StackRadar

GHSA-wmmp-3585-3rmp

Medium

Advisory

Published 8 Sept 2026In the index since 9 Sept 2026
Severity
Medium
worst across findings
CVSS
6.5
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
187
of 17,781 indexed, latest versions
Container images
172
deployed by those charts
Fix available
1 of 1
affected package

Nodemailer: IDN/Punycode domain allow-list bypass leads to email delivery to an attacker-controlled domain

Carried by container images the latest versions of 187 of 17,781 indexed charts deploy, on 172 images.

Affected packageAffected versionsFixed inImages
nodemailernpm1.11.0, 2.7.2, 4.0.1, 4.6.8+49 more9.1.0172
OSV records
GHSA-wmmp-3585-3rmp
Trending
Rank 48 in indexed charts, since 13 Sept 2026. See the ranking →

Charts affected

187 by stars
ChartLatestAffected imagesRadar Score
n8nopenshift1.18.01 of 1See more

n8n openshift 1.18.0

1 of the 1 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
n8nio/n8n:2.36.714c4285bc303
nodemailer@8.0.10
9.1.0

Open the chart page →

1,038
xyopsquench-xyopsVerified publisher0.0.121 of 1See more

xyops quench-xyops 0.0.12

1 of the 1 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/xyopsdigest-pinneddd7d8bf3b654
nodemailer@9.0.1
9.1.0

Open the chart page →

68
etherpadredhat-cop0.0.81 of 1See more

etherpad redhat-cop 0.0.8

1 of the 1 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
etherpad/etherpad:latest6020e7b57f4b
nodemailer@9.0.3
9.1.0

Open the chart page →

895
claude-relayrevolution10.1.371 of 4See more

claude-relay revolution1 0.1.37

1 of the 4 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
ghcr.io/wei-shaw/claude-relay-service:v1.1.292398c34934453
nodemailer@7.0.6
9.1.0

Open the chart page →

4,600
kresusrm3lVerified publisher0.2.11 of 3See more

kresus rm3l 0.2.1

1 of the 3 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
bnjbvr/kresus:0.22.137e216b182c8
nodemailer@6.9.16
9.1.0

Open the chart page →

15,591
devtron-enterpriseromholdings48.0.01 of 28See more

devtron-enterprise romholdings 48.0.0

1 of the 28 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
quay.io/devtron/notifier:9804331c-372-39294709c7da19c5a
nodemailer@7.0.13
9.1.0

Open the chart page →

68,240
routr-connectroutr0.4.35 of 10See more

routr-connect routr 0.4.3

5 of the 10 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
fonoster/routr-connect:2.13.6e8c84b5eaa67
nodemailer@6.9.15
9.1.0
fonoster/routr-dispatcher:2.13.65f8f380dc174
nodemailer@6.9.15
9.1.0
fonoster/routr-location:2.13.6051ba9c34ef5
nodemailer@6.9.15
9.1.0
fonoster/routr-pgdata:2.13.6e4d5f5ff1945
nodemailer@6.9.15
9.1.0
fonoster/routr-registry:2.13.6e27001f2813c
nodemailer@6.9.15
9.1.0

Open the chart page →

11,021
karakeeprtomik-helm-chartsVerified publisher0.0.11 of 3See more

karakeep rtomik-helm-charts 0.0.1

1 of the 3 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.26.0f575a34ed3f8
nodemailer@7.0.4
9.1.0

Open the chart page →

5,338
audiobookshelfrubxkubeVerified publisher0.1.31 of 1See more

audiobookshelf rubxkube 0.1.3

1 of the 1 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
ghcr.io/advplyr/audiobookshelf:2.36.0180acad33d69
nodemailer@6.9.13
9.1.0

Open the chart page →

1,722
joplinrubxkubeVerified publisher1.3.11 of 2See more

joplin rubxkube 1.3.1

1 of the 2 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
joplin/server:3.0-beta52af57880c0e
nodemailer@6.9.13
9.1.0

Open the chart page →

7,413
uptime-kumarubxkubeVerified publisher1.2.11 of 1See more

uptime-kuma rubxkube 1.2.1

1 of the 1 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.4.091e963bfda56
nodemailer@7.0.13
9.1.0

Open the chart page →

30,219
uptime-kumasarab97Verified publisher0.1.51 of 1See more

uptime-kuma sarab97 0.1.5

1 of the 1 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
louislam/uptime-kuma:1.22.10b55bcb83a1c
nodemailer@6.6.5
9.1.0

Open the chart page →

4,744
rsshubsb-helm-charts0.3.01 of 1See more

rsshub sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
diygod/rsshub:2025-11-097a6312cac0d5
nodemailer@7.0.10
9.1.0

Open the chart page →

4,684
outlineschmitzis0.0.81 of 4See more

outline schmitzis 0.0.8

1 of the 4 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
outlinewiki/outline:0.69.1d060dcd8f9aa
nodemailer@6.9.1
9.1.0

Open the chart page →

4,431
wekanschmitzis1.1.11 of 1See more

wekan schmitzis 1.1.1

1 of the 1 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
quay.io/wekan/wekan:v5.65cb17600883a3
nodemailer@6.4.6
9.1.0

Open the chart page →

3,638
seerr-chartseerr-chartVerified publisher3.9.11 of 1See more

seerr-chart seerr-chart 3.9.1

1 of the 1 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:v3.4.1f4768de5f616
nodemailer@6.9.16
9.1.0

Open the chart page →

1,991
infisicalsinextraVerified publisher0.6.01 of 1See more

infisical sinextra 0.6.0

1 of the 1 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
infisical/infisical:v0.165.602082bf13163
nodemailer@8.0.11
9.1.0

Open the chart page →

3,014
speckle-server-branch-hotfix-2.19.1speckleVerified publisher2.19.2-branch.hotfix-2.19.1.124125-665e7e11 of 5See more

speckle-server-branch-hotfix-2.19.1 speckle 2.19.2-branch.hotfix-2.19.1.124125-665e7e1

1 of the 5 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
speckle/speckle-server:2.19.2-branch.hotfix-2.19.1.124125-665e7e14b6a0750d5aa
nodemailer@6.9.9
9.1.0

Open the chart page →

16,368
speckle-server-branch-hotfix-2.20.2speckleVerified publisher2.20.3-branch.hotfix-2.20.2.149555-37ea0cb1 of 5See more

speckle-server-branch-hotfix-2.20.2 speckle 2.20.3-branch.hotfix-2.20.2.149555-37ea0cb

1 of the 5 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
speckle/speckle-server:2.20.3-branch.hotfix-2.20.2.149555-37ea0cb52f8eabf5cea
nodemailer@6.9.9
9.1.0

Open the chart page →

16,400
speckle-server-branch-testingspeckleVerified publisher2.17.14-branch.testing.72707.921a5f81 of 5See more

speckle-server-branch-testing speckle 2.17.14-branch.testing.72707.921a5f8

1 of the 5 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
speckle/speckle-server:2.17.14-branch.testing.72707.921a5f849d10dcdfb91
nodemailer@6.7.5
9.1.0

Open the chart page →

14,679
speckle-server-branch-testing1speckleVerified publisher2.20.6-branch.testing1.154030-9b091141 of 5See more

speckle-server-branch-testing1 speckle 2.20.6-branch.testing1.154030-9b09114

1 of the 5 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
speckle/speckle-server:2.20.6-branch.testing1.154030-9b09114e8413f57b327
nodemailer@6.9.9
9.1.0

Open the chart page →

16,400
speckle-server-branch-testing2speckleVerified publisher2.18.11-branch.testing2.88634-335d4691 of 5See more

speckle-server-branch-testing2 speckle 2.18.11-branch.testing2.88634-335d469

1 of the 5 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
speckle/speckle-server:2.18.11-branch.testing2.88634-335d469bf6a501b2210
nodemailer@6.9.9
9.1.0

Open the chart page →

14,221
speckle-server-branch-testing3speckleVerified publisher2.18.12-branch.testing3.88744-f55b3411 of 5See more

speckle-server-branch-testing3 speckle 2.18.12-branch.testing3.88744-f55b341

1 of the 5 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
speckle/speckle-server:2.18.12-branch.testing3.88744-f55b34189a5872375f9
nodemailer@6.9.9
9.1.0

Open the chart page →

14,221
speckle-server-branch-testing4speckleVerified publisher2.20.2-branch.testing4.134160-9fad4b21 of 5See more

speckle-server-branch-testing4 speckle 2.20.2-branch.testing4.134160-9fad4b2

1 of the 5 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
speckle/speckle-server:2.20.2-branch.testing4.134160-9fad4b2687f43ab16f3
nodemailer@6.9.9
9.1.0

Open the chart page →

16,019
speckle-server-branch-testing5speckleVerified publisher2.21.3-branch.testing5.219631-2153bef1 of 5See more

speckle-server-branch-testing5 speckle 2.21.3-branch.testing5.219631-2153bef

1 of the 5 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
speckle/speckle-server:2.21.3-branch.testing5.219631-2153bef8fd157733393
nodemailer@6.9.9
9.1.0

Open the chart page →

15,635
speckle-server-branch-testing6speckleVerified publisher2.25.10-branch.testing6.645-b125c1e1 of 4See more

speckle-server-branch-testing6 speckle 2.25.10-branch.testing6.645-b125c1e

1 of the 4 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
speckle/speckle-server:2.25.10-branch.testing6.645-b125c1e75cdf256067b
nodemailer@6.9.9
9.1.0

