Vulnerability · Published Aug 31, 2026 · Assigned by VulnCheck

CVE-2026-82853Nodemailer before 8.0.5 SMTP Command Injection via CRLF

Medium 4.9

In plain English

A medium-severity security flaw in nodemailer from nodemailer. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.9Medium

Exploit odds (30 days)1.0%top 36.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Nodemailer versions before 8.0.5 contain an SMTP command injection vulnerability in the transport name option used in EHLO/HELO commands. The name parameter is concatenated directly into SMTP commands without sanitizing carriage return and line feed characters, allowing attackers to inject arbitrary SMTP commands for email spoofing and phishing attacks.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	node-nodemailer	no fix listed	DEBIAN-CVE-2026-82853
Debian:13	node-nodemailer	no fix listed	DEBIAN-CVE-2026-82853
Debian:14	node-nodemailer	8.0.11+~8.0.1-1	DEBIAN-CVE-2026-82853
Ubuntu:22.04:LTS	node-nodemailer	no fix listed	UBUNTU-CVE-2026-82853
Ubuntu:24.04:LTS	node-nodemailer	no fix listed	UBUNTU-CVE-2026-82853
Ubuntu:26.04:LTS	node-nodemailer	no fix listed	UBUNTU-CVE-2026-82853
npm	nodemailer	8.0.5	GHSA-vvjj-xcjg-gr5g

Affected products (as reported)

Vendor	Product	Versions
nodemailer	nodemailer	0 – before 8.0.5

Weakness: CWE-93 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

References

GitHub Security Advisory (GHSA-vvjj-xcjg-gr5g) vendor-advisory
VulnCheck Advisory: Nodemailer before 8.0.5 SMTP Command Injection via CRLF third-party-advisory