Description

Nodemailer before 8.0.9 fails to sanitize carriage return and line feed characters in list comment fields, allowing attackers to inject arbitrary message headers. An attacker with control over list.*.comment parameters can inject CRLF sequences to create additional headers in generated RFC822 messages, altering mail client behavior and message semantics.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-31T09:17:03.940Z",
  "pubdate": "2026-08-31T09:17:03.940Z",
  "executiveSummary": "Nodemailer versions prior to 8.0.9 are vulnerable to a header injection flaw due to improper sanitization of input data. The vulnerability arises when handling list comment fields, where the application fails to strip carriage return (CR) and line feed (LF) characters. This security deficiency allows an attacker to inject arbitrary RFC822 mail headers into generated messages. By manipulating these parameters, a remote attacker can alter the semantics of an email, potentially tricking mail clients or downstream security systems. The impact includes email spoofing, manipulation of delivery paths, or bypassing security filters that rely on header integrity. No specialized authentication is required, as the vulnerability resides in the way the library processes provided parameters. Organizations using affected versions of Nodemailer to process dynamic list comments are exposed to these risks until the library is updated to version 8.0.9 or higher.",
  "technicalDetails": "The vulnerability is a classic CRLF injection flaw located within the message composition logic of Nodemailer. The root cause is the insufficient validation and sanitization of the list.*.comment parameters before they are serialized into the RFC822 email format. SMTP and MIME protocols rely on CRLF sequences (\\r\\n) to delimit headers and separate them from the message body.\nWhen an application utilizes Nodemailer to generate outgoing emails, it often maps input parameters to specific mail headers. If the input provided to the list comment fields contains CRLF sequences, the library fails to encode or neutralize these control characters. Consequently, an attacker can supply a crafted payload containing injected newline characters followed by arbitrary header fields (e.g., 'Bcc:', 'Subject:', or 'Content-Type:').\nThe attack flow proceeds as follows: 1) The attacker identifies an input vector that maps to the list comment field in an application using an affected version of Nodemailer. 2) The attacker submits a payload structured as 'CommentValue\\r\\nInjected-Header: Value'. 3) The underlying Nodemailer component processes this string and inadvertently places the 'Injected-Header: Value' on a new line within the final message structure. 4) The resulting RFC822 message is transmitted to the mail server with the attacker-controlled headers fully active. Because the mail server and the recipient's mail user agent (MUA) process the headers sequentially, the injected fields take precedence or augment the existing message structure.\nThe post-exploitation impact is significant. By injecting a 'Bcc:' header, an attacker may force the mail server to blindly relay sensitive information to an unauthorized third party. Furthermore, manipulating 'Content-Type' or 'Reply-To' headers can facilitate sophisticated phishing attacks, bypass SPF/DKIM validation logic in certain configurations, or deceive users by modifying the perceived origin or nature of the communication. The vulnerability is strictly an input handling issue within the library, independent of the underlying network protocol (SMTP), and does not require elevated privileges, provided the application allows user-controlled content to reach the affected library parameters."
}