StackRadar

GHSA-cc9r-2j5m-2m83

Medium

Advisory

Published 8 Sept 2026In the index since 9 Sept 2026
Severity
Medium
worst across findings
CVSS
6.5
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
95
of 17,781 indexed, latest versions
Container images
84
deployed by those charts
Fix available
1 of 1
affected package

Nodemailer: Recipient-domain validation bypass via RFC 5322 comment mis-parsing leads to email delivery to an attacker-controlled domain

Carried by container images the latest versions of 95 of 17,781 indexed charts deploy, on 84 images.

Affected packageAffected versionsFixed inImages
nodemailernpm6.9.16, 6.10.0, 6.10.1, 7.0.3+16 more9.1.084
OSV records
GHSA-cc9r-2j5m-2m83

Charts affected

95 by stars
ChartLatestAffected imagesRadar Score
paprahelmforgeVerified publisher1.0.01 of 1See more

papra helmforge 1.0.0

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
ghcr.io/papra-hq/papra:26.6.2-rootlessa281cb44176d
nodemailer@9.0.1
9.1.0

Open the chart page →

2,538
strapihelmforgeVerified publisher2.3.141 of 3See more

strapi helmforge 2.3.14

1 of the 3 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
helmforge/strapi-base:5.52.270e9143d6d92
nodemailer@9.0.1
9.1.0

Open the chart page →

2,061
uptime-kumahelmforgeVerified publisher1.5.121 of 1See more

uptime-kuma helmforge 1.5.12

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.5.33e24e96c89ef
nodemailer@7.0.13
9.1.0

Open the chart page →

30,099
self-learning-platformhelm-self-learning-platformVerified publisher1.1.01 of 1See more

self-learning-platform helm-self-learning-platform 1.1.0

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
devopsiaci/self-learning-platform:1.1.3d9441c931f75
nodemailer@8.0.1
9.1.0

Open the chart page →

1,468
bluesky-pdsijmacd1.0.01 of 2See more

bluesky-pds ijmacd 1.0.0

1 of the 2 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
ghcr.io/bluesky-social/pds:0.4d95725b24dbe
nodemailer@6.10.1
9.1.0

Open the chart page →

8,967
infisicalinfisical-charts0.4.21 of 3See more

infisical infisical-charts 0.4.2

1 of the 3 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
infisical/infisical:latest02082bf13163
nodemailer@8.0.11
9.1.0

Open the chart page →

3,014
nocodbinseefrlab0.2.01 of 1See more

nocodb inseefrlab 0.2.0

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
nocodb/nocodb:latest4b760f0d2547
nodemailer@9.0.5
9.1.0

Open the chart page →

781
ghostjanip81-helm-chartsVerified publisher0.1.21 of 1See more

ghost janip81-helm-charts 0.1.2

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
library/ghost:6.37.01ef2e532ca4d
nodemailer@8.0.5
9.1.0

Open the chart page →

3,436
ghostk8s-home-lab-repo4.1.01 of 1See more

ghost k8s-home-lab-repo 4.1.0

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
library/ghost:6.41.129773d6be407
nodemailer@8.0.5
9.1.0

Open the chart page →

3,092
kenerkener-chart0.0.71 of 1See more

kener kener-chart 0.0.7

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
ghcr.io/rajnandan1/kener:3.2.182b993cb232eb
nodemailer@6.10.0
9.1.0

Open the chart page →

5,228
keycloak-multi-client-notifierkeycloak-multi-client-notifier2.1.21 of 2See more

keycloak-multi-client-notifier keycloak-multi-client-notifier 2.1.2

1 of the 2 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
ghcr.io/blessingnator/keycloak-mcn-backend:2.0.5967470f05472
nodemailer@7.0.13
9.1.0

Open the chart page →

1,473
pangolinkrzwiatrzyk0.11.01 of 1See more

pangolin krzwiatrzyk 0.11.0

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
fosrl/pangolin:1.13.0c32ad797ab96
nodemailer@7.0.11
9.1.0

Open the chart page →

3,441
ghostkubernetes-homelab-helm-chartsVerified publisher0.1.21 of 2See more

ghost kubernetes-homelab-helm-charts 0.1.2

1 of the 2 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
library/ghost:6.39.0-alpine77196da4b0df
nodemailer@8.0.5
9.1.0

Open the chart page →

2,756
portfolio-trackerkubernetes-homelab-helm-chartsVerified publisher0.1.01 of 3See more

portfolio-tracker kubernetes-homelab-helm-charts 0.1.0

1 of the 3 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
ghcr.io/harish2k01/portfolio-tracker:0.1.056efa3085895
nodemailer@7.0.13
9.1.0

