GHSA-gmgm-r6fh-fq6g: zbateson mail-mime-parser before 3.0.9 and 4.x before 4.0.6 CRLF Header Injection via Message Builders

Published Nov 4, 2026

Updated

zbateson mail-mime-parser before 3.0.9 and 4.x before 4.0.6 contains a CRLF header injection vulnerability in message-building helpers that fail to strip CR and LF characters. Attackers supplying crafted MIME type, charset, encoding, micalg, or protocol values can inject extra header lines such as a forged Bcc into outgoing messages.

Event History

Nov 4, 2026

CVE Published

via OSV·12:31 PM

Data Sourced

via OSV·12:31 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which applications are exposed to this issue?

Applications using affected versions of zbateson mail-mime-parser are exposed when they pass attacker-controlled values into message-building helpers for MIME type, charset, encoding, micalg, or protocol fields. The issue affects versions before 3.0.9 and 4.x versions before 4.0.6.

What does an attacker need to exploit it?

An attacker needs a way to supply crafted values for one of the affected message parameters. By including CR and LF characters, they can cause additional email header lines to be inserted, such as a forged Bcc header.

Are applications that only parse incoming email affected?

The described vulnerable functionality is in message-building helpers used to create outgoing messages. The provided data does not identify parsing of incoming email as the affected path.

How can I determine whether an application may already be vulnerable?

Review code that builds email messages with this library and identify whether MIME type, charset, encoding, micalg, or protocol values can originate from untrusted input. Confirm the deployed library version is 3.0.9 or later for the 3.x line, or 4.0.6 or later for the 4.x line.

GHSA-gmgm-r6fh-fq6g: zbateson mail-mime-parser before 3.0.9 and 4.x before 4.0.6 CRLF Header Injection via Message Builders

Event History

Frequently Asked Questions

Which applications are exposed to this issue?

What does an attacker need to exploit it?

Are applications that only parse incoming email affected?

How can I determine whether an application may already be vulnerable?

Company

Resources

Contact

Frequently Asked Questions

Which applications are exposed to this issue?

What does an attacker need to exploit it?

Are applications that only parse incoming email affected?

How can I determine whether an application may already be vulnerable?