Open the chart page →

11,100
strapistrapi-xmv0.1.11 of 1See more

strapi strapi-xmv 0.1.1

1 of the 1 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
ghcr.io/xmv-solutions-gmbh/strapi:latesta288b4571142
nodemailer@8.0.11
9.1.0

Open the chart page →

676
trudesktechpreta1.0.01 of 3See more

trudesk techpreta 1.0.0

1 of the 3 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
polonel/trudesk:1.2.60cf6513f6fe3
nodemailer@6.7.3
9.1.0

Open the chart page →

4,017
joplintobiassackmann0.1.71 of 2See more

joplin tobiassackmann 0.1.7

1 of the 2 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
joplin/server:latest3f7b852959aa
nodemailer@6.10.1
9.1.0

Open the chart page →

5,535
twentytwenty-crm0.1.111 of 4See more

twenty twenty-crm 0.1.11

1 of the 4 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
twentycrm/twenty:v2.22.0e7d9948bf284
nodemailer@9.0.1
9.1.0

Open the chart page →

5,550
unleash-enterpriseunleash1.0.31 of 1See more

unleash-enterprise unleash 1.0.3

1 of the 1 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
unleashorg/unleash-enterprise:7.5.0245aeba40053
nodemailer@7.0.13
9.1.0

Open the chart page →

2,028
kenerunxwaresVerified publisher2026.2.51 of 1See more

kener unxwares 2026.2.5

1 of the 1 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
rajnandan1/kener:3.2.1930407afca731
nodemailer@6.10.0
9.1.0

Open the chart page →

5,228
devportalveecode-platform-nextVerified publisher0.1.211 of 1See more

devportal veecode-platform-next 0.1.21

1 of the 1 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
veecode/devportaldigest-pinnedc443520aebf7
nodemailer@8.0.11
9.1.0

Open the chart page →

1,787
genievhdirkVerified publisher0.1.31 of 1See more

genie vhdirk 0.1.3

1 of the 1 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
stanfordoval/almond-server:latest1a63cdccedaf
nodemailer@6.7.2
9.1.0

Open the chart page →

3,129
colanodevictorlane0.3.31 of 3See more

colanode victorlane 0.3.3

1 of the 3 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
ghcr.io/colanode/server:latest7006cac874fd
nodemailer@8.0.4
9.1.0

Open the chart page →

2,076
wikiwikijs3.0.01 of 2See more

wiki wikijs 3.0.0

1 of the 2 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
requarks/wiki:268f0d1848261
nodemailer@6.9.1
9.1.0

Open the chart page →

5,459
kibanawiremindVerified publisher8.5.231 of 2See more

kibana wiremind 8.5.23

1 of the 2 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
library/kibana:8.18.004c0fc150f3a
nodemailer@6.9.15
9.1.0