Open the chart page →

1,498
seerrkubernetes-homelab-helm-chartsVerified publisher0.1.21 of 1See more

seerr kubernetes-homelab-helm-charts 0.1.2

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:v3.2.0c4cbd5121236
nodemailer@6.10.0
9.1.0

Open the chart page →

2,548
uptime-kumakubernetes-homelab-helm-chartsVerified publisher0.1.21 of 1See more

uptime-kuma kubernetes-homelab-helm-charts 0.1.2

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.2.1-slim059b49d64739
nodemailer@7.0.13
9.1.0

Open the chart page →

6,356
kube-mailkubernetes-replicator0.11.11 of 3See more

kube-mail kubernetes-replicator 0.11.1

1 of the 3 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
quay.io/mittwald/kube-mail:latest04f1099241fc
nodemailer@7.0.3
9.1.0

Open the chart page →

2,509
jellyseerrlbenicio-communityVerified publisher0.1.01 of 1See more

jellyseerr lbenicio-community 0.1.0

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
fallenbagel/jellyseerr:latest4538137bc5af
nodemailer@6.10.0
9.1.0

Open the chart page →

3,555
uptime-kumalbenicio-communityVerified publisher0.1.11 of 1See more

uptime-kuma lbenicio-community 0.1.1

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.3.29aeb4e51d038
nodemailer@7.0.13
9.1.0

Open the chart page →

33,242
uptime-kumaloeken-at-homeVerified publisher2.3.21 of 1See more

uptime-kuma loeken-at-home 2.3.2

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.3.29aeb4e51d038
nodemailer@7.0.13
9.1.0

Open the chart page →

33,242
logtidelogtideVerified publisher2.1.142 of 4See more

logtide logtide 2.1.14

2 of the 4 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
ghcr.io/logtide-dev/logtide-backend:1.0.265463e02f887
nodemailer@9.0.1
9.1.0
ghcr.io/logtide-dev/logtide-frontend:1.0.22a7da1451f86
nodemailer@9.0.1
9.1.0

Open the chart page →

2,774
lynxpromptlynxpromptVerified publisher0.1.21 of 3See more

lynxprompt lynxprompt 0.1.2

1 of the 3 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
drumsergio/lynxprompt:2.0.75c6afb6679301
nodemailer@8.0.7
9.1.0

Open the chart page →

1,852
ghostmt1905028.25.11 of 3See more

ghost mt190502 8.25.1

1 of the 3 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
library/ghost:6.25.12654b1e90413
nodemailer@6.10.1
9.1.0

Open the chart page →

4,960
n8nn8n-openshiftVerified publisher1.18.01 of 1See more

n8n n8n-openshift 1.18.0

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
n8nio/n8n:2.36.714c4285bc303
nodemailer@8.0.10
9.1.0

Open the chart page →

1,038
uptime-kumancsaVerified publisher1.7.21 of 1See more

uptime-kuma ncsa 1.7.2

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.5.4917318f9d7be
nodemailer@7.0.13
9.1.0

Open the chart page →

30,028
bluesky-pdsnerkho-helm-charts0.4.21 of 1See more

bluesky-pds nerkho-helm-charts 0.4.2

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
ghcr.io/bluesky-social/pds:0.4.204cbc6e3ea157d
nodemailer@6.10.1
9.1.0

Open the chart page →

2,383
nocodbone-acre-fundVerified publisher0.4.61 of 3See more

nocodb one-acre-fund 0.4.6

1 of the 3 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
nocodb/nocodb:0.258.06779a4ddedf2
nodemailer@6.9.16
9.1.0

Open the chart page →

4,219
n8nopenshift1.18.01 of 1See more

n8n openshift 1.18.0

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
n8nio/n8n:2.36.714c4285bc303
nodemailer@8.0.10
9.1.0

Open the chart page →

1,038
xyopsquench-xyopsVerified publisher0.0.121 of 1See more

xyops quench-xyops 0.0.12

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/xyopsdigest-pinneddd7d8bf3b654
nodemailer@9.0.1
9.1.0

Open the chart page →

68
etherpadredhat-cop0.0.81 of 1See more

etherpad redhat-cop 0.0.8

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
etherpad/etherpad:latest6020e7b57f4b
nodemailer@9.0.3
9.1.0

Open the chart page →

895
claude-relayrevolution10.1.371 of 4See more

claude-relay revolution1 0.1.37

1 of the 4 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
ghcr.io/wei-shaw/claude-relay-service:v1.1.292398c34934453
nodemailer@7.0.6
9.1.0

Open the chart page →

4,600
kresusrm3lVerified publisher0.2.11 of 3See more

kresus rm3l 0.2.1

1 of the 3 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
bnjbvr/kresus:0.22.137e216b182c8
nodemailer@6.9.16
9.1.0

Open the chart page →

15,591
devtron-enterpriseromholdings48.0.01 of 28See more

devtron-enterprise romholdings 48.0.0

1 of the 28 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
quay.io/devtron/notifier:9804331c-372-39294709c7da19c5a
nodemailer@7.0.13
9.1.0

Open the chart page →

68,240
karakeeprtomik-helm-chartsVerified publisher0.0.11 of 3See more

karakeep rtomik-helm-charts 0.0.1

1 of the 3 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.26.0f575a34ed3f8
nodemailer@7.0.4
9.1.0

Open the chart page →

5,338
uptime-kumarubxkubeVerified publisher1.2.11 of 1See more

uptime-kuma rubxkube 1.2.1

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.4.091e963bfda56
nodemailer@7.0.13
9.1.0

Open the chart page →

30,219
rsshubsb-helm-charts0.3.01 of 1See more

rsshub sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
diygod/rsshub:2025-11-097a6312cac0d5
nodemailer@7.0.10
9.1.0

Open the chart page →

4,684
seerr-chartseerr-chartVerified publisher3.9.11 of 1See more

seerr-chart seerr-chart 3.9.1

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:v3.4.1f4768de5f616
nodemailer@6.9.16
9.1.0

Open the chart page →

1,991
infisicalsinextraVerified publisher0.6.01 of 1See more

infisical sinextra 0.6.0

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
infisical/infisical:v0.165.602082bf13163
nodemailer@8.0.11
9.1.0

Open the chart page →

3,014
strapistrapi-xmv0.1.11 of 1See more

strapi strapi-xmv 0.1.1

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
ghcr.io/xmv-solutions-gmbh/strapi:latesta288b4571142
nodemailer@8.0.11
9.1.0

Open the chart page →

676
joplintobiassackmann0.1.71 of 2See more

joplin tobiassackmann 0.1.7

1 of the 2 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
joplin/server:latest3f7b852959aa
nodemailer@6.10.1
9.1.0

Open the chart page →

5,535
twentytwenty-crm0.1.111 of 4See more

twenty twenty-crm 0.1.11

1 of the 4 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
twentycrm/twenty:v2.22.0e7d9948bf284
nodemailer@9.0.1
9.1.0

Open the chart page →

5,550
unleash-enterpriseunleash1.0.31 of 1See more

unleash-enterprise unleash 1.0.3

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
unleashorg/unleash-enterprise:7.5.0245aeba40053
nodemailer@7.0.13
9.1.0

Open the chart page →

2,028
kenerunxwaresVerified publisher2026.2.51 of 1See more

kener unxwares 2026.2.5

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
rajnandan1/kener:3.2.1930407afca731
nodemailer@6.10.0
9.1.0

Open the chart page →

5,228
devportalveecode-platform-nextVerified publisher0.1.211 of 1See more

devportal veecode-platform-next 0.1.21

1 of the 1 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
veecode/devportaldigest-pinnedc443520aebf7
nodemailer@8.0.11
9.1.0

Open the chart page →

1,787
colanodevictorlane0.3.31 of 3See more

colanode victorlane 0.3.3

1 of the 3 container images this version deploys carry GHSA-cc9r-2j5m-2m83.

Container imageDigestPackageFixed in
ghcr.io/colanode/server:latest7006cac874fd
nodemailer@8.0.4
9.1.0

Open the chart page →

2,076

Container images carrying it

84 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/seerr-team/seerr:latest:v3.4.1f4768de5f616
nodemailer@6.9.16
9.1.0
3
quay.io/devtron/notifier:9804331c-372-39294709c7da19c5a
nodemailer@7.0.13
9.1.0
3
infisical/infisical:latest:v0.165.602082bf13163
nodemailer@8.0.11
9.1.0
2
kutt/kutt:latest:v3.2.6fa3d24a89b04
nodemailer@9.0.3
9.1.0
2
library/ghost:6.63.0e05bc1169fb2
nodemailer@8.0.11
9.1.0
2
louislam/uptime-kuma:2.5.4917318f9d7be
nodemailer@7.0.13
9.1.0
2
louislam/uptime-kuma:2.3.29aeb4e51d038
nodemailer@7.0.13
9.1.0
2
louislam/uptime-kuma:2.5.0a8610b3b4c38
nodemailer@7.0.13
9.1.0
2
n8nio/n8n:2.36.714c4285bc303
nodemailer@8.0.10
9.1.0
2
n8nio/n8n:2.38.45d9f0cc5672b
nodemailer@8.0.10
9.1.0
2
rajnandan1/kener:3.2.1930407afca731
nodemailer@6.10.0
9.1.0
2
activepieces/activepieces:0.90.430c10a04fe3d
nodemailer@9.0.1
9.1.0
1
bnjbvr/kresus:0.22.137e216b182c8
nodemailer@6.9.16
9.1.0
1
budibase/apps:3.41.344fe6feab985
nodemailer@9.0.1
9.1.0
1
budibase/worker:3.41.3de5e2e560ce8
nodemailer@9.0.3
9.1.0
1
chocobozzz/peertube:v8.1.5052712130691
nodemailer@7.0.13
9.1.0
1
devopsiaci/self-learning-platform:1.1.3d9441c931f75
nodemailer@8.0.1
9.1.0
1
directus/directus:12.0.29c8470ea465c
nodemailer@8.0.5
9.1.0
1
diygod/rsshub:2025-11-097a6312cac0d5
nodemailer@7.0.10
9.1.0
1
docmost/docmost:0.95.041c8d777cf23
nodemailer@9.0.1
9.1.0
1
drumsergio/lynxprompt:2.0.75c6afb6679301
nodemailer@8.0.7
9.1.0
1
etherpad/etherpad:latest6020e7b57f4b
nodemailer@9.0.3
9.1.0
1
fallenbagel/jellyseerr:latest4538137bc5af
nodemailer@6.10.0
9.1.0
1
fosrl/pangolin:1.13.0c32ad797ab96
nodemailer@7.0.11
9.1.0
1
growthbook/growthbook:5.0.1f53ead646b5f
nodemailer@9.0.1
9.1.0
1
helmforge/strapi-base:5.52.270e9143d6d92
nodemailer@9.0.1
9.1.0
1
hoppscotch/hoppscotch:2026.8.0d50725df661f
nodemailer@9.0.1
9.1.0
1
joplin/server:latest3f7b852959aa
nodemailer@6.10.1
9.1.0
1
library/ghost:6.37.01ef2e532ca4d
nodemailer@8.0.5
9.1.0
1
library/ghost:6.25.12654b1e90413
nodemailer@6.10.1
9.1.0
1
library/ghost:6.41.129773d6be407
nodemailer@8.0.5
9.1.0
1
library/ghost:6.39.0-alpine77196da4b0df
nodemailer@8.0.5
9.1.0
1
library/ghost:6.62.0a7a268bbfb7f
nodemailer@8.0.11
9.1.0
1
library/ghost:6.22.0-alpine3.23ac533a6988ee
nodemailer@6.10.1
9.1.0
1
louislam/uptime-kuma:2.2.1-slim059b49d64739
nodemailer@7.0.13
9.1.0
1
louislam/uptime-kuma:13d632903e6af
nodemailer@6.9.16
9.1.0
1
louislam/uptime-kuma:2.5.33e24e96c89ef
nodemailer@7.0.13
9.1.0
1
louislam/uptime-kuma:2.0.24c364ef96aad
nodemailer@6.9.16
9.1.0
1
louislam/uptime-kuma:2.4.091e963bfda56
nodemailer@7.0.13
9.1.0
1
louislam/uptime-kuma:2.0.2-slim-rootless9865163f92c1
nodemailer@6.9.16
9.1.0
1
n8nio/n8n:2.25.7761374d4eb84
nodemailer@7.0.11
9.1.0
1
n8nio/n8n:2.36.8cfe2704ff858
nodemailer@8.0.10
9.1.0
1
nocodb/nocodb:latest4b760f0d2547
nodemailer@9.0.5
9.1.0
1
nocodb/nocodb:0.258.06779a4ddedf2
nodemailer@6.9.16
9.1.0
1
nocodb/nocodb:0.301.5d9516f0bf546
nodemailer@7.0.13
9.1.0
1
outlinewiki/outline:0.82.0494dfb9249a6
nodemailer@6.10.0
9.1.0
1
outlinewiki/outline:1.10.1832051f039b4
nodemailer@9.0.5
9.1.0
1
rocketadmin/rocketadmin:1.17.710955ef540b9
nodemailer@8.0.5
9.1.0
1
soulteary/cronicle:0.9.80ac2512fa6e39
nodemailer@6.10.0
9.1.0
1
twentycrm/twenty:v2.22.0e7d9948bf284
nodemailer@9.0.1
9.1.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.