Skip to content
CVE PROGRAM SOURCE RECORD6.9 Medium

CVE-2026-82853

Nodemailer before 8.0.5 SMTP Command Injection via CRLF

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

Nodemailer versions before 8.0.5 contain an SMTP command injection vulnerability in the transport name option used in EHLO/HELO commands. The name parameter is concatenated directly into SMTP commands without sanitizing carriage return and line feed characters, allowing attackers to inject arbitrary SMTP commands for email spoofing and phishing attacks.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

nodemailer nodemailer

Default version status: unaffected

  • 0 to < 8.0.5affected
  • 8.0.5unaffected
pkg:npm/nodemailer

References