Quick answers
- Is CVE-2026-82854 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-82854 being exploited in the wild.
- How severe is CVE-2026-82854?
- Critical severity, with a CVSS score of 9.8, published 31 August 2026.
- Which products and versions are affected?
- Nodemailer <8.0.4.
- Is there a fix for CVE-2026-82854?
- A patch was published on 2026-03-26: Version 8.0.4 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-82854 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-82854?
- Check whether you run Nodemailer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a SMTP command injection flaw in lib/smtp-connection/index.js. The envelope.size parameter is concatenated directly into the SMTP MAIL FROM command without sanitizing CRLF characters, allowing an attacker to terminate the current command and inject new ones. Other envelope fields (from, to, dsn parameters) are properly sanitized, but size is not. The attack requires the application to explicitly pass a custom envelope object to sendMail() — Nodemailer's default auto-generated envelope is not vulnerable. An attacker can inject RCPT TO commands to add hidden recipients, RSET to abort transactions, or other SMTP directives to exploit the server's reputation for spam or phishing. A patch is available in version 8.0.4.
Affected products
- Nodemailer Nodemailer <8.0.4
Identifiers
- CVE-2026-82854
- GHSA-c7w3-x93f-qmm8
Timeline
- 2026-03-26: disclosed
- 2026-03-26: patched: Version 8.0.4 released