StackRadar

GHSA-wmmp-3585-3rmp

Medium

Advisory

Published 8 Sept 2026In the index since 9 Sept 2026
Severity
Medium
worst across findings
CVSS
6.5
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
187
of 17,781 indexed, latest versions
Container images
172
deployed by those charts
Fix available
1 of 1
affected package

Nodemailer: IDN/Punycode domain allow-list bypass leads to email delivery to an attacker-controlled domain

Carried by container images the latest versions of 187 of 17,781 indexed charts deploy, on 172 images.

Affected packageAffected versionsFixed inImages
nodemailernpm1.11.0, 2.7.2, 4.0.1, 4.6.8+49 more9.1.0172
OSV records
GHSA-wmmp-3585-3rmp
Trending
Rank 48 in indexed charts, since 13 Sept 2026. See the ranking →

Charts affected

187 by stars
ChartLatestAffected imagesRadar Score
n8nopenshift1.18.01 of 1See more

n8n openshift 1.18.0

1 of the 1 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
n8nio/n8n:2.36.714c4285bc303
nodemailer@8.0.10
9.1.0

Open the chart page →

1,038
xyopsquench-xyopsVerified publisher0.0.121 of 1See more

xyops quench-xyops 0.0.12

1 of the 1 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/xyopsdigest-pinneddd7d8bf3b654
nodemailer@9.0.1
9.1.0

Open the chart page →

68
etherpadredhat-cop0.0.81 of 1See more

etherpad redhat-cop 0.0.8

1 of the 1 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
etherpad/etherpad:latest6020e7b57f4b
nodemailer@9.0.3
9.1.0

Open the chart page →

895
claude-relayrevolution10.1.371 of 4See more

claude-relay revolution1 0.1.37

1 of the 4 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
ghcr.io/wei-shaw/claude-relay-service:v1.1.292398c34934453
nodemailer@7.0.6
9.1.0

Open the chart page →

4,600
kresusrm3lVerified publisher0.2.11 of 3See more

kresus rm3l 0.2.1

1 of the 3 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
bnjbvr/kresus:0.22.137e216b182c8
nodemailer@6.9.16
9.1.0

Open the chart page →

15,591
devtron-enterpriseromholdings48.0.01 of 28See more

devtron-enterprise romholdings 48.0.0

1 of the 28 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
quay.io/devtron/notifier:9804331c-372-39294709c7da19c5a
nodemailer@7.0.13
9.1.0

Open the chart page →

68,240
routr-connectroutr0.4.35 of 10See more

routr-connect routr 0.4.3

5 of the 10 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
fonoster/routr-connect:2.13.6e8c84b5eaa67
nodemailer@6.9.15
9.1.0
fonoster/routr-dispatcher:2.13.65f8f380dc174
nodemailer@6.9.15
9.1.0
fonoster/routr-location:2.13.6051ba9c34ef5
nodemailer@6.9.15
9.1.0
fonoster/routr-pgdata:2.13.6e4d5f5ff1945
nodemailer@6.9.15
9.1.0
fonoster/routr-registry:2.13.6e27001f2813c
nodemailer@6.9.15
9.1.0

Open the chart page →

11,021
karakeeprtomik-helm-chartsVerified publisher0.0.11 of 3See more

karakeep rtomik-helm-charts 0.0.1

1 of the 3 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.26.0f575a34ed3f8
nodemailer@7.0.4
9.1.0

Open the chart page →

5,338
audiobookshelfrubxkubeVerified publisher0.1.31 of 1See more

audiobookshelf rubxkube 0.1.3

1 of the 1 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
ghcr.io/advplyr/audiobookshelf:2.36.0180acad33d69
nodemailer@6.9.13
9.1.0

Open the chart page →

1,722
joplinrubxkubeVerified publisher1.3.11 of 2See more

joplin rubxkube 1.3.1

1 of the 2 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
joplin/server:3.0-beta52af57880c0e
nodemailer@6.9.13
9.1.0

Open the chart page →

7,413
uptime-kumarubxkubeVerified publisher1.2.11 of 1See more

uptime-kuma rubxkube 1.2.1

1 of the 1 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.4.091e963bfda56
nodemailer@7.0.13
9.1.0

Open the chart page →

30,219
uptime-kumasarab97Verified publisher0.1.51 of 1See more

uptime-kuma sarab97 0.1.5

1 of the 1 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
louislam/uptime-kuma:1.22.10b55bcb83a1c
nodemailer@6.6.5
9.1.0

