Read the docs
TI-2026-57158 Aliases CVE-2026-82854GHSA-2x76-7hhq-pgvw

Nodemailer before 8.0.4 SMTP Command Injection via envelope.size

Priority MEDIUM 52CWE-93Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 3 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.size parameter. When an application passes a custom envelope object with a size property containing CRLF characters to sendMail(), the value is concatenated into the SMTP MAIL FROM command (as SIZE=...) without sanitization, allowing injection of arbitrary SMTP commands such as RCPT TO to silently add attacker-controlled recipients. Exploitation requires the application to expose the envelope size to attacker-controlled input, as Nodemailer does not include size in the default auto-constructed envelope.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01975 80th percentileScored 2026-11-07
Fix Partial nodemailer (nodemailer): 8.0.4Red Hat: 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nodemailernodemailerbefore 8.0.48.0.4Patch availableCNA
  • nodemailer Vendornodemailer Affected before 8.0.4 Fixed in 8.0.4 Patch available CNA

Remediation

  • Fix · CNA nodemailer (nodemailer) Fixed in 8.0.4

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Developer Hub 1AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 10AffectedNo fix yet: Fix deferred
Self-service automation portal 2AffectedNo fix yet
Not affected: 1 product
  • Red Hat Hardened Images

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-82854
  2. 2026-10-03 Alias added: GHSA-2x76-7hhq-pgvw
  3. 2026-10-13 Affected versions changed · Red Hat
  4. 2026-10-20 Affected versions changed · Red Hat
  5. 2026-10-27 Affected versions changed · Red Hat
  6. 2026-10-29 Title updated · CNA
  7. 2026-10-29 Fix available: nodemailer/[email protected] · CNA

References

Advisory 1

  • TI-2026-74559 ReDoS in Nodemailer SMTP AUTH mechanism detection regexes CVSS 4.0HIGH 8.7
  • TI-2026-64856 nodemailer before 10.0.6 Denial of Service via addressparser CVSS 4.0HIGH 8.7
  • TI-2026-62452 Nodemailer before 9.1.0 Denial of Service via addressparser CVSS 4.0HIGH 8.7
  • TI-2026-61683 Nodemailer 9.1.0 through 10.0.4 Denial of Service via Quadratic Address Parsing CVSS 4.0HIGH 8.7
  • TI-2025-13566 Nodemailer: nodemailer: denial of service via crafted email address header CVSS 3.1HIGH 7.5
  • TI-2026-74560 Nodemailer address parser passes illegal characters to SMTP envelope CVSS 4.0MEDIUM 6.9
See all 27 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences