SZB-9913db5000
EUVD-2026-68442: SMTP command injection in Nodemailer before 8.0.4
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Nodemailer
- Product
- nodemailer
- First seen
Summary
The EUVD entry, scored 9.3 under CVSS v3.1, describes SMTP command injection in Nodemailer versions before 8.0.4. The entry says CRLF characters in the envelope.size property passed to sendMail() are not sanitized.
If you use Nodemailer
Upgrade nodemailer to 8.0.4 or later
Validate or strip CRLF characters from user-influenced envelope fields
Review outbound mail logs for unexpected SMTP commands
What the sources say 1
· Mastodon: “Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.size parameter.” Source