Nodemailer CVE-2026-82661

Exploitation requires that the target application passes user-controllable data into at least one of the following Nodemailer list comment fields: list.help.comment, list.unsubscribe.comment, list.subscribe.comment, list.post.comment, list.owner.comment, list.archive.comment, or list.id.comment. The attacker must be able to supply a string containing a CR (\r) or LF (\n) character in that field. Applications that hardcode all list.* values from static configuration, or that fully strip newline characters from user input before constructing the options object, are not exploitable. Limiting factors include: the CVSS PR:L requirement (attacker must have application-level access to influence sendMail parameters), and the fact that the injection only affects the outbound generated message - it does not enable server-side code execution or filesystem access.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and score of 5.3 accurately reflect moderate, network-accessible risk with a low-privilege prerequisite. The PR:L metric is key: exploitation requires that an attacker be able to influence the list comment parameters passed to Nodemailer's sendMail() call, which in practice means the attacker has some foothold in the application layer - not arbitrary unauthenticated internet access. Applications that hardcode list comment values are entirely unaffected. No EPSS data was provided in the input, preventing quantitative probability comparison, and the CVE is absent from the CISA KEV catalog with no public exploit code identified, all of which reduce urgency. The real-world risk is primarily mail spoofing, spam filter bypass, phishing header injection, or anti-spam policy evasion rather than system compromise. The VC:L/VI:L impact metrics correctly reflect bounded message-level integrity and limited confidentiality consequences rather than full system access.

An attacker with a low-privilege account in a web application that assembles Nodemailer sendMail() options from user-supplied data crafts a list.unsubscribe.comment value containing an embedded CRLF sequence followed by a forged header such as 'X-Spam-Status: No'. Nodemailer inserts this unsanitized comment into the List-Unsubscribe prepared header, causing the generated RFC822 message to contain the injected header, which mail clients or gateways then parse as a legitimate message field - enabling spam filter bypass or recipient spoofing. No public exploit code has been identified, so exploitation currently requires manual construction of the malicious parameter.