CVE-2026-82661

Name of the Vulnerable Software and Affected Versions Nodemailer versions prior to 8.0.9

Description Nodemailer fails to sanitize carriage return (CR) and line feed (LF) characters in list comment fields. An attacker who can influence the list.*.comment parameters can inject CRLF sequences to create additional headers in generated RFC822 messages. This occurs because the list.*.comment field is inserted into prepared header values that bypass the normal header-value sanitizer and are passed to the mimeFuncs.foldLines() function. This can alter mail client behavior and message semantics by adding attacker-controlled metadata headers.

The affected parameters include list.help.comment, list.unsubscribe.comment, list.subscribe.comment, list.post.comment, list.owner.comment, list.archive.comment, and list.id.comment.

Recommendations Update Nodemailer to version 8.0.9 or later. As a temporary workaround, restrict or sanitize user input provided to the list.*.comment parameters to ensure they do not contain CR or LF characters.