CVE-2026-82854

Name of the Vulnerable Software and Affected Versions Nodemailer versions prior to 8.0.4

Description An SMTP command injection issue exists when a custom envelope object is passed to the sendMail() function. If the size property within this object contains CRLF (Carriage Return Line Feed) characters, the value is concatenated directly into the SMTP MAIL FROM command without sanitization. This allows an attacker to terminate the current command and inject arbitrary SMTP commands, such as RCPT TO, to silently add unauthorized recipients to outgoing emails. This issue occurs because the size property is not validated for CRLF characters, unlike other envelope parameters. Exploitation is possible only if the application explicitly provides a custom envelope object and exposes the size parameter to attacker-controlled input, as it is not included in the default auto-constructed envelope.

Recommendations Update Nodemailer to version 8.0.4 or later. As a temporary workaround, avoid using the size parameter within the envelope object in the sendMail() function if the input is user-controlled.