Open the chart page →

4,744
rsshubsb-helm-charts0.3.01 of 1See more

rsshub sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
diygod/rsshub:2025-11-097a6312cac0d5
nodemailer@7.0.10
9.1.0

Open the chart page →

4,684
outlineschmitzis0.0.81 of 4See more

outline schmitzis 0.0.8

1 of the 4 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
outlinewiki/outline:0.69.1d060dcd8f9aa
nodemailer@6.9.1
9.1.0

Open the chart page →

4,431
wekanschmitzis1.1.11 of 1See more

wekan schmitzis 1.1.1

1 of the 1 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
quay.io/wekan/wekan:v5.65cb17600883a3
nodemailer@6.4.6
9.1.0

Open the chart page →

3,638
seerr-chartseerr-chartVerified publisher3.9.11 of 1See more

seerr-chart seerr-chart 3.9.1

1 of the 1 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:v3.4.1f4768de5f616
nodemailer@6.9.16
9.1.0

Open the chart page →

1,991
infisicalsinextraVerified publisher0.6.01 of 1See more

infisical sinextra 0.6.0

1 of the 1 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
infisical/infisical:v0.165.602082bf13163
nodemailer@8.0.11
9.1.0

Open the chart page →

3,014
speckle-server-branch-hotfix-2.19.1speckleVerified publisher2.19.2-branch.hotfix-2.19.1.124125-665e7e11 of 5See more

speckle-server-branch-hotfix-2.19.1 speckle 2.19.2-branch.hotfix-2.19.1.124125-665e7e1

1 of the 5 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
speckle/speckle-server:2.19.2-branch.hotfix-2.19.1.124125-665e7e14b6a0750d5aa
nodemailer@6.9.9
9.1.0

Open the chart page →

16,368
speckle-server-branch-hotfix-2.20.2speckleVerified publisher2.20.3-branch.hotfix-2.20.2.149555-37ea0cb1 of 5See more

speckle-server-branch-hotfix-2.20.2 speckle 2.20.3-branch.hotfix-2.20.2.149555-37ea0cb

1 of the 5 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
speckle/speckle-server:2.20.3-branch.hotfix-2.20.2.149555-37ea0cb52f8eabf5cea
nodemailer@6.9.9
9.1.0

Open the chart page →

16,400
speckle-server-branch-testingspeckleVerified publisher2.17.14-branch.testing.72707.921a5f81 of 5See more

speckle-server-branch-testing speckle 2.17.14-branch.testing.72707.921a5f8

1 of the 5 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
speckle/speckle-server:2.17.14-branch.testing.72707.921a5f849d10dcdfb91
nodemailer@6.7.5
9.1.0

Open the chart page →

14,679
speckle-server-branch-testing1speckleVerified publisher2.20.6-branch.testing1.154030-9b091141 of 5See more

speckle-server-branch-testing1 speckle 2.20.6-branch.testing1.154030-9b09114

1 of the 5 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
speckle/speckle-server:2.20.6-branch.testing1.154030-9b09114e8413f57b327
nodemailer@6.9.9
9.1.0

Open the chart page →

16,400
speckle-server-branch-testing2speckleVerified publisher2.18.11-branch.testing2.88634-335d4691 of 5See more

speckle-server-branch-testing2 speckle 2.18.11-branch.testing2.88634-335d469

1 of the 5 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
speckle/speckle-server:2.18.11-branch.testing2.88634-335d469bf6a501b2210
nodemailer@6.9.9
9.1.0

Open the chart page →

14,221
speckle-server-branch-testing3speckleVerified publisher2.18.12-branch.testing3.88744-f55b3411 of 5See more

speckle-server-branch-testing3 speckle 2.18.12-branch.testing3.88744-f55b341

1 of the 5 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
speckle/speckle-server:2.18.12-branch.testing3.88744-f55b34189a5872375f9
nodemailer@6.9.9
9.1.0

Open the chart page →

14,221
speckle-server-branch-testing4speckleVerified publisher2.20.2-branch.testing4.134160-9fad4b21 of 5See more

speckle-server-branch-testing4 speckle 2.20.2-branch.testing4.134160-9fad4b2

1 of the 5 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
speckle/speckle-server:2.20.2-branch.testing4.134160-9fad4b2687f43ab16f3
nodemailer@6.9.9
9.1.0

Open the chart page →

16,019
speckle-server-branch-testing5speckleVerified publisher2.21.3-branch.testing5.219631-2153bef1 of 5See more

speckle-server-branch-testing5 speckle 2.21.3-branch.testing5.219631-2153bef

1 of the 5 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
speckle/speckle-server:2.21.3-branch.testing5.219631-2153bef8fd157733393
nodemailer@6.9.9
9.1.0

