CVE-2026-121946: zbateson mail-mime-parser before 3.0.9 and 4.x before 4.0.6 CRLF Header Injection via Message Builders
zbateson mail-mime-parser before 3.0.9 and 4.x before 4.0.6 contains a CRLF header injection vulnerability in message-building helpers that fail to strip CR and LF characters. Attackers supplying crafted MIME type, charset, encoding, micalg, or protocol values can inject extra header lines such as a forged Bcc into outgoing messages.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using zbateson mail-mime-parser versions before 3.0.9, or 4.x versions before 4.0.6, are affected when they use the vulnerable message-building helpers with attacker-controlled MIME type, charset, encoding, micalg, or protocol values.
What must an attacker control to exploit it?
An attacker needs to supply a crafted value containing CR or LF characters for one of the affected message-builder inputs: MIME type, charset, encoding, micalg, or protocol. This can cause additional outbound email header lines, such as a forged Bcc header, to be injected.
What should be done to remediate the issue?
Upgrade to version 3.0.9 or later on the 3.x branch, or 4.0.6 or later on the 4.x branch. If upgrading is not immediately possible, do not pass untrusted values into the affected message-building helper parameters and reject or strip CR and LF characters from those inputs.