Executive brief
Nodemailer is a popular Node.js library for sending emails via SMTP. When applications allow users to customize the envelope object passed to the sendMail() function, an attacker can inject SMTP commands by embedding carriage return and line feed characters in the size parameter, silently adding unauthorized recipients to outgoing emails or executing other arbitrary SMTP commands.
Technical details
The vulnerability is a SMTP command injection flaw in lib/smtp-connection/index.js. The envelope.size parameter is concatenated directly into the SMTP MAIL FROM command without sanitizing CRLF characters, allowing an attacker to terminate the current command and inject new ones. Other envelope fields (from, to, dsn parameters) are properly sanitized, but size is not. The attack requires the application to explicitly pass a custom envelope object to sendMail() — Nodemailer's default auto-generated envelope is not vulnerable. An attacker can inject RCPT TO commands to add hidden recipients, RSET to abort transactions, or other SMTP directives to exploit the server's reputation for spam or phishing. A patch is available in version 8.0.4.
Affected products
- Nodemailer Nodemailer <8.0.4
Timeline
- 2026-03-26: disclosed
- 2026-03-26: patched: Version 8.0.4 released