CVE-2021-23400: HTTP Header Injection
Published Jun 29, 2021
·Updated
The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain newlines and carriage returns is passed into an address object.
Affected Software
1 affected component
Nodemailer Nodemailer Node.js<6.6.1
Remediation
Patch Available
Patch Available
Event History
Jun 29, 2021
CVE Published
via MITRE·11:45 AM
Data Sourced
via MITRE·11:45 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2021-23400?
The severity of CVE-2021-23400 is considered high due to the potential for HTTP header injection.
2
How do I fix CVE-2021-23400?
To fix CVE-2021-23400, update Nodemailer to version 6.6.1 or later.
3
What are the potential impacts of CVE-2021-23400?
The potential impacts of CVE-2021-23400 include the ability for an attacker to manipulate HTTP headers and conduct phishing or spoofing attacks.
4
Which versions of Nodemailer are affected by CVE-2021-23400?
CVE-2021-23400 affects all versions of Nodemailer prior to 6.6.1.
5
How does CVE-2021-23400 exploit user input?
CVE-2021-23400 exploits unsanitized user input that can contain newlines and carriage returns, allowing for header injection.