Nodemailer CVE-2026-82853

The attacker must be able to supply or influence the name option in the Nodemailer transport configuration - the string used to identify the local host in EHLO/HELO commands. This occurs when application code accepts external input (user-submitted hostname, tenant name, environment variable, or similar) and passes it to the Nodemailer transport constructor's name field without stripping \r or \n characters. The CVSS PR:H metric reflects that this configuration value is ordinarily a developer- or operator-controlled parameter, not directly reachable by unauthenticated end-users in a standard deployment. Exploitation is further limited to Node.js applications specifically using Nodemailer for outbound SMTP. Applications that hard-code a static hostname string in the transport name option are not exploitable regardless of patch status. No special network position, non-default feature flags, or specific SMTP server implementations are required beyond basic SMTP relay connectivity.

The CVSS 4.0 base score of 6.9 with PR:H accurately reflects the principal limiting factor: exploitation requires that an attacker control the transport name configuration option, which is an operator- or developer-level parameter not typically exposed to unauthenticated end-users. This substantially narrows the real-world attack surface compared to a PR:N flaw. That said, applications that accept user-supplied hostnames, tenant identifiers, or other strings and pass them into Nodemailer transport options without sanitization are directly exposed. A proof-of-concept is embedded in the GHSA advisory, lowering the skill bar for exploitation in such scenarios. No CISA KEV listing exists, and EPSS data was not provided in the input - exploitation appears opportunistic rather than widespread at time of analysis. The integrity-only impact (VI:H, VC:N, VA:N) reflects that a successful attack enables email spoofing and phishing via the relay rather than host compromise. Overall: moderate priority for applications where user-controlled data flows into Nodemailer transport configuration; low priority elsewhere.

An application accepts a user-supplied hostname or tenant label and passes it unsanitized to the Nodemailer transport name option. An attacker submits a value containing embedded CRLF sequences such as attacker.example\r\nMAIL FROM:<spoof@victim.com>\r\nRCPT TO:<target@example.com>\r\nDATA\r\n. When Nodemailer connects and issues EHLO, the SMTP relay processes each injected line as a discrete command, sending an unauthorized email on behalf of the spoofed sender. A working proof-of-concept demonstrating this command injection, including a minimal local SMTP observer, is included in GHSA-vvjj-xcjg-gr5g.