Executive brief
Nodemailer, a popular Node.js library for sending emails, is vulnerable to a header injection flaw. If an application allows users to provide comments for mailing list headers (like Unsubscribe or Help), an attacker can insert special characters to add their own arbitrary headers to the email. This could be used to bypass spam filters, spoof email metadata, or manipulate how mail clients display the message.
Technical details
A CRLF injection vulnerability exists in Nodemailer's handling of 'List-*' headers (e.g., List-Help, List-Unsubscribe, List-ID). The vulnerability occurs because the 'comment' field within the 'list' message option is inserted into 'prepared' header values without sanitizing carriage return (\r) or line feed (\n) characters. Since these headers are marked as 'prepared', they bypass the standard header-value sanitizer. An attacker who can influence these comment fields can inject arbitrary RFC822 headers into the generated message. This was confirmed in version 8.0.8 and is addressed in version 8.0.9.
Affected products
- nodemailer nodemailer <= 8.0.8
Timeline
- 2026-05-26: disclosed
- 2026-06-15: advisory
- 2026-06-15: patched: Fixed in version 8.0.9