CVE-2026-121946 in mail-mime-parser
Summary
by MITRE • 11/04/2026
zbateson mail-mime-parser before 3.0.9 and 4.x before 4.0.6 contains a CRLF header injection vulnerability in message-building helpers that fail to strip CR and LF characters. Attackers supplying crafted MIME type, charset, encoding, micalg, or protocol values can inject extra header lines such as a forged Bcc into outgoing messages.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/04/2026
The zbateson mail-mime-parser library, specifically versions prior to 3.0.9 and the 4.x series before version 4.0.6, contains a critical server-side request forgery vulnerability classified under CWE-117: Improper Output Neutralization for Logs. This flaw resides within the message-building helper functions responsible for constructing MIME email messages. The core technical deficiency is the failure to sanitize or strip carriage return (CR) and line feed (LF) characters from user-supplied input fields that are directly embedded into email headers. In standard SMTP protocols, header lines must be terminated by CRLF sequences; however, if an attacker can inject these control characters into a single field value without proper escaping or validation, the parser interprets them as delimiters for new header lines rather than part of the current field's data.
This lack of input sanitization allows malicious actors to perform email header injection attacks when they supply crafted values for MIME type, charset, encoding parameters, MICALG (Message Integrity Check Algorithm), or protocol fields. By inserting CRLF sequences into these specific attributes, an attacker can effectively terminate the intended header line and append arbitrary new headers to the outgoing message. The most severe operational impact of this vulnerability is the ability to forge Blind Carbon Copy recipients. An adversary can inject a Bcc: header containing their own email address or that of another target, ensuring they receive copies of sensitive communications without the original sender's knowledge. This capability undermines the confidentiality and integrity expectations associated with private messaging channels.
Beyond simple recipient manipulation, this vulnerability enables broader phishing campaigns where attackers can modify other headers such as From:, Reply-To:, or Subject: to make forged emails appear legitimate. The exploitation vector typically involves web applications that utilize zbateson mail-mime-parser for transactional email notifications, password resets, or internal communications. If the application accepts user input into any of the vulnerable parameters and passes it directly to the parser without rigorous validation, the attacker gains a foothold to manipulate message routing and content presentation. This aligns with ATT&CK technique T1534: Internal Spearphishing, as the compromised email system can be used to launch targeted attacks against other users within or outside the organization by spoofing trusted identities.
Mitigation strategies must prioritize immediate version upgrades for affected systems. Organizations running zbateson mail-mime-parser should upgrade to version 3.0.9 or later, and those on the 4.x branch must update to at least version 4.0.6 where these sanitization checks have been implemented. For applications unable to patch immediately due to dependency constraints, a temporary workaround involves implementing strict input validation layers before data reaches the parser. Developers should enforce allow-lists for acceptable characters in header fields and explicitly strip or encode any CR (hex 0D) and LF (hex 0A) sequences from user-supplied MIME parameters. Additionally, integrating output encoding mechanisms that neutralize special characters can prevent these control codes from being interpreted as structural delimiters by the underlying SMTP engine. Regular security audits of email handling code paths are recommended to ensure no other instances of unsanitized header construction exist within the application logic.