CVE-2026-82661

EUVD-2026-68439
Nodemailer before 8.0.9 fails to sanitize carriage return and line feed characters in list comment fields, allowing attackers to inject arbitrary message headers. An attacker with control over list.*.comment parameters can inject CRLF sequences to create additional headers in generated RFC822 messages, altering mail client behavior and message semantics.
CRLF Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
5.4 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 16.6%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
nodemailernodemailer
𝑥
< 8.0.9
CNA
Debian logo
Debian Releases
Debian Product
Codename
node-nodemailer
bookworm
postponed
forky
10.0.13+~8.0.2-1
fixed
sid
10.0.14+~8.0.2-1
fixed
trixie
no-dsa
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
node-nodemailer
focal
needs-triage
jammy
needs-triage
noble
needs-triage
resolute
needs-triage
Common Weakness Enumeration
References
https://github.com/nodemailer/nodemailer/security/advisories/GHSA-268h-hp4c-crq3
https://www.vulncheck.com/advisories/nodemailer-crlf-injection-via-list-header-comments
https://github.com/nodemailer/nodemailer/security/advisories/GHSA-268h-hp4c-crq3