GHSA-2x76-7hhq-pgvwPublished
Nodemailer before 8.0.4 SMTP Command Injection via envelope.size
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-82854 · Microsoft / collected KEV context
cve-program · CVE-2026-82854
- https://github.com/nodemailer/nodemailer/security/advisories/GHSA-c7w3-x93f-qmm8
- https://www.vulncheck.com/advisories/nodemailer-before-8.0.3-smtp-command-injection-via-envelope-size
euvd · EUVD-2026-68442
- https://github.com/nodemailer/nodemailer/security/advisories/GHSA-c7w3-x93f-qmm8
- https://www.vulncheck.com/advisories/nodemailer-before-8.0.3-smtp-command-injection-via-envelope-size
nvd · CVE-2026-82854
- https://github.com/nodemailer/nodemailer/security/advisories/GHSA-c7w3-x93f-qmm8
- https://www.vulncheck.com/advisories/nodemailer-before-8.0.3-smtp-command-injection-via-envelope-size
osv · GHSA-c7w3-x93f-qmm8
Related operational evidence
Explicit CVE identifiers- Nodemailer before 8.0.4 SMTP Command Injection via envelope.size · Affected-version evidence changed · 29 Oct 2026