CVE-2026-82661
Received Received - Intake

Nodemailer SMTP Header Injection via CRLF in List Comments

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: VulnCheck

Description
Nodemailer before 8.0.9 fails to sanitize carriage return and line feed characters in list comment fields, allowing attackers to inject arbitrary message headers. An attacker with control over list.*.comment parameters can inject CRLF sequences to create additional headers in generated RFC822 messages, altering mail client behavior and message semantics.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-82661
EUVD
EUVD-2026-68439

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
nodemailer nodemailer to 8.0.9 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-93 The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Nodemailer before version 8.0.9 has a flaw where it fails to properly sanitize carriage return (CR) and line feed (LF) characters in list comment fields. Attackers can exploit this by injecting CRLF sequences into these fields, which allows them to add arbitrary headers to RFC822 email messages. This manipulation can change how email clients or filters interpret the message.

Detection Guidance

To detect this vulnerability, check if your Nodemailer version is below 8.0.9. Run: npm list nodemailer. If the version is 8.0.8 or earlier, the system is vulnerable. Inspect email headers for unexpected CRLF sequences in List-* headers like List-Unsubscribe or List-ID.

Impact Analysis

An attacker could alter email metadata, such as adding fake headers or changing existing ones, which might trick email clients into misinterpreting the message. This could lead to phishing attempts, bypassing spam filters, or manipulating how recipients view the email. The impact depends on how the email is used and processed by recipients or systems.

Mitigation Strategies

Upgrade Nodemailer to version 8.0.9 or later immediately. If upgrading is not possible, sanitize all user-provided input in list.*.comment fields by removing CR and LF characters before header construction.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82661. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart