CVE-2026-82661 Overview
CVE-2026-82661 is a CRLF injection vulnerability affecting Nodemailer versions prior to 8.0.9. The library fails to sanitize carriage return (\r) and line feed (\n) characters in list comment fields. Attackers with control over list.*.comment parameters can inject CRLF sequences into generated RFC822 messages. The injected sequences create additional message headers, altering mail client interpretation and message semantics. The flaw is categorized under CWE-93: Improper Neutralization of CRLF Sequences.
Critical Impact
Attackers who influence list comment inputs can inject arbitrary email headers, enabling header spoofing, message routing manipulation, and downstream trust abuse in mail clients.
Affected Products
- Nodemailer versions prior to 8.0.9
- Node.js applications that expose list.*.comment parameters to untrusted input
- Downstream services generating RFC822 messages through the vulnerable Nodemailer API
Discovery Timeline
- 2026-08-31 - CVE-2026-82661 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-82661
Vulnerability Analysis
Nodemailer constructs RFC822 messages from developer-supplied options, including List-* header comment fields. The library concatenates the supplied comment value into the generated header without stripping CRLF characters. When an attacker controls that input, injected \r\n sequences terminate the current header and begin a new one under attacker control.
The issue affects any application that forwards user-provided data into the list option tree. Newsletter platforms, notification services, and multi-tenant SaaS mailers frequently pass tenant metadata into these fields. The resulting messages remain syntactically valid RFC822, which allows the injected headers to reach recipient mail clients unmodified.
Impact is bounded to header injection rather than full message body takeover. Attackers can still forge headers such as Bcc, Reply-To, Content-Type, or authentication-related fields to influence delivery, phishing plausibility, and downstream processing.
Root Cause
The root cause is missing input neutralization on list.*.comment values before header serialization. The library does not enforce the RFC 5322 restriction that structured header field content must not contain bare CR or LF characters. Any value reaching the header builder is trusted as-is.
Attack Vector
Exploitation requires the attacker to control the comment property of one or more entries in the list option passed to Nodemailer's sendMail call. This typically occurs when applications map user-provided form fields, API payloads, or tenant configuration directly into mailer options. The attacker embeds \r\n followed by the forged header name and value. Nodemailer then emits the crafted headers into the outgoing MIME message.
Code-level details are documented in the GitHub Security Advisory GHSA-268h-hp4c-crq3 and the VulnCheck Advisory on Nodemailer CRLF Injection.
Detection Methods for CVE-2026-82661
Indicators of Compromise
- Outbound SMTP messages containing unexpected headers such as duplicate Bcc, Reply-To, or Content-Type values sourced from applications using Nodemailer.
- Application logs showing list.help.comment, list.unsubscribe.comment, or similar fields containing %0d%0a, \r, or \n sequences.
- Mail transfer agent (MTA) logs recording deliveries to recipients not present in the application's intended recipient list.
Detection Strategies
- Perform a software composition analysis (SCA) scan across Node.js projects to identify nodemailer versions below 8.0.9.
- Add server-side validation logging that flags CRLF byte sequences in any request field ultimately forwarded to mail options.
- Compare emitted RFC822 headers against an expected header allowlist before handing messages to the MTA.
Monitoring Recommendations
- Monitor SMTP submission traffic for messages whose header count or header names diverge from application templates.
- Alert on user input fields that contain URL-encoded or literal \r\n sequences at API gateways and web application firewalls.
- Track Nodemailer package versions across CI/CD pipelines and block builds that pull versions earlier than 8.0.9.
How to Mitigate CVE-2026-82661
Immediate Actions Required
- Upgrade Nodemailer to version 8.0.9 or later across all Node.js services.
- Audit application code paths that populate list.help, list.unsubscribe, list.subscribe, and any custom list entries with untrusted input.
- Reject or strip CRLF characters from any user-controlled string before passing it into mailer options.
Patch Information
The maintainers addressed the issue in Nodemailer 8.0.9 by sanitizing CRLF characters in list comment fields before header serialization. Upgrade guidance is available in the GitHub Security Advisory GHSA-268h-hp4c-crq3.
Workarounds
- Wrap mailer invocations with a validator that rejects strings containing \r or \n in any list.*.comment value.
- Remove or hardcode list header configuration where user input cannot be excluded from those fields.
- Enforce an outbound header allowlist at the MTA or an SMTP relay proxy to drop unexpected headers before delivery.
# Configuration example: enforce patched version via npm
npm install nodemailer@^8.0.9
npm ls nodemailer
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.