CVE-2026-82854 Overview
CVE-2026-82854 is an SMTP command injection vulnerability affecting Nodemailer versions prior to 8.0.4. The flaw resides in how Nodemailer handles the envelope.size parameter when passed to sendMail(). When an application forwards attacker-controlled input into a custom envelope object, carriage-return and line-feed (CRLF) characters embedded in the size value are concatenated directly into the SMTP MAIL FROM command. This allows attackers to inject arbitrary SMTP commands, including RCPT TO, to silently add recipients to outbound mail. The vulnerability is classified under CWE-93: Improper Neutralization of CRLF Sequences.
Critical Impact
Attackers who influence the envelope size field can inject SMTP commands to reroute or duplicate outbound email, enabling data exfiltration, phishing amplification, and silent recipient injection.
Affected Products
- Nodemailer versions prior to 8.0.4
- Node.js applications that pass user-influenced data into the envelope.size field of sendMail()
- Any downstream package or service embedding a vulnerable Nodemailer release
Discovery Timeline
- 2026-08-31 - CVE-2026-82854 published to NVD
- 2026-08-31 - Last updated in NVD database
Technical Details for CVE-2026-82854
Vulnerability Analysis
Nodemailer constructs the SMTP MAIL FROM command by concatenating envelope fields into a single line sent to the mail server. When an application supplies a custom envelope object containing a size property, Nodemailer appends it as SIZE=<value> to the command. Versions before 8.0.4 do not validate or sanitize this value. An attacker who supplies a size string containing CRLF (\r\n) sequences can terminate the MAIL FROM line and inject additional SMTP verbs. The injected verbs are interpreted by the receiving SMTP server as legitimate protocol traffic from the sending application.
Root Cause
The root cause is missing input neutralization for CRLF characters in the SMTP command builder. Nodemailer trusts that the envelope.size property, when supplied by the caller, contains a numeric value. No type coercion, regex validation, or CRLF stripping is performed before the value is written to the SMTP transport socket. This design assumption breaks whenever an application exposes envelope construction to untrusted input.
Attack Vector
Exploitation requires the vulnerable application to accept attacker-controlled input into the envelope.size field. Nodemailer's default auto-constructed envelope does not include a size property, so the vulnerability is not reachable in default configurations. When reachable, the attacker submits a crafted value such as a numeric prefix followed by \r\nRCPT TO:<attacker@example.com>. The SMTP server processes the injected RCPT TO command and silently adds the attacker's address as a recipient. The original sender and legitimate recipients remain unaware that the message was delivered to an additional destination.
For implementation details and proof-of-concept information, refer to the GitHub Security Advisory GHSA-c7w3-x93f-qmm8 and the VulnCheck Advisory on Nodemailer.
Detection Methods for CVE-2026-82854
Indicators of Compromise
- SMTP session logs containing unexpected RCPT TO commands immediately following a MAIL FROM line that includes a SIZE= parameter
- Outbound mail delivered to recipients not present in the application's message metadata or database
- Node.js process logs showing sendMail() invocations where request parameters include CRLF byte sequences (0x0D 0x0A) in envelope fields
Detection Strategies
- Inspect SMTP transaction logs on outbound relays for MAIL FROM commands containing embedded CRLF or multi-line payloads
- Audit application code paths that construct the envelope object passed to Nodemailer's sendMail() and flag any that accept external input into size, from, or to
- Enable dependency scanning to identify Nodemailer versions earlier than 8.0.4 across build pipelines and container images
Monitoring Recommendations
- Alert on outbound email volume anomalies, particularly increases in recipients per message from application service accounts
- Correlate web application request logs with mail-server transaction logs to identify inputs that produce injected SMTP verbs
- Monitor npm audit output and software bill of materials (SBOM) feeds for Nodemailer advisories
How to Mitigate CVE-2026-82854
Immediate Actions Required
- Upgrade Nodemailer to version 8.0.4 or later across all applications and container images
- Audit application code for any use of a custom envelope object and confirm the size field is never populated from untrusted input
- Remove or hard-code the envelope.size value where custom envelopes are required for business logic
Patch Information
The maintainers released a fix in Nodemailer 8.0.4. The patch adds input sanitization to reject or strip CRLF characters from envelope fields before they are written to the SMTP transport. Consult the GitHub Security Advisory GHSA-c7w3-x93f-qmm8 for the authoritative patch notes and commit references.
Workarounds
- Rely on Nodemailer's default auto-constructed envelope, which does not include a size property and is not affected
- If a custom envelope is required, validate the size value with a strict numeric check such as Number.isInteger() before assignment
- Strip CRLF characters from all envelope fields using a sanitization wrapper before invoking sendMail()
- Restrict outbound SMTP traffic from application servers to authorized relays that log and inspect protocol commands
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
