PT-2026-83730
CVE-2026-82853
·
Published
2026-04-08
·
Updated
2026-09-01
Description by
CVSS 4.0
6.9
MediumMetricsAV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
Nodemailer versions prior to 8.0.5
Description
An SMTP command injection issue exists in the transport
name configuration option used in EHLO, HELO, and LHLO commands. The name parameter is concatenated directly into SMTP commands without sanitizing carriage return and line feed (CRLF) characters. An attacker capable of influencing this option can inject arbitrary SMTP commands, enabling unauthorized email sending, email spoofing, and phishing attacks. This occurs within the lib/smtp-connection/index.js file during connection initialization, where the sendCommand() function writes the string directly to the socket.Recommendations
Update Nodemailer to version 8.0.5 or later.
As a temporary workaround, restrict or sanitize any external input used to configure the
name transport option to ensure it does not contain CRLF sequences. Found an issue in the description? Have something to add? Feel free to write us 👾