CVE-2026-82854: Nodemailer before 8.0.3 SMTP Command Injection via envelope.size
Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.size parameter. When an application passes a custom envelope object with a size property containing CRLF characters to sendMail(), the value is concatenated into the SMTP MAIL FROM command (as SIZE=...) without sanitization, allowing injection of arbitrary SMTP commands such as RCPT TO to silently add attacker-controlled recipients. Exploitation requires the application to expose the envelope size to attacker-controlled input, as Nodemailer does not include size in the default auto-constructed envelope.
Affected Software
Event History
Frequently Asked Questions
Are applications using Nodemailer’s default envelope construction exposed?
Not through this specific path. Nodemailer does not include size in its default auto-constructed envelope, so exploitation requires an application to pass a custom envelope object with a size property.
What must an attacker control to exploit the issue?
The attacker must be able to influence the custom envelope.size value supplied to sendMail() and include CRLF characters in it. Those characters can terminate the SIZE parameter in the SMTP MAIL FROM command and inject additional SMTP commands, including RCPT TO commands.
How can we determine whether our application is affected?
Review sendMail() usage for custom envelope objects and determine whether envelope.size can contain untrusted input. In particular, identify any path where an attacker-controlled value can reach envelope.size without rejecting CRLF characters.