Executive brief
Nodemailer is a widely-used Node.js library for sending emails. The vulnerability allows an attacker to inject arbitrary email headers into messages by inserting CRLF (carriage return + line feed) sequences into list management comment fields that the application passes to the email library. This could allow an attacker to manipulate how emails are displayed, filtered, or processed by mail servers and clients—potentially leading to spam bypass, phishing, or message spoofing attacks.
Technical details
The vulnerability is a CRLF injection (CWE-93) in the email header construction logic. When Nodemailer builds List-* headers (List-Unsubscribe, List-Subscribe, List-Post, List-Help, List-Owner, List-Archive, List-ID) from the caller-provided `list.*.comment` field, it does not remove CR (\r) or LF (\n) characters before inserting the comment into the header value. The vulnerable code in lib/mailer/mail-message.js constructs these as "prepared" headers that bypass the normal header-value sanitizer. These prepared headers are passed directly to mimeFuncs.foldLines(), causing CRLF sequences to be emitted as actual header boundaries in the RFC822 message. An attacker who can control the list comment field (for example, via a lower-privileged application account or unauthenticated API endpoint) can inject additional email headers such as X-Custom-Header. The attack requires no user interaction and affects message metadata interpretation. Patch available in version 8.0.9; versions through 8.0.8 are confirmed vulnerable, and the code path exists in older versions (at least v3.1.8 and v4.3.0) but was not comprehensively tested.
Affected products
- Nodemailer Nodemailer <= 8.0.8
Timeline
- 2026-05-26: disclosed
- 2026-05-26: patched: Patch released as version 8.0.9