Skip to main content

Nodemailer CVE-2026-82853

| EUVDEUVD-2026-68441 MEDIUM
Improper Neutralization of CRLF Sequences ('CRLF Injection') (CWE-93)
2026-08-31 VulnCheck GHSA-q8rv-95x3-46j5
Command Injection Nodemailer
6.9
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
6.9 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
4.9 MEDIUM

PR:H because exploitation requires operator-level control of the transport name option; integrity-only impact via arbitrary SMTP command injection with no confidentiality or availability effect.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE
4.9 MEDIUM
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Red Hat
4.9 MEDIUM
qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
X

Lifecycle Timeline

4
CVE Published
Aug 31, 2026 - 10:50 cve.org
MEDIUM 6.9
Patch available
Aug 31, 2026 - 10:16 EUVD
Source Code Evidence Fetched
Aug 31, 2026 - 09:34 vuln.today
Analysis Generated
Aug 31, 2026 - 09:34 vuln.today

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 91 npm packages depend on nodemailer (54 direct, 41 indirect)

Ecosystem-wide dependent count for version 8.0.5.

DescriptionCVE.org

Nodemailer versions before 8.0.5 contain an SMTP command injection vulnerability in the transport name option used in EHLO/HELO commands. The name parameter is concatenated directly into SMTP commands without sanitizing carriage return and line feed characters, allowing attackers to inject arbitrary SMTP commands for email spoofing and phishing attacks.

AnalysisAI

SMTP command injection in Nodemailer (npm) versions up to and including 8.0.4 allows an attacker who can influence the transport name configuration option to inject arbitrary SMTP commands by embedding CRLF sequences in the value. The EHLO, HELO, and LHLO commands are constructed via direct string concatenation in lib/smtp-connection/index.js without sanitization, enabling unauthorized email sending, spoofing, and phishing through the configured SMTP relay. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The attacker must be able to supply or influence the `name` option in the Nodemailer transport configuration - the string used to identify the local host in EHLO/HELO commands. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 base score of 6.9 with PR:H accurately reflects the principal limiting factor: exploitation requires that an attacker control the transport `name` configuration option, which is an operator- or developer-level parameter not typically exposed to unauthenticated end-users. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade Nodemailer to version 8.0.5 or later, which sanitizes the `name` transport option against CRLF sequences. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Nodemailer

View all
CVE-2020-7769 CRITICAL POC
9.8 Nov 12

This affects the package nodemailer before 6.4.16. Rated critical severity (CVSS 9.8), this vulnerability is remotely ex
CVE-2021-23400 HIGH POC
8.8 Jun 29

The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain n
CVE-2026-82659 HIGH POC
7.1 Aug 31

Sandbox bypass in nodemailer <= 9.0.0 exposes arbitrary file read and full-response SSRF to any authenticated applicatio
CVE-2026-82854 CRITICAL
9.3 Aug 31

SMTP command injection in Nodemailer before 8.0.4 lets attackers smuggle arbitrary SMTP verbs (notably RCPT TO) into out
CVE-2026-82662 HIGH
8.3 Aug 31

TLS certificate verification is disabled by hardcoded `rejectUnauthorized: false` in Nodemailer's internal HTTPS fetch c
CVE-2026-82661 MEDIUM
5.3 Aug 31

CRLF injection in Nodemailer's List-* header construction allows any application-level user with control over list comme
CVE-2026-82660 MEDIUM
5.3 Aug 31

Nodemailer's jsonTransport transport fails to enforce disableFileAccess and disableUrlAccess controls during message nor
CVE-2026-3455 LOW POC
2.0 Mar 03

Versions of the package mailparser versions up to 3.9.3 is affected by cross-site scripting (xss) (CVSS 6.1).

Same weakness CWE-93 – Improper Neutralization of CRLF Sequences ('CRLF Injection')

View all
CVE-2016-3115 MEDIUM POC
6.4
CVE-2026-84372 CRITICAL POC
9.8
CVE-2021-39172 HIGH POC
8.8
CVE-2026-23953 HIGH POC
8.7
CVE-2026-54511 HIGH POC
8.6
CVE-2026-70615 HIGH POC
8.5
CVE-2024-45302 HIGH POC
7.8
CVE-2017-5868 MEDIUM POC
6.1

Same technique Command Injection

View all
CVE-2024-21887 CRITICAL POC
9.1
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2024-55956 CRITICAL POC
9.8
CVE-2018-11138 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 12 Not-Affected
SUSE Linux Enterprise Micro 5.3 Affected
SUSE Linux Enterprise Micro 5.4 Affected
SUSE Linux Enterprise Micro 5.5 Not-Affected

Share

CVE-2026-82853 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy