CVE-2026-82853
Received Received - Intake

Nodemailer SMTP Command Injection via EHLO/HELO

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: VulnCheck

Description
Nodemailer versions before 8.0.5 contain an SMTP command injection vulnerability in the transport name option used in EHLO/HELO commands. The name parameter is concatenated directly into SMTP commands without sanitizing carriage return and line feed characters, allowing attackers to inject arbitrary SMTP commands for email spoofing and phishing attacks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-82853
EUVD
EUVD-2026-68441

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
nodemailer nodemailer to 8.0.5 (exc)
nodemailer nodemailer to 8.0.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-93 The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Nodemailer versions before 8.0.5 have a flaw where the transport name option used in SMTP EHLO/HELO commands is not sanitized for carriage return and line feed characters. This allows attackers to inject arbitrary SMTP commands by manipulating the name parameter, enabling email spoofing and phishing attacks.

Detection Guidance

Check Nodemailer version with npm list nodemailer. If version is <=8.0.4, the system is vulnerable. Inspect SMTP transport configurations for user-controlled 'name' parameters in EHLO/HELO commands. Monitor SMTP server logs for unusual commands or unexpected email activity.

Impact Analysis
  • Attackers can send unauthorized emails using your server, spoof sender addresses to impersonate you or others, and launch phishing campaigns to deceive recipients.
  • The vulnerability occurs early in the SMTP process, often before authentication, making it harder to detect and block.
  • Attackers may perform SMTP reconnaissance to gather information about your mail server configuration.
Compliance Impact

This vulnerability could lead to unauthorized email transmissions, potentially violating data protection requirements under GDPR (e.g., unauthorized processing of personal data) and HIPAA (e.g., unauthorized transmission of protected health information). Organizations may face compliance breaches if attackers misuse the flaw to send phishing emails or exfiltrate data.

Mitigation Strategies

Upgrade Nodemailer to version 8.0.5 or later immediately. Sanitize the 'name' parameter by stripping CRLF characters if custom SMTP configurations are used. Restrict user input in SMTP transport settings to prevent command injection.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82853. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart