CRLF Header Injection Vulnerability in zbateson Mail Mime Parser Software
CVE-2026-121946

6.9MEDIUM

Key Information:

Vendor

Zbateson

Status
Mail-mime-parser
Vendor
CVE Published:
4 November 2026

What is CVE-2026-121946?

The zbateson Mail Mime Parser software prior to specified versions is susceptible to a CRLF header injection vulnerability. This occurs due to failure to adequately sanitize input in message-building functions, allowing malicious actors to embed additional headers, such as a deceptive Bcc line, in outgoing email messages. Attackers can exploit crafted inputs related to MIME type, charset, encoding, micalg, or protocol values, potentially compromising email integrity and confidentiality. Immediate updating to the latest versions is recommended to mitigate these risks.

Affected Version(s)

mail-mime-parser 0.3.0 < 3.0.9

mail-mime-parser 4.0.0 < 4.0.6

References

https://github.com/zbateson/mail-mime-parser/security/adv...
vendor-advisory
https://github.com/zbateson/mail-mime-parser/commit/f385b...
patch
https://github.com/zbateson/mail-mime-parser/commit/1fa84...
patch

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

AlpetGexha
kemrec
manus-pi
.