Executive brief
nodemailer is a popular Node.js library used to send emails from applications. A header injection vulnerability allows attackers to inject arbitrary SMTP headers (such as BCC, CC, or Reply-To) by crafting malicious email addresses or names with embedded newlines and carriage returns. This could enable an attacker to redirect emails, add unauthorized recipients, or manipulate email headers if user input is passed unsanitized into address fields.
Technical details
The vulnerability is a CWE-74 (Improper Neutralization of Special Elements in Output) header injection flaw in nodemailer versions before 6.6.1. When unsanitized user input containing newline (\n) and carriage return (\r) characters is passed into address object fields (from, to, replyTo, etc.), these characters are not filtered, allowing an attacker to inject new SMTP headers. The vulnerability requires user-controlled input to reach the address object, typically through an HTTP handler or form submission. An attacker can inject headers like BCC to add unauthorized recipients or modify mail routing. The fix was released in version 6.6.1.
Affected products
- nodemailer nodemailer before 6.6.1
Timeline
- 2021-05-22: disclosed: Vulnerability reported in GitHub issue #1289
- 2021-06-29: advisory: NVD published CVE-2021-23400
- 2021-06-30: patched: Fix released in nodemailer 6.6.1
- 2021-12-10: other: GHSA-hwqf-gcqm-7353 published