Vulnerability Description
Nodemailer before 8.0.9 fails to sanitize carriage return and line feed characters in list comment fields, allowing attackers to inject arbitrary message headers. An attacker with control over list.*.comment parameters can inject CRLF sequences to create additional headers in generated RFC822 messages, altering mail client behavior and message semantics.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/nodemailer/nodemailer/security/advisories/GHSA-268h-hp4c-crq3
- https://www.vulncheck.com/advisories/nodemailer-crlf-injection-via-list-header-c
- https://github.com/nodemailer/nodemailer/security/advisories/GHSA-268h-hp4c-crq3
FAQ
What is CVE-2026-82661?
CVE-2026-82661 is a vulnerability with a CVSS score of 5.4 (MEDIUM). Nodemailer before 8.0.9 fails to sanitize carriage return and line feed characters in list comment fields, allowing attackers to inject arbitrary message headers. An attacker with control over list.*....
How severe is CVE-2026-82661?
CVE-2026-82661 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-82661?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.