CVE-2026-82854 nodemailer CVE debrief

Who should care

Developers and administrators using Nodemailer in their applications, especially those exposing envelope size to attacker-controlled input, should be aware of this vulnerability. Security teams and vulnerability management teams should prioritize assessment and remediation of affected systems. Platform operators and security operations teams should monitor for suspicious SMTP activity that could indicate exploitation attempts.

Technical summary

Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.size parameter. An application passing a custom envelope object with a size property containing CRLF characters to sendMail() can lead to injection of arbitrary SMTP commands. This vulnerability can be exploited if the application exposes the envelope size to attacker-controlled input. The vulnerability affects Nodemailer, a popular Node.js email sending library.

Defensive priority

Critical vulnerability in Nodemailer, a popular Node.js email sending library, allowing SMTP command injection via unsanitized envelope.size parameter.

Recommended defensive actions

• Inventory checks for Nodemailer versions before 8.0.4
• Apply vendor remediation when available
• Implement compensating controls such as input validation and sanitization
• Monitor for suspicious SMTP activity
• Review Nodemailer configurations for exposure to attacker-controlled input
• Perform vulnerability scanning to identify potentially affected systems
• Engage with the Nodemailer community or vendor for additional guidance on mitigation and remediation

Evidence notes

Evidence is limited; primary official records indicate Nodemailer before 8.0.4 is vulnerable to SMTP command injection. Vendor remediation and compensating controls are unknown. The vulnerability allows attackers to inject arbitrary SMTP commands via the unsanitized envelope.size parameter. This can lead to the addition of attacker-controlled recipients. Defenders should verify the presence of affected Nodemailer versions in their environments and review the official advisory for specific guidance.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.