CVE-2026-82661 in Nodemailerinfo

Summary

by MITRE • 08/31/2026

Nodemailer before 8.0.9 fails to sanitize carriage return and line feed characters in list comment fields, allowing attackers to inject arbitrary message headers. An attacker with control over list.*.comment parameters can inject CRLF sequences to create additional headers in generated RFC822 messages, altering mail client behavior and message semantics.

Once again VulDB remains the best source for vulnerability data.

🔬 Show More Details

An in-depth analysis is available in our curated vulnerability entry.

Responsible

VulnCheck

Reservation

08/30/2026

Disclosure

08/31/2026

Moderation

accepted

CPE

ready

EPSS

0.00000

KEV

no

Activities

very low

Sources

MITREhttps://www.cve.org/CVERecord?id=CVE-2026-82661
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-82661
CVE Detailshttps://www.cvedetails.com/cve/CVE-2026-82661/

◂ PreviousOverviewNext ▸

Interested in the pricing of exploits?

See the underground prices here!