CVE-2026-82661
Fixed in a distro release EPSS <1%CVSS 5.4
Nodemailer before 8.0.9 fails to sanitize carriage return and line feed characters in list comment fields, allowing attackers to inject arbitrary message headers. An attacker with control over list.*.comment parameters can inject CRLF sequences to create additional headers in generated RFC822 messages, altering mail client behavior and message semantics.
Products: nodemailer
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | nodemailer | 8.0.9 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | node-nodemailer | no fix |
| Debian 13 | node-nodemailer | no fix |
| Debian 14 | node-nodemailer | 8.0.11+~8.0.1-1 |
| Ubuntu 20.04 LTS | node-nodemailer | no fix |
| Ubuntu 22.04 LTS | node-nodemailer | no fix |
| Ubuntu 24.04 LTS | node-nodemailer | no fix |
| Ubuntu 26.04 LTS | node-nodemailer | no fix |