CVE-2021-23400

HTTP Header Injection

State: Published
Severity: 6.3 Medium
Published: Jun 29, 2021
Updated: Sep 16, 2024
Reserved: Jan 8, 2021

Description

The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain newlines and carriage returns is passed into an address object.

Scores

CVSS	Score	Vector	Source
3.1	6.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P	snyk

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
nodemailern/a	before 6.6.1Affected

References

https://snyk.io/vuln/SNYK-JS-NODEMAILER-1296415
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1314737
https://github.com/nodemailer/nodemailer/issues/1289
https://github.com/nodemailer/nodemailer/commit/7e02648cc8cd863f5085bad3cd09087bccf84b9f

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.