Skip to main content

Nodemailer EUVDEUVD-2026-68439

| CVE-2026-82661 MEDIUM
Improper Neutralization of CRLF Sequences ('CRLF Injection') (CWE-93)
2026-08-31 VulnCheck GHSA-2jv2-wqrj-g6x7
Code Injection Nodemailer Red Hat Suse
5.3
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
5.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.4 MEDIUM

Network-accessible injection but PR:L required to control list comment parameters; no availability impact; integrity/confidentiality limited to generated message headers.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
SUSE
5.4 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Red Hat
5.4 MEDIUM
qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

4
CVE Published
Aug 31, 2026 - 10:50 cve.org
MEDIUM 5.3
Patch available
Aug 31, 2026 - 10:16 EUVD
Source Code Evidence Fetched
Aug 31, 2026 - 09:35 vuln.today
Analysis Generated
Aug 31, 2026 - 09:35 vuln.today

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 10 npm packages depend on nodemailer (8 direct, 3 indirect)

Ecosystem-wide dependent count for version 8.0.9.

DescriptionCVE.org

Nodemailer before 8.0.9 fails to sanitize carriage return and line feed characters in list comment fields, allowing attackers to inject arbitrary message headers. An attacker with control over list.*.comment parameters can inject CRLF sequences to create additional headers in generated RFC822 messages, altering mail client behavior and message semantics.

AnalysisAI

CRLF injection in Nodemailer's List-* header construction allows any application-level user with control over list comment parameters to inject arbitrary RFC822 message headers into outbound emails. Versions up to and including 8.0.8 of the npm package are affected; the fix is available in 8.0.9. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that the target application passes user-controllable data into at least one of the following Nodemailer list comment fields: list.help.comment, list.unsubscribe.comment, list.subscribe.comment, list.post.comment, list.owner.comment, list.archive.comment, or list.id.comment. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and score of 5.3 accurately reflect moderate, network-accessible risk with a low-privilege prerequisite. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Vendor-released patch: Nodemailer 8.0.9. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Nodemailer

View all
CVE-2020-7769 CRITICAL POC
9.8 Nov 12

This affects the package nodemailer before 6.4.16. Rated critical severity (CVSS 9.8), this vulnerability is remotely ex
CVE-2021-23400 HIGH POC
8.8 Jun 29

The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain n
CVE-2026-82854 CRITICAL
9.3 Aug 31

SMTP command injection in Nodemailer before 8.0.4 lets attackers smuggle arbitrary SMTP verbs (notably RCPT TO) into out
CVE-2026-82662 HIGH
8.3 Aug 31

TLS certificate verification is disabled by hardcoded `rejectUnauthorized: false` in Nodemailer's internal HTTPS fetch c
CVE-2026-82659 HIGH POC
7.1 Aug 31

Sandbox bypass in nodemailer <= 9.0.0 exposes arbitrary file read and full-response SSRF to any authenticated applicatio
CVE-2026-82853 MEDIUM
6.9 Aug 31

SMTP command injection in Nodemailer (npm) versions up to and including 8.0.4 allows an attacker who can influence the t
CVE-2026-82660 MEDIUM
5.3 Aug 31

Nodemailer's jsonTransport transport fails to enforce disableFileAccess and disableUrlAccess controls during message nor

Same weakness CWE-93 – Improper Neutralization of CRLF Sequences ('CRLF Injection')

View all
CVE-2016-3115 MEDIUM POC
6.4
CVE-2021-39172 HIGH POC
8.8
CVE-2026-23953 HIGH POC
8.7
CVE-2026-54511 HIGH POC
8.6
CVE-2026-70615 HIGH POC
8.5
CVE-2024-45302 HIGH POC
7.8
CVE-2017-5868 MEDIUM POC
6.1
CVE-2026-21428 HIGH POC
7.5

Same technique Code Injection

View all
CVE-2023-3519 CRITICAL POC
9.8
CVE-2021-22205 CRITICAL POC
10.0
CVE-2024-23692 CRITICAL POC
9.8
CVE-2012-0158 HIGH POC
8.8
CVE-2021-44529 CRITICAL POC
9.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2025-24893 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 12 Not-Affected
SUSE Linux Enterprise Micro 5.3 Affected
SUSE Linux Enterprise Micro 5.4 Affected
SUSE Linux Enterprise Micro 5.5 Not-Affected

Share

EUVD-2026-68439 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy