Nodemailer before 8.0.5 SMTP Command Injection via CRLF

CISA KEV lists vulnerabilities known to be exploited. FIRST EPSS estimates the likelihood of exploitation in the next 30 days. An unavailable score does not mean zero risk.

No exploitation or prediction data is available here for these CVEs. This does not mean they are safe or unlikely to be exploited.

Nodemailer versions before 8.0.5 contain an SMTP command injection vulnerability in the transport name option used in EHLO/HELO commands. The name parameter is concatenated directly into SMTP commands without sanitizing carriage return and line feed characters, allowing attackers to inject arbitrary SMTP commands for email spoofing and phishing attacks.

Source published

31 Aug 2026 08:46:27 UTC

Source modified

31 Aug 2026 11:00:28 UTC

Saved here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

Source: cve-program · CVE Program Terms of Use. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS 4.0 · 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

CVSS 3.1 · 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Nodemailer versions before 8.0.5 contain an SMTP command injection vulnerability in the transport name option used in EHLO/HELO commands. The name parameter is concatenated directly into SMTP commands without sanitizing carriage return and line feed characters, allowing attackers to inject arbitrary SMTP commands for email spoofing and phishing attacks.

Source published

Aug 31, 2026, 8:46:27 AM (timezone not stated)

Source modified

Aug 31, 2026, 11:00:28 AM (timezone not stated)

Saved here

13 Nov 2026 18:01:52 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

Source: euvd · ENISA EUVD · source terms and attribution apply. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

EUVD CVSS 4.0 · 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Nodemailer versions before 8.0.5 contain an SMTP command injection vulnerability in the transport name option used in EHLO/HELO commands. The name parameter is concatenated directly into SMTP commands without sanitizing carriage return and line feed characters, allowing attackers to inject arbitrary SMTP commands for email spoofing and phishing attacks.

Source published

31 Aug 2026 09:17:05 UTC

Source modified

10 Sep 2026 15:48:28 UTC

Saved here

25 Oct 2026 16:19:10 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

Source: nvd · NIST NVD usage terms; underlying source attribution retained. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS 4.0 · [email protected] · Secondary · 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS 3.1 · [email protected] · Secondary · 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

### Summary Nodemailer versions up to and including 8.0.4 are vulnerable to SMTP command injection via CRLF sequences in the transport `name` configuration option. The `name` value is used directly in the EHLO/HELO SMTP command without any sanitization for carriage return and line feed characters (`\r\n`). An attacker who can influence this option can inject arbitrary SMTP commands, enabling unauthorized email sending, email spoofing, and phishing attacks. ### Details The vulnerability exists in `lib/smtp-connection/index.js`. When establishing an SMTP connection, the `name` option is concatenated directly into the EHLO command: ```javascript // lib/smtp-connection/index.js, line 71 this.name = this.options.name || this._getHostname(); // line 1336 this._sendCommand('EHLO ' + this.name); ``` The `_sendCommand` method writes the string directly to the socket followed by `\r\n` (line 1082): ```javascript this._socket.write(Buffer.from(str + '\r\n', 'utf-8')); ``` If the `name` option contains `\r\n` sequences, each injected line is interpreted by the SMTP server as a separate command. Unlike the `envelope.from` and `envelope.to` fields which are validated for `\r\n` (line 1107-1119), and unlike `envelope.size` which was recently fixed (GHSA-c7w3-x93f-qmm8) by casting to a number, the `name` parameter receives no CRLF sanitization whatsoever. This is distinct from the previously reported GHSA-c7w3-x93f-qmm8 (envelope.size injection) as it affects a different parameter (`name` vs `size`), uses a different injection point (EHLO command vs MAIL FROM command), and occurs at connection initialization rather than during message sending. The `name` option is also used in HELO (line 1384) and LHLO (line 1333) commands with the same lack of sanitization. ### PoC ```javascript const nodemailer = require('nodemailer'); const net = require('net'); // Simple SMTP server to observe injected commands const server = net.createServer(socket => { socket.write('220 test ESMTP\r\n'); socket.on('data', data => { const lines = data.toString().split('\r\n').filter(l => l); lines.forEach(line => { console.log('SMTP CMD:', line); if (line.startsWith('EHLO') || line.startsWith('HELO')) socket.write('250 OK\r\n'); else if (line.startsWith('MAIL FROM')) socket.write('250 OK\r\n'); else if (line.startsWith('RCPT TO')) socket.write('250 OK\r\n'); else if (line === 'DATA') socket.write('354 Go\r\n'); else if (line === '.') socket.write('250 OK\r\n'); else if (line === 'QUIT') { socket.write('221 Bye\r\n'); socket.end(); } else if (line === 'RSET') socket.write('250 OK\r\n'); }); }); }); server.listen(0, '127.0.0.1', () => { const port = server.address().port; // Inject a complete phishing email via EHLO name const transport = nodemailer.createTransport({ host: '127.0.0.1', port: port, secure: false, name: 'legit.host\r\nMAIL FROM:<[email protected]>\r\n' + 'RCPT TO:<[email protected]>\r\nDATA\r\n' + 'From: [email protected]\r\nTo: [email protected]\r\n' + 'Subject: Urgent\r\n\r\nPhishing content\r\n.\r\nRSET' }); transport.sendMail({ from: '[email protected]', to: '[email protected]', subject: 'Normal email', text: 'Normal content' }, () => { server.close(); process.exit(0); }); }); ``` Running this PoC shows the SMTP server receives the injected MAIL FROM, RCPT TO, DATA, and phishing email content as separate SMTP commands before the legitimate email is sent. ### Impact **Who is affected:** Applications that allow users or external input to configure the `name` SMTP transport option. This includes: - Multi-tenant SaaS platforms with per-tenant SMTP configuration - Admin panels where SMTP hostname/name settings are stored in databases - Applications loading SMTP config from environment variables or external sources **What can an attacker do:** 1. **Send unauthorized emails** to arbitrary recipients by injecting MAIL FROM and RCPT TO commands 2. **Spoof email senders** by injecting arbitrary From headers in the DATA portion 3. **Conduct phishing attacks** using the legitimate SMTP server as a relay 4. **Bypass application-level controls** on email recipients, since the injected commands are processed before the application's intended MAIL FROM/RCPT TO 5. **Perform SMTP reconnaissance** by injecting commands like VRFY or EXPN The injection occurs at the EHLO stage (before authentication in most SMTP flows), making it particularly dangerous as the injected commands may be processed with the server's trust context. **Recommended fix:** Sanitize the `name` option by stripping or rejecting CRLF sequences, similar to how `envelope.from` and `envelope.to` are already validated on lines 1107-1119 of `lib/smtp-connection/index.js`. For example: ```javascript this.name = (this.options.name || this._getHostname()).replace(/[\r\n]/g, ''); ```

Source published

8 Apr 2026 15:05:20 UTC

Source modified

10 Sep 2026 03:51:03 UTC

Saved here

24 Oct 2026 13:17:17 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

Source: osv · GitHub Advisory Database · CC-BY-4.0. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Publisher rating · MODERATE