CVE-2026-82661

EUVD-2026-68439
Nodemailer before 8.0.9 fails to sanitize carriage return and line feed characters in list comment fields, allowing attackers to inject arbitrary message headers. An attacker with control over list.*.comment parameters can inject CRLF sequences to create additional headers in generated RFC822 messages, altering mail client behavior and message semantics.
CRLF Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
5.4 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 8.69%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
nodemailernodemailer
𝑥
< 8.0.9
CNA
Debian logo
Debian Releases
Debian Product
Codename
node-nodemailer
bookworm
vulnerable
bullseye
vulnerable
forky
9.0.5+~8.0.1-1
fixed
sid
9.0.6+~8.0.1-1
fixed
trixie
vulnerable
Common Weakness Enumeration
References
https://github.com/nodemailer/nodemailer/security/advisories/GHSA-268h-hp4c-crq3
https://www.vulncheck.com/advisories/nodemailer-crlf-injection-via-list-header-comments