CVE-2026-82854
Received Received - Intake

SMTP Command Injection in Nodemailer

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: VulnCheck

Description
Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.size parameter. When an application passes a custom envelope object with a size property containing CRLF characters to sendMail(), the value is concatenated into the SMTP MAIL FROM command (as SIZE=...) without sanitization, allowing injection of arbitrary SMTP commands such as RCPT TO to silently add attacker-controlled recipients. Exploitation requires the application to expose the envelope size to attacker-controlled input, as Nodemailer does not include size in the default auto-constructed envelope.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-82854
EUVD
EUVD-2026-68442

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
nodemailer nodemailer to 8.0.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-93 The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Nodemailer before version 8.0.4 has a vulnerability where the envelope.size parameter is not sanitized. Attackers can inject CRLF characters into this parameter to manipulate SMTP commands like adding unauthorized recipients via RCPT TO without detection.

Detection Guidance

To detect this vulnerability, inspect your application's use of Nodemailer's sendMail() function for custom envelope objects containing a size property. Check if the size value includes CRLF characters or if user input is passed directly to the envelope.size parameter without sanitization.

Impact Analysis

This vulnerability allows attackers to silently add themselves as recipients to emails sent through your application. This could lead to unauthorized data access, information leakage, or further attacks using your email infrastructure.

Compliance Impact

This vulnerability could violate GDPR by enabling unauthorized data access or disclosure, and HIPAA by allowing protected health information to be sent to unintended recipients. Compliance may be compromised due to lack of data integrity and confidentiality.

Mitigation Strategies

Immediately upgrade Nodemailer to version 8.0.4 or later. If upgrading is not possible, ensure any custom envelope.size values are sanitized to remove CRLF characters before passing them to sendMail(). Avoid exposing envelope configuration to user-controlled input.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82854. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart