CVE-2026-82854 in Nodemailer
Summary
by MITRE • 08/31/2026
Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.size parameter. When an application passes a custom envelope object with a size property containing CRLF characters to sendMail(), the value is concatenated into the SMTP MAIL FROM command (as SIZE=...) without sanitization, allowing injection of arbitrary SMTP commands such as RCPT TO to silently add attacker-controlled recipients. Exploitation requires the application to expose the envelope size to attacker-controlled input, as Nodemailer does not include size in the default auto-constructed envelope.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/31/2026
The vulnerability identified in versions of Nodemailer prior to 8.0.4 represents a critical SMTP command injection flaw rooted in improper validation and sanitization of user-supplied data within the mail sending process. Specifically, this issue affects the handling of the envelope.size parameter when an application explicitly passes a custom envelope object to the sendMail function. In standard email transmission protocols such as Simple Mail Transfer Protocol (SMTP), commands are sent sequentially from client to server to establish connections and deliver messages. The MAIL FROM command is used to specify the sender, and it often includes optional parameters like SIZE to indicate the message size for resource allocation by the receiving mail server. Nodemailer constructs this SMTP command string by concatenating user-provided values directly into the protocol stream without adequate filtering or escaping mechanisms.
The technical core of this vulnerability lies in the lack of sanitization applied to the size property within a custom envelope object. When an attacker can control the value assigned to this parameter, they are able to inject Carriage Return and Line Feed (CRLF) characters into the SMTP command stream. These whitespace characters serve as delimiters that terminate the current SMTP command and initiate a new one. Consequently, instead of merely setting the message size attribute, the injected CRLFs allow an attacker to append arbitrary SMTP commands directly after the MAIL FROM directive. This capability effectively bypasses the intended logic flow of the email transmission process, granting the attacker control over subsequent protocol interactions with the mail server.
The operational impact of this vulnerability is severe, primarily enabling unauthorized recipient manipulation and potential data exfiltration or spam relay abuse. By injecting an RCPT TO command following the MAIL FROM statement, an attacker can silently add their own controlled email addresses to the list of recipients for any message sent through the vulnerable application. This means that sensitive information intended for legitimate users could be intercepted by malicious actors without detection from the sending application's logic. Furthermore, depending on the configuration and permissions of the underlying SMTP server, this injection vector might allow attackers to execute other commands such as RSET or QUIT, potentially disrupting ongoing sessions or causing denial-of-service conditions. The severity is compounded by the fact that exploitation does not require authentication bypass if the application itself handles untrusted input in its envelope construction logic.
Exploitation of this flaw requires specific contextual conditions within the host application using Nodemailer. It is important to note that Nodemailer does not include a size field in its default auto-constructed envelopes, meaning applications relying solely on standard usage patterns are generally unaffected. The vulnerability manifests only when developers explicitly construct and pass custom envelope objects where the size property is derived from or influenced by attacker-controlled input sources such as HTTP request parameters, database entries, or file uploads without proper validation. This highlights a common development oversight where convenience features like manual envelope customization introduce security risks if input sanitization practices are not rigorously applied to all fields involved in protocol command generation.
To mitigate this vulnerability, organizations must upgrade Nodemailer to version 8.0.4 or later, which addresses the improper handling of the size parameter by implementing robust validation and encoding mechanisms that prevent CRLF injection. For applications unable to immediately update their dependencies, immediate remediation involves enforcing strict input validation on any data used to populate envelope properties before they are passed to sendMail functions. Developers should ensure that numeric fields like size are validated as integers and stripped of any non-numeric characters or control codes such as carriage returns and line feeds. Additionally, implementing a whitelist approach for allowed characters in protocol-related parameters can significantly reduce the attack surface.
From a classification perspective, this vulnerability aligns with CWE-74 Improper Neutralization of Special Elements used in an Command, commonly known as injection vulnerabilities. It also maps to MITRE ATT&CK techniques related to command and script interpretation, specifically where input validation failures allow attackers to alter the execution path or intent of system commands. Security teams should audit their codebases for any instances where custom envelope objects are constructed with dynamic data sources, ensuring that all such inputs undergo rigorous sanitization before interacting with external mail servers. Regular security testing including static analysis and penetration testing focused on SMTP interactions can help identify similar flaws in email handling logic across the application stack.