CVE-2026-82854
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk80th percentile - higher than 80% of all known CVEs
Summary
Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.size parameter. When an application passes a custom envelope object with a size property containing CRLF characters to sendMail(), the value is concatenated into the SMTP MAIL FROM command (as SIZE=...) without sanitization, allowing injection of arbitrary SMTP commands such as RCPT TO to silently add attacker-controlled recipients.
Risk Assessment
Risk of sending emails to unauthorized recipients, potentially leading to information leakage or server misuse for phishing.
Recommendation
Update Nodemailer to version 8.0.4 or later and ensure the application does not pass attacker-controlled data to the envelope.size parameter.
Other vulnerabilities in Nodemailer
See all- GHSA-4g23-2xm8-66gcMedium
Nodemailer's SMTP client response parser reassembles multiline server replies by appending each continuation line onto a single response-queue entry and re-testing whether it is still a partial reply on every line. The partial-response test performs string operations per line, which can lead to inefficient processing.
- GHSA-2x7j-588g-ccc2High
Nodemailer's address parser parses comma-separated addresses in quadratic time (O(n²)) in the number of addresses. A single crafted address string (e.g., To, Cc, Bcc, From, Reply-To) can cause significant slowdown.
- GHSA-8vvx-rff5-p5rqMedium
A vulnerability exists in the nodemailer package (npm) affecting versions from 2.7.2 to 10.0.1. Details are not fully described in the provided snippet, but vulnerable versions are confirmed.
- GHSA-268h-hp4c-crq3Medium
A vulnerability in the Nodemailer library allows header injection via the `list.*.comment` field, which is not sanitized for CR (`\r`) and LF (`\n`) characters. An attacker can supply a malicious value in this field, leading to email header spoofing.
- GHSA-wqvq-jvpq-h66fMedium
A vulnerability in Nodemailer allows bypassing the `disableFileAccess` and `disableUrlAccess` options when using `jsonTransport`. While the normal MIME streaming path enforces these restrictions, `jsonTransport` serializes the message in a way that bypasses them, potentially enabling access to local files or external URLs.
- GHSA-p6gq-j5cr-w38fHigh
In nodemailer v9.0.0, the message-level `raw` option bypasses `disableFileAccess` and `disableUrlAccess` protections, enabling arbitrary file reads and full SSRF (Server-Side Request Forgery) in the sent message.
- GHSA-r7g4-qg5f-qqm2Medium
Nodemailer disables TLS certificate verification in its internal HTTPS fetch client by setting rejectUnauthorized: false in lib/fetch/index.js. This causes OAuth2 token requests to trust invalid or self-signed HTTPS certificates.
- GHSA-4ffr-jq9g-5ffxMedium
Nodemailer's SMTP client applies four regular expressions to a peer's EHLO response to detect supported SASL mechanisms. Each pattern uses overlapping whitespace-matching sub-patterns, producing quadratic (O(n^2)) backtracking on long mechanism names.
- GHSA-g73g-hqqh-jr95Medium
Nodemailer's address parser has three published, patched fixes for RFC 5322 comment handling inside an addr-spec. The description covers earlier issues with glued domain atoms and quoted local parts, plus related ReDoS fixes.
- GHSA-8m3c-c648-2xjjMedium
Nodemailer's disableFileAccess/disableUrlAccess options are a security sandbox that forbids untrusted message content from reading local files or making outbound HTTP(S) requests. The fix for GHSA-wqvq-jvpq-h66f may be incomplete, allowing bypass of the sandbox.
Original NVD description (English source)
Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.size parameter. When an application passes a custom envelope object with a size property containing CRLF characters to sendMail(), the value is concatenated into the SMTP MAIL FROM command (as SIZE=...) without sanitization, allowing injection of arbitrary SMTP commands such as RCPT TO to silently add attacker-controlled recipients. Exploitation requires the application to expose the envelope size to attacker-controlled input, as Nodemailer does not include size in the default auto-constructed envelope.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS