CVE-2026-82661: Nodemailer CRLF Injection via List-* Header Comments

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-31 · updated 2026-09-10
Weakness: CWE-93

Description

Nodemailer before 8.0.9 fails to sanitize carriage return and line feed characters in list comment fields, allowing attackers to inject arbitrary message headers. An attacker with control over list.*.comment parameters can inject CRLF sequences to create additional headers in generated RFC822 messages, altering mail client behavior and message semantics.

Affected products

nodemailer: before 8.0.9 — fixed in 8.0.9

How to fix

Upgrade to a fixed version: nodemailer 8.0.9. Check the vendor advisory for mitigations.

References

https://github.com/nodemailer/nodemailer/security/advisories/GHSA-268h-hp4c-crq3
https://www.vulncheck.com/advisories/nodemailer-crlf-injection-via-list-header-comments
https://github.com/nodemailer/nodemailer/security/advisories/GHSA-268h-hp4c-crq3

Get alerted when CVE-2026-82661 or the next vulnerability affects your stack