Open the chart page →

6,285

Container images carrying it

172 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
polonel/trudesk:1.2.60cf6513f6fe3
nodemailer@6.7.3
9.1.0
1
requarks/wiki:canary-2.5.2438b5865a7386c
nodemailer@6.4.14
9.1.0
1
rocketadmin/rocketadmin:1.17.710955ef540b9
nodemailer@8.0.5
9.1.0
1
shinobisystems/shinobi:dev3ca746937856
nodemailer@6.6.1
9.1.0
1
shinobisystems/shinobi:latestc2f5ce2e1067
nodemailer@6.6.1
9.1.0
1
solidproject/community-server:6.0.2ccc4acb7e9a1
nodemailer@6.9.1
9.1.0
1
soulteary/cronicle:0.9.80ac2512fa6e39
nodemailer@6.10.0
9.1.0
1
speckle/speckle-server:2.17.14-branch.testing.72707.921a5f849d10dcdfb91
nodemailer@6.7.5
9.1.0
1
speckle/speckle-server:2.19.2-branch.hotfix-2.19.1.124125-665e7e14b6a0750d5aa
nodemailer@6.9.9
9.1.0
1
speckle/speckle-server:2.20.3-branch.hotfix-2.20.2.149555-37ea0cb52f8eabf5cea
nodemailer@6.9.9
9.1.0
1
speckle/speckle-server:2.20.2-branch.testing4.134160-9fad4b2687f43ab16f3
nodemailer@6.9.9
9.1.0
1
speckle/speckle-server:2.25.10-branch.testing6.645-b125c1e75cdf256067b
nodemailer@6.9.9
9.1.0
1
speckle/speckle-server:2.26.379f14a2bf931
nodemailer@6.9.9
9.1.0
1
speckle/speckle-server:2.18.12-branch.testing3.88744-f55b34189a5872375f9
nodemailer@6.9.9
9.1.0
1
speckle/speckle-server:2.21.3-branch.testing5.219631-2153bef8fd157733393
nodemailer@6.9.9
9.1.0
1
speckle/speckle-server:2.18.11-branch.testing2.88634-335d469bf6a501b2210
nodemailer@6.9.9
9.1.0
1
speckle/speckle-server:2.20.6-branch.testing1.154030-9b09114e8413f57b327
nodemailer@6.9.9
9.1.0
1
stanfordoval/almond-server:latest1a63cdccedaf
nodemailer@6.7.2
9.1.0
1
tooljet/tooljet-ce:v1.18.0c85a4720e42e
nodemailer@6.7.2
9.1.0
1
twentycrm/twenty:v2.22.0e7d9948bf284
nodemailer@9.0.1
9.1.0
1
unleashorg/unleash-enterprise:7.5.0245aeba40053
nodemailer@7.0.13
9.1.0
1
unleashorg/unleash-server:7.5.09adb37e399ba
nodemailer@7.0.11
9.1.0
1
veecode/devportalc443520aebf7
nodemailer@8.0.11
9.1.0
1
zooz/predator:1.6f491d1f7a865
nodemailer@6.7.3
9.1.0
1
ghcr.io/advplyr/audiobookshelf:2.32.1a52dc5db694a
nodemailer@6.9.13
9.1.0
1
ghcr.io/blessingnator/keycloak-mcn-backend:2.0.5967470f05472
nodemailer@7.0.13
9.1.0
1
ghcr.io/bluesky-social/pds:0.4.208637083d9369d
nodemailer@6.10.1
9.1.0
1
ghcr.io/bluesky-social/pds:0.4.204cbc6e3ea157d
nodemailer@6.10.1
9.1.0
1
ghcr.io/bluesky-social/pds:0.4d95725b24dbe
nodemailer@6.10.1
9.1.0
1
ghcr.io/colanode/server:latest7006cac874fd
nodemailer@8.0.4
9.1.0
1
ghcr.io/ctron/streamsheets-gateway:2.4.00635f17c9d2c
nodemailer@4.6.8
9.1.0
1
ghcr.io/ctron/streamsheets-service-graphs:2.4.0e34964e336c1
nodemailer@6.1.1
9.1.0
1
ghcr.io/ctron/streamsheets-service-machines:2.4.00c5a3398d1e4
nodemailer@6.1.1
9.1.0
1
ghcr.io/ctron/streamsheets-service-streams:2.4.08ba040e79ca0
nodemailer@6.1.1
9.1.0
1
ghcr.io/danny-avila/librechat:v0.7.87fe76551a78e
nodemailer@6.9.15
9.1.0
1
ghcr.io/danny-avila/librechat:v0.7.78c68abbe1cff
nodemailer@6.9.15
9.1.0
1
ghcr.io/data-fair/portals:18b621866ceb2
nodemailer@6.10.1
9.1.0
1
ghcr.io/data-fair/processings:15a9216989707
nodemailer@6.9.7
9.1.0
1
ghcr.io/data-fair/simple-directory:438a4f32fad82
nodemailer@5.0.0
9.1.0
1
ghcr.io/fallenbagel/jellyseerr:2.5.22a611369ad1d
nodemailer@6.9.16
9.1.0
1
ghcr.io/harish2k01/portfolio-tracker:0.1.056efa3085895
nodemailer@7.0.13
9.1.0
1
ghcr.io/immich-app/immich-server:v3.2.0ae13784ffcfc
nodemailer@9.0.5
9.1.0
1
ghcr.io/immich-app/immich-server:v3.1.0b434cb9287ee
nodemailer@9.0.3
9.1.0
1
ghcr.io/immich-app/immich-server:v2.3.1f8d06a32b1b2
nodemailer@7.0.10
9.1.0
1
ghcr.io/karakeep-app/karakeep:0.27.1abd7d6b11b1b
nodemailer@7.0.4
9.1.0
1
ghcr.io/karakeep-app/karakeep:0.33.2b069e4307dec
nodemailer@7.0.13
9.1.0
1
ghcr.io/karakeep-app/karakeep:0.26.0f575a34ed3f8
nodemailer@7.0.4
9.1.0
1
ghcr.io/linkwarden/linkwarden:v2.16.30664c28a039b
nodemailer@9.0.4
9.1.0
1
ghcr.io/linuxserver/wikijs:version-2.5.20158d377933678
nodemailer@6.4.14
9.1.0
1
ghcr.io/logtide-dev/logtide-backend:1.0.265463e02f887
nodemailer@9.0.1
9.1.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.