CVE-2026-82661
Nodemailer CRLF Injection via List-* Header Comments
Nodemailer before 8.0.9 fails to sanitize carriage return and line feed characters in list comment fields, allowing attackers to inject arbitrary message headers. An attacker with control over list.*.comment parameters can inject CRLF sequences to create additional headers in generated RFC822 messages, altering mail client behavior and message semantics.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Nodemailer CRLF Injection via List-* Header Comments
Nodemailer before 8.0.9 fails to sanitize carriage return and line feed characters in list comment fields, allowing attackers to inject arbitrary message headers. An attacker with control over list.*.comment parameters can inject CRLF sequences to create additional headers in generated RFC822 messages, altering mail client behavior and message semantics.
- Record
CVE-2026-82661- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-93
- Updated
- 2026-11-02
EUVDEUVD-2026-68439
Nodemailer before 8.0.9 fails to sanitize carriage return and line feed characters in list comment fields, allowing attackers to inject arbitrary message headers. An attacker with control over list.*.comment parameters can inject CRLF sequences to create additional headers in generated RFC822 messages, altering mail client behavior and message semantics.
- Record
EUVD-2026-68439- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-2jv2-wqrj-g6x7
Nodemailer before 8.0.9 fails to sanitize carriage return and line feed characters in list...
Nodemailer before 8.0.9 fails to sanitize carriage return and line feed characters in list comment fields, allowing attackers to inject arbitrary message headers. An attacker with control over list.*.comment parameters can inject CRLF sequences to create additional headers in generated RFC822 messages, altering mail client behavior and message semantics.
- Record
GHSA-2jv2-wqrj-g6x7- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-93
- Updated
- 2026-11-02
NVD
Nodemailer before 8.0.9 fails to sanitize carriage return and line feed characters in list comment fields, allowing attackers to inject arbitrary message headers. An attacker with control over list.*.comment parameters can inject CRLF sequences to create additional headers in generated RFC822 messages, altering mail client behavior and message semantics.
- Record
CVE-2026-82661- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-93
- Updated
- 2026-11-02
OSV
Nodemailer CRLF Injection via List-* Header Comments
Nodemailer before 8.0.9 fails to sanitize carriage return and line feed characters in list comment fields, allowing attackers to inject arbitrary message headers. An attacker with control over list.*.comment parameters can inject CRLF sequences to create additional headers in generated RFC822 messages, altering mail client behavior and message semantics.
- Record
CVE-2026-82661- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-93
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-82661
Nodemailer before 8.0.9 fails to sanitize carriage return and line feed characters in list comment fields, allowing attackers to inject arbitrary message headers. An attacker with control over list.*.comment parameters can inject CRLF sequences to create additional headers in generated RFC822 messages, altering mail client behavior and message semantics.
- Record
DEBIAN-CVE-2026-82661- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2026-82661
Nodemailer before 8.0.9 fails to sanitize carriage return and line feed characters in list comment fields, allowing attackers to inject arbitrary message headers. An attacker with control over list.*.comment parameters can inject CRLF sequences to create additional headers in generated RFC822 messages, altering mail client behavior and message semantics.
- Record
UBUNTU-CVE-2026-82661- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVCLSA-2026-1788976685 No score
TuxCare security update for nodemailer (3 CVEs)
TuxCare rebuilt nodemailer to address 3 CVEs. Fixed in 0.7.1-tuxcare.2.
- Record
CLSA-2026-1788976685- Updated
- 2026-11-02
OSVCLSA-2026-1789050616 No score
TuxCare security update for nodemailer (7 CVEs)
TuxCare rebuilt nodemailer to address 7 CVEs. Fixed in 2.7.2-tuxcare.5.
- Record
CLSA-2026-1789050616- Updated
- 2026-11-02
OSVCLSA-2026-1789052249 No score
TuxCare security update for nodemailer (6 CVEs)
TuxCare rebuilt nodemailer to address 6 CVEs. Fixed in 6.10.1-tuxcare.9.
- Record
CLSA-2026-1789052249- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
nodemailerTuxCare:npm From an advisory covering 3 CVEs |
0.7.1-tuxcare.0 up to 0.7.1-tuxcare.2, plus listed versions 0.7.10.7.1-tuxcare.1 |
0.7.1-tuxcare.2 |
nodemailerTuxCare:npm From an advisory covering 7 CVEs |
2.7.2-tuxcare.0 up to 2.7.2-tuxcare.5, plus listed versions 2.7.22.7.2-tuxcare.12.7.2-tuxcare.22.7.2-tuxcare.32.7.2-tuxcare.4 |
2.7.2-tuxcare.5 |
nodemailerTuxCare:npm From an advisory covering 6 CVEs |
6.10.1-tuxcare.0 up to 6.10.1-tuxcare.9, plus listed versions 6.10.16.10.1-tuxcare.16.10.1-tuxcare.26.10.1-tuxcare.36.10.1-tuxcare.4 Show 4 moreShow less6.10.1-tuxcare.56.10.1-tuxcare.66.10.1-tuxcare.76.10.1-tuxcare.8 |
6.10.1-tuxcare.9 |
node-nodemailerDebian:12 |
All versions, plus listed versions 10.0.0+~8.0.1-110.0.10+~8.0.1-110.0.10+~8.0.2-16.10.0+~6.4.17-16.8.0+~6.4.6-1 Show 22 moreShow less6.9.13+~6.4.14-16.9.15+~6.4.16-16.9.16+~6.4.16-16.9.4+~6.4.9-16.9.4+~6.4.9-26.9.4+~6.4.9-36.9.4+~6.4.9-47.0.10+~7.0.2-17.0.12+~7.0.5-17.0.5+~7.0.1-17.0.6+~7.0.1-17.0.9+~7.0.2-17.0.9+~7.0.2-28.0.11+~8.0.1-18.0.2+~7.0.11-18.0.3+~7.0.11-18.0.4+~7.0.11-18.0.4+~7.0.11-29.0.0+~8.0.1-19.0.3+~8.0.1-19.0.5+~8.0.1-19.0.6+~8.0.1-1 |
None known |
node-nodemailerDebian:13 |
All versions, plus listed versions 10.0.0+~8.0.1-110.0.10+~8.0.1-110.0.10+~8.0.2-16.10.0+~6.4.17-16.10.0+~6.4.17-1+deb13u1 Show 15 moreShow less7.0.10+~7.0.2-17.0.12+~7.0.5-17.0.5+~7.0.1-17.0.6+~7.0.1-17.0.9+~7.0.2-17.0.9+~7.0.2-28.0.11+~8.0.1-18.0.2+~7.0.11-18.0.3+~7.0.11-18.0.4+~7.0.11-18.0.4+~7.0.11-29.0.0+~8.0.1-19.0.3+~8.0.1-19.0.5+~8.0.1-19.0.6+~8.0.1-1 |
None known |
node-nodemailerDebian:14 |
before 8.0.11+~8.0.1-1, plus listed versions 6.10.0+~6.4.17-17.0.10+~7.0.2-17.0.12+~7.0.5-17.0.5+~7.0.1-17.0.6+~7.0.1-1 Show 6 moreShow less7.0.9+~7.0.2-17.0.9+~7.0.2-28.0.2+~7.0.11-18.0.3+~7.0.11-18.0.4+~7.0.11-18.0.4+~7.0.11-2 |
8.0.11+~8.0.1-1 |
node-nodemailerUbuntu:20.04:LTS |
All versions, plus listed versions 6.3.0-26.3.1-16.4.0-16.4.1-16.4.2-16.4.5-1 |
None known |
node-nodemailerUbuntu:22.04:LTS |
All versions, plus listed versions 6.4.17-36.7.0-16.7.0-26.7.1+~6.4.4-1 |
None known |
node-nodemailerUbuntu:24.04:LTS |
All versions, plus listed versions 6.9.4+~6.4.9-26.9.4+~6.4.9-3ubuntu16.9.4+~6.4.9-4 |
None known |
node-nodemailerUbuntu:26.04:LTS |
All versions, plus listed versions 7.0.5+~7.0.1-17.0.9+~7.0.2-27.0.10+~7.0.2-17.0.12+~7.0.5-18.0.4+~7.0.11-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-82661 is a medium vulnerability (CVSS 5.3) in Nodemailer, published August 31, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.26%, the 17th percentile. Fixed in node-nodemailer 8.0.11+~8.0.1-1.
References
github.com/nodemailer/nodemailer/security/advisories/GHSA-268h-hp4c-crq3
vulncheck.com/advisories/nodemailer-crlf-injection-via-list-header-comments
nvd.nist.gov/vuln/detail/CVE-2026-82661
security-tracker.debian.org/tracker/CVE-2026-82661
ubuntu.com/security/CVE-2026-82661
cve.org/CVERecord?id=CVE-2026-82661