Open the chart page →

15,635
speckle-server-branch-testing6speckleVerified publisher2.25.10-branch.testing6.645-b125c1e1 of 4See more

speckle-server-branch-testing6 speckle 2.25.10-branch.testing6.645-b125c1e

1 of the 4 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
speckle/speckle-server:2.25.10-branch.testing6.645-b125c1e75cdf256067b
nodemailer@6.9.9
9.1.0

Open the chart page →

11,100
strapistrapi-xmv0.1.11 of 1See more

strapi strapi-xmv 0.1.1

1 of the 1 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
ghcr.io/xmv-solutions-gmbh/strapi:latesta288b4571142
nodemailer@8.0.11
9.1.0

Open the chart page →

676
trudesktechpreta1.0.01 of 3See more

trudesk techpreta 1.0.0

1 of the 3 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
polonel/trudesk:1.2.60cf6513f6fe3
nodemailer@6.7.3
9.1.0

Open the chart page →

4,017
joplintobiassackmann0.1.71 of 2See more

joplin tobiassackmann 0.1.7

1 of the 2 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
joplin/server:latest3f7b852959aa
nodemailer@6.10.1
9.1.0

Open the chart page →

5,535
twentytwenty-crm0.1.111 of 4See more

twenty twenty-crm 0.1.11

1 of the 4 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
twentycrm/twenty:v2.22.0e7d9948bf284
nodemailer@9.0.1
9.1.0

Open the chart page →

5,550
unleash-enterpriseunleash1.0.31 of 1See more

unleash-enterprise unleash 1.0.3

1 of the 1 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
unleashorg/unleash-enterprise:7.5.0245aeba40053
nodemailer@7.0.13
9.1.0

Open the chart page →

2,028
kenerunxwaresVerified publisher2026.2.51 of 1See more

kener unxwares 2026.2.5

1 of the 1 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
rajnandan1/kener:3.2.1930407afca731
nodemailer@6.10.0
9.1.0

Open the chart page →

5,228
devportalveecode-platform-nextVerified publisher0.1.211 of 1See more

devportal veecode-platform-next 0.1.21

1 of the 1 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
veecode/devportaldigest-pinnedc443520aebf7
nodemailer@8.0.11
9.1.0

Open the chart page →

1,787
genievhdirkVerified publisher0.1.31 of 1See more

genie vhdirk 0.1.3

1 of the 1 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
stanfordoval/almond-server:latest1a63cdccedaf
nodemailer@6.7.2
9.1.0

Open the chart page →

3,129
colanodevictorlane0.3.31 of 3See more

colanode victorlane 0.3.3

1 of the 3 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
ghcr.io/colanode/server:latest7006cac874fd
nodemailer@8.0.4
9.1.0

Open the chart page →

2,076
wikiwikijs3.0.01 of 2See more

wiki wikijs 3.0.0

1 of the 2 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
requarks/wiki:268f0d1848261
nodemailer@6.9.1
9.1.0

Open the chart page →

5,459
kibanawiremindVerified publisher8.5.231 of 2See more

kibana wiremind 8.5.23

1 of the 2 container images this version deploys carry GHSA-wmmp-3585-3rmp.

Container imageDigestPackageFixed in
library/kibana:8.18.004c0fc150f3a
nodemailer@6.9.15
9.1.0

