StackRadar

GHSA-cc9r-2j5m-2m83

Medium

Advisory

Published 8 Sept 2026In the index since 9 Sept 2026
Severity
Medium
worst across findings
CVSS
6.5
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
95
of 17,781 indexed, latest versions
Container images
84
deployed by those charts
Fix available
1 of 1
affected package

Nodemailer: Recipient-domain validation bypass via RFC 5322 comment mis-parsing leads to email delivery to an attacker-controlled domain

Carried by container images the latest versions of 95 of 17,781 indexed charts deploy, on 84 images.

Affected packageAffected versionsFixed inImages
nodemailernpm6.9.16, 6.10.0, 6.10.1, 7.0.3+16 more9.1.084
OSV records
GHSA-cc9r-2j5m-2m83

Charts affected

95 by stars
ChartLatestAffected imagesRadar Score
paprahelmforgeVerified publisher1.0.01 of 1See more

papra helmforge 1.0.0

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
ghcr.io/papra-hq/papra:26.6.2-rootlessa281cb44176d
nodemailer@9.0.1
9.1.0

Open the chart page →

2,538
strapihelmforgeVerified publisher2.3.141 of 3See more

strapi helmforge 2.3.14

1 of the 3 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
helmforge/strapi-base:5.52.270e9143d6d92
nodemailer@9.0.1
9.1.0

Open the chart page →

2,061
uptime-kumahelmforgeVerified publisher1.5.121 of 1See more

uptime-kuma helmforge 1.5.12

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.5.33e24e96c89ef
nodemailer@7.0.13
9.1.0

Open the chart page →

30,099
self-learning-platformhelm-self-learning-platformVerified publisher1.1.01 of 1See more

self-learning-platform helm-self-learning-platform 1.1.0

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
devopsiaci/self-learning-platform:1.1.3d9441c931f75
nodemailer@8.0.1
9.1.0

Open the chart page →

1,468
bluesky-pdsijmacd1.0.01 of 2See more

bluesky-pds ijmacd 1.0.0

1 of the 2 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
ghcr.io/bluesky-social/pds:0.4d95725b24dbe
nodemailer@6.10.1
9.1.0

Open the chart page →

8,967
infisicalinfisical-charts0.4.21 of 3See more

infisical infisical-charts 0.4.2

1 of the 3 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
infisical/infisical:latest02082bf13163
nodemailer@8.0.11
9.1.0

Open the chart page →

3,014
nocodbinseefrlab0.2.01 of 1See more

nocodb inseefrlab 0.2.0

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
nocodb/nocodb:latest4b760f0d2547
nodemailer@9.0.5
9.1.0

Open the chart page →

781
ghostjanip81-helm-chartsVerified publisher0.1.21 of 1See more

ghost janip81-helm-charts 0.1.2

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
library/ghost:6.37.01ef2e532ca4d
nodemailer@8.0.5
9.1.0

Open the chart page →

3,436
ghostk8s-home-lab-repo4.1.01 of 1See more

ghost k8s-home-lab-repo 4.1.0

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
library/ghost:6.41.129773d6be407
nodemailer@8.0.5
9.1.0

Open the chart page →

3,092
kenerkener-chart0.0.71 of 1See more

kener kener-chart 0.0.7

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
ghcr.io/rajnandan1/kener:3.2.182b993cb232eb
nodemailer@6.10.0
9.1.0

Open the chart page →

5,228
keycloak-multi-client-notifierkeycloak-multi-client-notifier2.1.21 of 2See more

keycloak-multi-client-notifier keycloak-multi-client-notifier 2.1.2

1 of the 2 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
ghcr.io/blessingnator/keycloak-mcn-backend:2.0.5967470f05472
nodemailer@7.0.13
9.1.0

Open the chart page →

1,473
pangolinkrzwiatrzyk0.11.01 of 1See more

pangolin krzwiatrzyk 0.11.0

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
fosrl/pangolin:1.13.0c32ad797ab96
nodemailer@7.0.11
9.1.0

Open the chart page →

3,441
ghostkubernetes-homelab-helm-chartsVerified publisher0.1.21 of 2See more

ghost kubernetes-homelab-helm-charts 0.1.2

1 of the 2 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
library/ghost:6.39.0-alpine77196da4b0df
nodemailer@8.0.5
9.1.0

