemailer@8.0.11
9.1.0
1
ghcr.io/xmv-solutions-gmbh/strapi:latesta288b4571142
nodemailer@8.0.11
9.1.0
1
quay.io/mittwald/kube-mail:latest04f1099241fc
nodemailer@7.0.3
9.1.0
1
quay.io/rhdh/rhdh-hub-rhel9:latest0b26358f5793
nodemailer@7.0.13
9.1.0
1
quay.io/seamware/onboarding:0.2.2b406475f9f00
nodemailer@7.0.12
9.1.0
1
quay.io/wi_stefan/consent-manager:0.0.656399619568b
nodemailer@6.10.1
9.1.0
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer:1.0.310e3cd8c7776d
nodemailer@6.10.1
9.1.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.