Vulnerability · Published Jun 29, 2021 · Assigned by snyk
CVE-2021-23400HTTP Header Injection
Medium 6.3
In plain English
A medium-severity security flaw in nodemailer. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 72% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)1.4%top 27.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain newlines and carriage returns is passed into an address object.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | node-nodemailer | 6.4.17-3 | DEBIAN-CVE-2021-23400 |
| Debian:13 | node-nodemailer | 6.4.17-3 | DEBIAN-CVE-2021-23400 |
| Debian:14 | node-nodemailer | 6.4.17-3 | DEBIAN-CVE-2021-23400 |
| Ubuntu:22.04:LTS | node-nodemailer | no fix listed | UBUNTU-CVE-2021-23400 |
| npm | nodemailer | 6.6.1 | GHSA-hwqf-gcqm-7353 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | nodemailer | unspecified – before 6.6.1 |
References
- https://snyk.io/vuln/SNYK-JS-NODEMAILER-1296415 x_refsource_MISC
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1314737 x_refsource_MISC
- https://github.com/nodemailer/nodemailer/issues/1289 x_refsource_MISC
- https://github.com/nodemailer/nodemailer/commit/7e02648cc8cd863f5085bad3cd09087bccf84b9f x_refsource_MISC