CVE-2026-82853: Nodemailer before 8.0.5 SMTP Command Injection via CRLF
Nodemailer versions before 8.0.5 contain an SMTP command injection vulnerability in the transport name option used in EHLO/HELO commands. The name parameter is concatenated directly into SMTP commands without sanitizing carriage return and line feed characters, allowing attackers to inject arbitrary SMTP commands for email spoofing and phishing attacks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
nodemailerto a version that resolves this vulnerability.Fixed in 8.0.5
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using Nodemailer versions before 8.0.5 are exposed if an attacker with the required high privileges can control the SMTP transport name option used in EHLO or HELO commands.
What can an attacker do if they exploit it?
By supplying carriage return and line feed characters in the transport name, an attacker can inject arbitrary SMTP commands. The stated impact is email spoofing and phishing; confidentiality and availability impact are not indicated.
What should teams change to remediate the vulnerability?
Upgrade Nodemailer to version 8.0.5 or later. The affected behavior is the unsanitized concatenation of the transport name into SMTP commands, so do not allow untrusted values containing CR or LF characters in that option.