Description

Nodemailer versions before 8.0.5 contain an SMTP command injection vulnerability in the transport name option used in EHLO/HELO commands. The name parameter is concatenated directly into SMTP commands without sanitizing carriage return and line feed characters, allowing attackers to inject arbitrary SMTP commands for email spoofing and phishing attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.9",
  "pubDate": "2026-08-31T09:17:05.320Z",
  "pubdate": "2026-08-31T09:17:05.320Z",
  "executiveSummary": "Nodemailer versions prior to 8.0.5 are susceptible to an SMTP command injection vulnerability arising from improper input sanitization within the EHLO/HELO transport configuration.\nThe vulnerability resides in the application's failure to sanitize carriage return (CR) and line feed (LF) characters when processing the 'name' parameter for SMTP greeting commands.\nThis flaw allows a remote attacker to inject arbitrary SMTP commands into the communication stream between the application and the mail server.\nSuccessful exploitation enables email spoofing and the delivery of phishing content by manipulating the underlying SMTP conversation.\nThe vulnerability presents a significant risk to email integrity and sender authenticity, potentially allowing attackers to bypass security filters or misrepresent the source of transmitted messages.\nNo specific authentication is required by the attacker if they can influence the transport 'name' configuration, which is then utilized by the vulnerable library.",
  "technicalDetails": "The root cause of this vulnerability is an insufficient sanitization mechanism within the Nodemailer library concerning the 'name' option provided during the initialization of the SMTP transport. This parameter is intended to define the hostname used in the EHLO or HELO command sent to the receiving mail server.\nBecause the input is not validated for CRLF (Carriage Return and Line Feed, represented as \\r\\n) sequences, an attacker who controls the input passed to the 'name' option can terminate the intended EHLO/HELO command prematurely and append arbitrary SMTP commands.\nThe attack flow proceeds as follows: An attacker provides a crafted string containing CRLF sequences followed by malicious SMTP commands, such as 'MAIL FROM:', 'RCPT TO:', or 'DATA', within the transport 'name' field. When Nodemailer executes the communication handshake, it concatenates this input directly into the SMTP stream. The underlying TCP socket interprets the injected CRLF characters as command delimiters, forcing the mail server to process the attacker's injected commands as legitimate parts of the SMTP dialogue.\nThis vulnerability effectively breaks the protocol-level encapsulation. By injecting additional commands, the attacker can manipulate the 'MAIL FROM' header, potentially spoofing sender addresses to deceive recipients. Furthermore, by injecting 'DATA' commands, an attacker could attempt to insert their own content into the email body, facilitating phishing campaigns.\nThe issue affects versions of Nodemailer before 8.0.5. The vulnerability is network-exposed as it impacts the interaction between the application server and the SMTP relay. No elevated privileges are explicitly required beyond the ability to influence the configuration of the SMTP transport component. Post-exploitation impact includes unauthorized email origination, reputation damage to the legitimate sender domain, and increased success rates for social engineering attacks due to the bypass of standard email delivery protocols."
}