AIKIDO-2026-10942
nodemailer is vulnerable to CRLF Injection
54
Medium Risk
This Affects:
nodemailerTL;DR
Nodemailer constructs List-* headers from the caller-provided list message option using internally prepared header values. The list.*.comment field is inserted into those prepared values without removing CR ( ) or LF ( ) characters. Because prepared headers bypass the normal header-value sanitizer and are passed to mimeFuncs.foldLines(), a CRLF sequence in a list comment is emitted as an actual header boundary in the generated RFC822 message.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
nodemailer is vulnerable to CRLF Injection in versions 0.0.0 - 8.0.8.
How to fix this
Upgrade the nodemailer library to the patch version.
Links
GitHub Release
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.