CVE-2026-82853: Nodemailer SMTP Injection Vulnerability

CVE-2026-82853 Overview

CVE-2026-82853 is an SMTP command injection vulnerability in Nodemailer versions before 8.0.5. The flaw exists in the transport name option used to construct EHLO and HELO commands. Nodemailer concatenates the name parameter into SMTP commands without stripping carriage return (\r) and line feed (\n) characters. Attackers who control the name value can inject arbitrary SMTP commands, enabling email spoofing and phishing. The issue is tracked under CWE-93: Improper Neutralization of CRLF Sequences.

Critical Impact
Attackers with control over the transport name value can inject arbitrary SMTP commands into an authenticated session, enabling message spoofing and downstream phishing.

Affected Products

Nodemailer versions prior to 8.0.5
Node.js applications using Nodemailer SMTP transport with attacker-influenced name option
Downstream libraries and services embedding vulnerable Nodemailer releases

Discovery Timeline

2026-08-31 - CVE-2026-82853 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-82853

Vulnerability Analysis

Nodemailer establishes SMTP sessions by issuing EHLO or HELO commands that identify the client to the mail server. The client identity is taken from the transport name option. Nodemailer builds these commands by concatenating the name value directly into the wire protocol string. It does not neutralize CRLF byte sequences before sending.

SMTP uses \r\n as its command terminator. When name contains embedded CRLF characters, the receiving mail server treats each line as a separate command. An attacker can therefore inject MAIL FROM, RCPT TO, DATA, or additional EHLO commands into an already-authenticated SMTP session. This turns a benign greeting into a multi-command sequence executed with the sender's credentials.

Exploitation requires the attacker to influence the name value passed to createTransport or an equivalent API. Applications that derive name from user-controlled input, tenant configuration, or database records are exposed.

Root Cause

The root cause is missing input sanitization on the name transport option before it is written to the SMTP socket. Nodemailer trusted this value as a static, developer-supplied string. Failure to filter or reject \r and \n bytes allows the SMTP command stream to be split, which is the defining pattern of CRLF injection ([CWE-93]).

Attack Vector

The vulnerability is exploited over the network through the SMTP session that Nodemailer opens to a mail relay. High privileges are required because the attacker must reach the code path that supplies the name option, typically through an authenticated administrative or tenant-configuration interface. No user interaction is required. Successful exploitation yields injection of arbitrary SMTP verbs, which primarily impacts message integrity through spoofing and phishing rather than confidentiality or availability.

A sanitized description of the exploitation pattern: the attacker sets the transport name to a string that ends the legitimate EHLO line with \r\n and appends attacker-chosen SMTP verbs. When Nodemailer transmits the greeting, the SMTP server parses and executes the injected verbs on the same authenticated connection. See the GitHub Security Advisory GHSA-vvjj-xcjg-gr5g and the VulnCheck Advisory on Nodemailer for full protocol-level details.

Detection Methods for CVE-2026-82853

Indicators of Compromise

SMTP server logs showing multiple MAIL FROM, RCPT TO, or DATA verbs following a single client greeting on one connection
Outbound mail records with From or Return-Path values that do not match the application's configured sender identity
Nodemailer transport configurations where the name option is populated from user input, request headers, or tenant metadata
Presence of Nodemailer versions earlier than 8.0.5 in package-lock.json or yarn.lock

Detection Strategies

Run software composition analysis (SCA) against Node.js projects to flag any Nodemailer release below 8.0.5.
Audit code paths that call nodemailer.createTransport and confirm the name value is a hardcoded, sanitized constant.
Enable SMTP relay verbose logging and alert on connections that issue more SMTP verbs than the application's expected send pattern.

Monitoring Recommendations

Correlate outbound SMTP traffic with application send events to detect extra injected commands per session.
Monitor DMARC, SPF, and DKIM failure reports for sudden increases involving the sending domain.
Alert on any deployment introducing a Nodemailer version pinned below 8.0.5.

How to Mitigate CVE-2026-82853

Immediate Actions Required

Upgrade Nodemailer to version 8.0.5 or later across all Node.js services and dependent libraries.
Audit every call site that constructs an SMTP transport and remove attacker-influenced input from the name option.
Rotate SMTP relay credentials if logs show unexpected injected commands on authenticated sessions.
Enforce DMARC with a reject policy on sending domains to blunt spoofing that reaches recipients.

Patch Information

The maintainers fixed the issue in Nodemailer 8.0.5 by sanitizing the name option before it is inserted into EHLO and HELO commands. Update the dependency in package.json and regenerate the lockfile. Refer to the GitHub Security Advisory GHSA-vvjj-xcjg-gr5g for the fix commit and version details.

Workarounds

Hardcode the transport name option to a static ASCII hostname and never derive it from external data.
Validate any dynamic name value against a strict allowlist that rejects \r, \n, and non-hostname characters.
Restrict access to configuration surfaces where the name option can be modified to trusted administrators only.

bash

# Configuration example
npm install nodemailer@^8.0.5
npm ls nodemailer