PT-2026-83730
CVE-2026-82853
·
تاريخ النشر
2026-04-08
·
تاريخ التحديث
2026-09-01
الوصف من
CVSS 4.0
6.9
متوسطةالمقاييسAV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
Nodemailer versions prior to 8.0.5
Description
An SMTP command injection issue exists in the transport
name configuration option used in EHLO, HELO, and LHLO commands. The name parameter is concatenated directly into SMTP commands without sanitizing carriage return and line feed (CRLF) characters. An attacker capable of influencing this option can inject arbitrary SMTP commands, enabling unauthorized email sending, email spoofing, and phishing attacks. This occurs within the lib/smtp-connection/index.js file during connection initialization, where the sendCommand() function writes the string directly to the socket.Recommendations
Update Nodemailer to version 8.0.5 or later.
As a temporary workaround, restrict or sanitize any external input used to configure the
name transport option to ensure it does not contain CRLF sequences. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