SMTP Command Injection Vulnerability in Nodemailer by Nodemailer

CVE-2026-82854

What is CVE-2026-82854?

Nodemailer, before version 8.0.4, has a vulnerability that can be exploited via the unsanitized envelope.size parameter when constructing SMTP commands. By passing a custom envelope object containing CRLF characters to the sendMail() method, an attacker can manipulate the SMTP MAIL FROM command, injecting arbitrary commands that may include the addition of unintended recipient addresses. Exploitation relies on the application exposing the envelope size for uncontrolled input. This vulnerability can pose significant risks to email security, allowing potentially malicious activities without detection.

References