Open the chart page →

6,285

Container images carrying it

172 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/advplyr/audiobookshelf:2.36.0180acad33d69
nodemailer@6.9.13
9.1.0
4
pantsel/konga:latestc8172b75607d
nodemailer@4.7.0
9.1.0
3
rcdelacruz/my-strapi-app:js-amd6438007f358355
nodemailer@6.9.1
9.1.0
3
ghcr.io/kamilkisiela/graphql-hive/app:59b64c36c866b3555c135c70de76a884e63f8619a4a3639899f7
nodemailer@6.8.0
9.1.0
3
ghcr.io/seerr-team/seerr:latest:v3.4.1f4768de5f616
nodemailer@6.9.16
9.1.0
3
quay.io/devtron/notifier:9804331c-372-39294709c7da19c5a
nodemailer@7.0.13
9.1.0
3
governify/registry:v3.4.0d3f37f4f8168
nodemailer@6.6.0
9.1.0
2
hoppscotch/hoppscotch:2024.8.2f1da831950b7
nodemailer@6.9.14
9.1.0
2
infisical/infisical:latest:v0.165.602082bf13163
nodemailer@8.0.11
9.1.0
2
kutt/kutt:latest:v3.2.6fa3d24a89b04
nodemailer@9.0.3
9.1.0
2
library/ghost:6.63.0e05bc1169fb2
nodemailer@8.0.11
9.1.0
2
louislam/uptime-kuma:2.5.4917318f9d7be
nodemailer@7.0.13
9.1.0
2
louislam/uptime-kuma:2.3.29aeb4e51d038
nodemailer@7.0.13
9.1.0
2
louislam/uptime-kuma:2.5.0a8610b3b4c38
nodemailer@7.0.13
9.1.0
2
moreillon/user-manager:v5.0.2e1c9bfab5c16
nodemailer@6.9.0
9.1.0
2
n8nio/n8n:2.36.714c4285bc303
nodemailer@8.0.10
9.1.0
2
n8nio/n8n:2.38.45d9f0cc5672b
nodemailer@8.0.10
9.1.0
2
outlinewiki/outline:0.69.1d060dcd8f9aa
nodemailer@6.9.1
9.1.0
2
rajnandan1/kener:3.2.1930407afca731
nodemailer@6.10.0
9.1.0
2
requarks/wiki:2:latest68f0d1848261
nodemailer@6.9.1
9.1.0
2
activepieces/activepieces:0.90.430c10a04fe3d
nodemailer@9.0.1
9.1.0
1
activepieces/activepieces:0.23.0c26188b44e62
nodemailer@6.9.9
9.1.0
1
assistiot/cybersecurity-monitoring_ir-kbn:latest0570b27bb7c2
nodemailer@6.4.16
9.1.0
1
automatischio/automatisch:0.15.03bace7a12d5f
nodemailer@6.7.0
9.1.0
1
bnjbvr/kresus:0.22.137e216b182c8
nodemailer@6.9.16
9.1.0
1
budibase/apps:3.41.344fe6feab985
nodemailer@9.0.1
9.1.0
1
budibase/worker:3.41.3de5e2e560ce8
nodemailer@9.0.3
9.1.0
1
chocobozzz/peertube:v8.1.5052712130691
nodemailer@7.0.13
9.1.0
1
cnieg/maildev:v1.1.998ee05668915
nodemailer@5.0.0
9.1.0
1
countly/api:25.05.4f4cc7447c4f5
nodemailer@6.9.13
9.1.0
1
countly/countly-server:25.05.4e3c238248f99
nodemailer@6.9.13
9.1.0
1
countly/frontend:25.05.42acbc11499b6
nodemailer@6.9.13
9.1.0
1
devopsiaci/self-learning-platform:1.1.3d9441c931f75
nodemailer@8.0.1
9.1.0
1
directus/directus:12.0.29c8470ea465c
nodemailer@8.0.5
9.1.0
1
directus/directus:11.1.0e3c8bb975350
nodemailer@6.9.14
9.1.0
1
diygod/rsshub:2025-11-097a6312cac0d5
nodemailer@7.0.10
9.1.0
1
docmost/docmost:0.95.041c8d777cf23
nodemailer@9.0.1
9.1.0
1
drumsergio/lynxprompt:2.0.75c6afb6679301
nodemailer@8.0.7
9.1.0
1
etherpad/etherpad:latest6020e7b57f4b
nodemailer@9.0.3
9.1.0
1
fallenbagel/jellyseerr:latest4538137bc5af
nodemailer@6.10.0
9.1.0
1
fallenbagel/jellyseerr:1.7.06dcdb5ba5091
nodemailer@6.9.3
9.1.0
1
fiware/idm:8.3.3a1b6ed4ae84f
nodemailer@6.7.8
9.1.0
1
fonoster/routr-connect:2.13.6e8c84b5eaa67
nodemailer@6.9.15
9.1.0
1
fonoster/routr-dispatcher:2.13.65f8f380dc174
nodemailer@6.9.15
9.1.0
1
fonoster/routr-location:2.13.6051ba9c34ef5
nodemailer@6.9.15
9.1.0
1
fonoster/routr-pgdata:2.13.6e4d5f5ff1945
nodemailer@6.9.15
9.1.0
1
fonoster/routr-registry:2.13.6e27001f2813c
nodemailer@6.9.15
9.1.0
1
fosrl/pangolin:1.13.0c32ad797ab96
nodemailer@7.0.11
9.1.0
1
getferdi/ferdi-server:1.3.26e620b85afaa
nodemailer@4.7.0
9.1.0
1
growthbook/growthbook:5.0.1f53ead646b5f
nodemailer@9.0.1
9.1.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.