Description

Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.size parameter. When an application passes a custom envelope object with a size property containing CRLF characters to sendMail(), the value is concatenated into the SMTP MAIL FROM command (as SIZE=...) without sanitization, allowing injection of arbitrary SMTP commands such as RCPT TO to silently add attacker-controlled recipients. Exploitation requires the application to expose the envelope size to attacker-controlled input, as Nodemailer does not include size in the default auto-constructed envelope.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-31T09:17:05.463Z",
  "pubdate": "2026-08-31T09:17:05.463Z",
  "executiveSummary": "A critical security vulnerability exists in Nodemailer versions prior to 8.0.4, where the application is susceptible to SMTP command injection. This vulnerability arises due to improper sanitization of the envelope.size parameter within the custom envelope object passed to the sendMail() function.\nIf an application allows user-controlled input to populate this parameter without adequate validation, an attacker can inject carriage return and line feed (CRLF) characters. This injection breaks the protocol context of SMTP, enabling the insertion of arbitrary SMTP commands such as RCPT TO.\nThe primary impact of this flaw is the potential for unauthorized mail relaying, allowing attackers to silently add recipients. Because Nodemailer does not include the size parameter in its default auto-constructed envelope, exploitation requires the application to explicitly expose this property to untrusted inputs.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient input validation of the size property within a custom envelope object passed to Nodemailer's sendMail() function. SMTP communication relies on line-oriented commands terminated by CRLF (\\r\\n) sequences. When Nodemailer processes a custom envelope, it appends the SIZE parameter to the MAIL FROM command.\nIn affected versions before 8.0.4, Nodemailer concatenates the size property directly into the SMTP stream without stripping or escaping CRLF characters. An attacker capable of influencing this value can inject these control characters to terminate the current SMTP command line prematurely and initiate new commands.\nThe attack flow proceeds as follows: First, the application receives untrusted input and assigns it to envelope.size. Second, sendMail() is called with this custom envelope. Third, Nodemailer writes the MAIL FROM command containing the raw, injected CRLF characters. Fourth, the SMTP server interprets the injected characters as command boundaries, executing subsequent payloads like RCPT TO or DATA. Finally, the email is sent to additional, unauthorized recipients.\nThis vulnerability requires no special privileges or authentication on the Nodemailer library level itself, but network exposure depends on how the host application structures its mail-sending workflows. Post-exploitation impacts include spoofing, data exfiltration, and bypass of mail routing policies."
}