CVE-2026-82661: Nodemailer CRLF Injection via List-* Header Comments
Nodemailer before 8.0.9 fails to sanitize carriage return and line feed characters in list comment fields, allowing attackers to inject arbitrary message headers. An attacker with control over list..comment parameters can inject CRLF sequences to create additional headers in generated RFC822 messages, altering mail client behavior and message semantics.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using Nodemailer versions before 8.0.9 are exposed if untrusted input can control a list.*.comment parameter used when generating messages.
What access does an attacker need to exploit this?
An attacker needs control over one or more list.*.comment values. They can supply carriage return and line feed sequences to add arbitrary headers to generated RFC822 messages.
What is the recommended remediation?
Upgrade Nodemailer to version 8.0.9 or later. If upgrading is not immediately possible, prevent untrusted input from reaching list.*.comment parameters and reject carriage return and line feed characters in those values.
How can I determine whether an application is affected?
Check whether the application uses a Nodemailer version earlier than 8.0.9 and whether it sets list header comment fields from user-controlled or otherwise untrusted data. Review generated message headers for unexpected additional headers when comment values contain CRLF characters.