Is CVE-2026-82661 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-82661 being exploited in the wild.

How severe is CVE-2026-82661?

Medium severity, with a CVSS score of 5.4, published 31 August 2026.

Is there a fix for CVE-2026-82661?

A patch was published on 2026-05-26: Patch released as version 8.0.9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-82661 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-82661?

Check whether you run Nodemailer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82661: Nodemailer CRLF injection in List-* header comments

CVE-2026-82661 · Severity: medium · CVSS 5.4 · Published 2026-08-31

Nodemailer is a widely-used Node.js library for sending emails. The vulnerability allows an attacker to inject arbitrary email headers into messages by inserting CRLF (carriage return + line feed) sequences into list management comment fields that the application passes to the email library. This could allow an attacker to manipulate how emails are displayed, filtered, or processed by mail servers and clients—potentially leading to spam bypass, phishing, or message spoofing attacks.

Technologies: Nodemailer. Vendors: Nodemailer.

Quick answers

Is CVE-2026-82661 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-82661 being exploited in the wild.
How severe is CVE-2026-82661?: Medium severity, with a CVSS score of 5.4, published 31 August 2026.
Which products and versions are affected?: Nodemailer <= 8.0.8.
Is there a fix for CVE-2026-82661?: A patch was published on 2026-05-26: Patch released as version 8.0.9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-82661 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-82661?: Check whether you run Nodemailer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a CRLF injection (CWE-93) in the email header construction logic. When Nodemailer builds List-* headers (List-Unsubscribe, List-Subscribe, List-Post, List-Help, List-Owner, List-Archive, List-ID) from the caller-provided `list.*.comment` field, it does not remove CR (\r) or LF (\n) characters before inserting the comment into the header value. The vulnerable code in lib/mailer/mail-message.js constructs these as "prepared" headers that bypass the normal header-value sanitizer. These prepared headers are passed directly to mimeFuncs.foldLines(), causing CRLF sequences to be emitted as actual header boundaries in the RFC822 message. An attacker who can control the list comment field (for example, via a lower-privileged application account or unauthenticated API endpoint) can inject additional email headers such as X-Custom-Header. The attack requires no user interaction and affects message metadata interpretation. Patch available in version 8.0.9; versions through 8.0.8 are confirmed vulnerable, and the code path exists in older versions (at least v3.1.8 and v4.3.0) but was not comprehensively tested.

Affected products

Nodemailer Nodemailer <= 8.0.8

Identifiers

CVE-2026-82661
GHSA-268h-hp4c-crq3

Timeline

2026-05-26: disclosed
2026-05-26: patched: Patch released as version 8.0.9

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.