Vulnerability · Published Aug 31, 2026 · Assigned by VulnCheck

CVE-2026-82661Nodemailer CRLF Injection via List-* Header Comments

Medium 5.4

In plain English

A medium-severity security flaw in nodemailer from nodemailer. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.3%top 82.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Nodemailer before 8.0.9 fails to sanitize carriage return and line feed characters in list comment fields, allowing attackers to inject arbitrary message headers. An attacker with control over list.*.comment parameters can inject CRLF sequences to create additional headers in generated RFC822 messages, altering mail client behavior and message semantics.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	node-nodemailer	no fix listed	DEBIAN-CVE-2026-82661
Debian:13	node-nodemailer	no fix listed	DEBIAN-CVE-2026-82661
Debian:14	node-nodemailer	8.0.11+~8.0.1-1	DEBIAN-CVE-2026-82661
Ubuntu:22.04:LTS	node-nodemailer	no fix listed	UBUNTU-CVE-2026-82661
Ubuntu:24.04:LTS	node-nodemailer	no fix listed	UBUNTU-CVE-2026-82661
Ubuntu:26.04:LTS	node-nodemailer	no fix listed	UBUNTU-CVE-2026-82661
npm	nodemailer	8.0.9	GHSA-268h-hp4c-crq3

Affected products (as reported)

Vendor	Product	Versions
nodemailer	nodemailer	0 – before 8.0.9

Weakness: CWE-93 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

References

GitHub Security Advisory (GHSA-268h-hp4c-crq3) vendor-advisory
VulnCheck Advisory: Nodemailer CRLF Injection via List-* Header Comments third-party-advisory