Open the chart page →

2,756
portfolio-trackerkubernetes-homelab-helm-chartsVerified publisher0.1.01 of 3See more

portfolio-tracker kubernetes-homelab-helm-charts 0.1.0

1 of the 3 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
ghcr.io/harish2k01/portfolio-tracker:0.1.056efa3085895
nodemailer@7.0.13
9.1.0

Open the chart page →

1,498
seerrkubernetes-homelab-helm-chartsVerified publisher0.1.21 of 1See more

seerr kubernetes-homelab-helm-charts 0.1.2

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:v3.2.0c4cbd5121236
nodemailer@6.10.0
9.1.0

Open the chart page →

2,548
uptime-kumakubernetes-homelab-helm-chartsVerified publisher0.1.21 of 1See more

uptime-kuma kubernetes-homelab-helm-charts 0.1.2

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.2.1-slim059b49d64739
nodemailer@7.0.13
9.1.0

Open the chart page →

6,356
kube-mailkubernetes-replicator0.11.11 of 3See more

kube-mail kubernetes-replicator 0.11.1

1 of the 3 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
quay.io/mittwald/kube-mail:latest04f1099241fc
nodemailer@7.0.3
9.1.0

Open the chart page →

2,509
jellyseerrlbenicio-communityVerified publisher0.1.01 of 1See more

jellyseerr lbenicio-community 0.1.0

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
fallenbagel/jellyseerr:latest4538137bc5af
nodemailer@6.10.0
9.1.0

Open the chart page →

3,555
uptime-kumalbenicio-communityVerified publisher0.1.11 of 1See more

uptime-kuma lbenicio-community 0.1.1

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.3.29aeb4e51d038
nodemailer@7.0.13
9.1.0

Open the chart page →

33,242
uptime-kumaloeken-at-homeVerified publisher2.3.21 of 1See more

uptime-kuma loeken-at-home 2.3.2

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.3.29aeb4e51d038
nodemailer@7.0.13
9.1.0

Open the chart page →

33,242
logtidelogtideVerified publisher2.1.142 of 4See more

logtide logtide 2.1.14

2 of the 4 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
ghcr.io/logtide-dev/logtide-backend:1.0.265463e02f887
nodemailer@9.0.1
9.1.0
ghcr.io/logtide-dev/logtide-frontend:1.0.22a7da1451f86
nodemailer@9.0.1
9.1.0

Open the chart page →

2,774
lynxpromptlynxpromptVerified publisher0.1.21 of 3See more

lynxprompt lynxprompt 0.1.2

1 of the 3 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
drumsergio/lynxprompt:2.0.75c6afb6679301
nodemailer@8.0.7
9.1.0

Open the chart page →

1,852
ghostmt1905028.25.11 of 3See more

ghost mt190502 8.25.1

1 of the 3 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
library/ghost:6.25.12654b1e90413
nodemailer@6.10.1
9.1.0

Open the chart page →

4,960
n8nn8n-openshiftVerified publisher1.18.01 of 1See more

n8n n8n-openshift 1.18.0

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
n8nio/n8n:2.36.714c4285bc303
nodemailer@8.0.10
9.1.0

Open the chart page →

1,038
uptime-kumancsaVerified publisher1.7.21 of 1See more

uptime-kuma ncsa 1.7.2

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.5.4917318f9d7be
nodemailer@7.0.13
9.1.0

Open the chart page →

30,028
bluesky-pdsnerkho-helm-charts0.4.21 of 1See more

bluesky-pds nerkho-helm-charts 0.4.2

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
ghcr.io/bluesky-social/pds:0.4.204cbc6e3ea157d
nodemailer@6.10.1
9.1.0

Open the chart page →

2,383
nocodbone-acre-fundVerified publisher0.4.61 of 3See more

nocodb one-acre-fund 0.4.6

1 of the 3 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
nocodb/nocodb:0.258.06779a4ddedf2
nodemailer@6.9.16
9.1.0

Open the chart page →

4,219
n8nopenshift1.18.01 of 1See more

n8n openshift 1.18.0

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
n8nio/n8n:2.36.714c4285bc303
nodemailer@8.0.10
9.1.0

