CVE-2026-82853
Nodemailer before 8.0.5 SMTP Command Injection via CRLF
- State
- Published
- Severity
- 6.9 Medium
- Published
- Aug 31, 2026
- Updated
- Aug 31, 2026
- Reserved
- Aug 31, 2026
Description
Nodemailer versions before 8.0.5 contain an SMTP command injection vulnerability in the transport name option used in EHLO/HELO commands. The name parameter is concatenated directly into SMTP commands without sanitizing carriage return and line feed characters, allowing attackers to inject arbitrary SMTP commands for email spoofing and phishing attacks.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 4.9 Medium | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N | VulnCheck |
Weaknesses
- CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')
Affected Products
| Product | Versions |
|---|---|
nodemailernodemailer |
|
References
- GitHub Security Advisory (GHSA-vvjj-xcjg-gr5g)vendor-advisory
- VulnCheck Advisory: Nodemailer before 8.0.5 SMTP Command Injection via CRLFthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.