CVE-2026-82853: Nodemailer before 8.0.5 SMTP Command Injection via CRLF

Severity: medium (CVSS 4.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-31 · updated 2026-09-10
Weakness: CWE-93

Description

Nodemailer versions before 8.0.5 contain an SMTP command injection vulnerability in the transport name option used in EHLO/HELO commands. The name parameter is concatenated directly into SMTP commands without sanitizing carriage return and line feed characters, allowing attackers to inject arbitrary SMTP commands for email spoofing and phishing attacks.

Affected products

nodemailer: before 8.0.5 — fixed in 8.0.5

How to fix

Upgrade to a fixed version: nodemailer 8.0.5. Check the vendor advisory for mitigations.

References

https://github.com/nodemailer/nodemailer/security/advisories/GHSA-vvjj-xcjg-gr5g
https://www.vulncheck.com/advisories/nodemailer-before-8.0.5-smtp-command-injection-via-crlf
https://github.com/nodemailer/nodemailer/security/advisories/GHSA-vvjj-xcjg-gr5g

Get alerted when CVE-2026-82853 or the next vulnerability affects your stack