Open the chart page →

1,038
xyopsquench-xyopsVerified publisher0.0.121 of 1See more

xyops quench-xyops 0.0.12

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/xyopsdigest-pinneddd7d8bf3b654
nodemailer@9.0.1
9.1.0

Open the chart page →

68
etherpadredhat-cop0.0.81 of 1See more

etherpad redhat-cop 0.0.8

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
etherpad/etherpad:latest6020e7b57f4b
nodemailer@9.0.3
9.1.0

Open the chart page →

895
claude-relayrevolution10.1.371 of 4See more

claude-relay revolution1 0.1.37

1 of the 4 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
ghcr.io/wei-shaw/claude-relay-service:v1.1.292398c34934453
nodemailer@7.0.6
9.1.0

Open the chart page →

4,600
kresusrm3lVerified publisher0.2.11 of 3See more

kresus rm3l 0.2.1

1 of the 3 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
bnjbvr/kresus:0.22.137e216b182c8
nodemailer@6.9.16
9.1.0

Open the chart page →

15,591
devtron-enterpriseromholdings48.0.01 of 28See more

devtron-enterprise romholdings 48.0.0

1 of the 28 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
quay.io/devtron/notifier:9804331c-372-39294709c7da19c5a
nodemailer@7.0.13
9.1.0

Open the chart page →

68,240
karakeeprtomik-helm-chartsVerified publisher0.0.11 of 3See more

karakeep rtomik-helm-charts 0.0.1

1 of the 3 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.26.0f575a34ed3f8
nodemailer@7.0.4
9.1.0

Open the chart page →

5,338
uptime-kumarubxkubeVerified publisher1.2.11 of 1See more

uptime-kuma rubxkube 1.2.1

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.4.091e963bfda56
nodemailer@7.0.13
9.1.0

Open the chart page →

30,219
rsshubsb-helm-charts0.3.01 of 1See more

rsshub sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
diygod/rsshub:2025-11-097a6312cac0d5
nodemailer@7.0.10
9.1.0

Open the chart page →

4,684
seerr-chartseerr-chartVerified publisher3.9.11 of 1See more

seerr-chart seerr-chart 3.9.1

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:v3.4.1f4768de5f616
nodemailer@6.9.16
9.1.0

Open the chart page →

1,991
infisicalsinextraVerified publisher0.6.01 of 1See more

infisical sinextra 0.6.0

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
infisical/infisical:v0.165.602082bf13163
nodemailer@8.0.11
9.1.0

Open the chart page →

3,014
strapistrapi-xmv0.1.11 of 1See more

strapi strapi-xmv 0.1.1

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
ghcr.io/xmv-solutions-gmbh/strapi:latesta288b4571142
nodemailer@8.0.11
9.1.0

Open the chart page →

676
joplintobiassackmann0.1.71 of 2See more

joplin tobiassackmann 0.1.7

1 of the 2 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
joplin/server:latest3f7b852959aa
nodemailer@6.10.1
9.1.0

Open the chart page →

5,535
twentytwenty-crm0.1.111 of 4See more

twenty twenty-crm 0.1.11

1 of the 4 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
twentycrm/twenty:v2.22.0e7d9948bf284
nodemailer@9.0.1
9.1.0

Open the chart page →

5,550
unleash-enterpriseunleash1.0.31 of 1See more

unleash-enterprise unleash 1.0.3

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
unleashorg/unleash-enterprise:7.5.0245aeba40053
nodemailer@7.0.13
9.1.0

Open the chart page →

2,028
kenerunxwaresVerified publisher2026.2.51 of 1See more

kener unxwares 2026.2.5

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
rajnandan1/kener:3.2.1930407afca731
nodemailer@6.10.0
9.1.0

Open the chart page →

5,228
devportalveecode-platform-nextVerified publisher0.1.211 of 1See more

devportal veecode-platform-next 0.1.21

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
veecode/devportaldigest-pinnedc443520aebf7
nodemailer@8.0.11
9.1.0

Open the chart page →

1,787
colanodevictorlane0.3.31 of 3See more

colanode victorlane 0.3.3

1 of the 3 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
ghcr.io/colanode/server:latest7006cac874fd
nodemailer@8.0.4
9.1.0

Open the chart page →

2,076

Container images carrying it

84 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
unleashorg/unleash-enterprise:7.5.0245aeba40053
nodemailer@7.0.13
9.1.0
1
unleashorg/unleash-server:7.5.09adb37e399ba
nodemailer@7.0.11
9.1.0
1
veecode/devportalc443520aebf7
nodemailer@8.0.11
9.1.0
1
ghcr.io/blessingnator/keycloak-mcn-backend:2.0.5967470f05472
nodemailer@7.0.13
9.1.0
1
ghcr.io/bluesky-social/pds:0.4.208637083d9369d
nodemailer@6.10.1
9.1.0
1
ghcr.io/bluesky-social/pds:0.4.204cbc6e3ea157d
nodemailer@6.10.1
9.1.0
1
ghcr.io/bluesky-social/pds:0.4d95725b24dbe
nodemailer@6.10.1
9.1.0
1
ghcr.io/colanode/server:latest7006cac874fd
nodemailer@8.0.4
9.1.0
1
ghcr.io/data-fair/portals:18b621866ceb2
nodemailer@6.10.1
9.1.0
1
ghcr.io/fallenbagel/jellyseerr:2.5.22a611369ad1d
nodemailer@6.9.16
9.1.0
1
ghcr.io/harish2k01/portfolio-tracker:0.1.056efa3085895
nodemailer@7.0.13
9.1.0
1
ghcr.io/immich-app/immich-server:v3.2.0ae13784ffcfc
nodemailer@9.0.5
9.1.0
1
ghcr.io/immich-app/immich-server:v3.1.0b434cb9287ee
nodemailer@9.0.3
9.1.0
1
ghcr.io/immich-app/immich-server:v2.3.1f8d06a32b1b2
nodemailer@7.0.10
9.1.0
1
ghcr.io/karakeep-app/karakeep:0.27.1abd7d6b11b1b
nodemailer@7.0.4
9.1.0
1
ghcr.io/karakeep-app/karakeep:0.33.2b069e4307dec
nodemailer@7.0.13
9.1.0
1
ghcr.io/karakeep-app/karakeep:0.26.0f575a34ed3f8
nodemailer@7.0.4
9.1.0
1
ghcr.io/linkwarden/linkwarden:v2.16.30664c28a039b
nodemailer@9.0.4
9.1.0
1
ghcr.io/logtide-dev/logtide-backend:1.0.265463e02f887
nodemailer@9.0.1
9.1.0
1
ghcr.io/logtide-dev/logtide-frontend:1.0.22a7da1451f86
nodemailer@9.0.1
9.1.0
1
ghcr.io/papra-hq/papra:26.6.2-rootlessa281cb44176d
nodemailer@9.0.1
9.1.0
1
ghcr.io/quenchworks/images/xyopsdd7d8bf3b654
nodemailer@9.0.1
9.1.0
1
ghcr.io/rajnandan1/kener:3.2.182b993cb232eb
nodemailer@6.10.0
9.1.0
1
ghcr.io/seerr-team/seerr:v3.2.0c4cbd5121236
nodemailer@6.10.0
9.1.0
1
ghcr.io/sredevopsorg/ghost-on-kubernetes:maindd991bafa85e
nodemailer@9.0.1
9.1.0
1
ghcr.io/toeverything/affine:0.27.4b649f5ce2384
nodemailer@9.0.1
9.1.0
1
ghcr.io/wei-shaw/claude-relay-service:v1.1.292398c34934453
nodemailer@7.0.6
9.1.0
1
ghcr.io/wekan/wekan:v11.764a9601847dfd
nodemailer@8.0.11
9.1.0
1
ghcr.io/xmv-solutions-gmbh/strapi:latesta288b4571142
nodemailer@8.0.11
9.1.0
1
quay.io/mittwald/kube-mail:latest04f1099241fc
nodemailer@7.0.3
9.1.0
1
quay.io/rhdh/rhdh-hub-rhel9:latest0b26358f5793
nodemailer@7.0.13
9.1.0
1
quay.io/seamware/onboarding:0.2.2b406475f9f00
nodemailer@7.0.12
9.1.0
1
quay.io/wi_stefan/consent-manager:0.0.656399619568b
nodemailer@6.10.1
9.1.0
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer:1.0.310e3cd8c7776d
nodemailer@6.10.1
9.1.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.