AIKIDO-2026-442290

nodemailer is vulnerable to CRLF Injection

CRLF Injection Pre-CVE Published Aug 10, 2026

Medium Risk

This Affects:

nodemailer

3.0.0 - 9.0.4

Fixed in 9.0.5

Are you affected? Scan for Free

TL;DR

Nodemailer builds MIME and RFC822 message headers from caller-supplied fields, including header values, message-id, List-* header comments, MIME parameter continuations, header key callbacks, and DKIM signature tags. Several of these paths do not fully neutralize carriage return, line feed, DEL, and other control characters and do not escape comment delimiters, so externally influenced input can terminate a header and inject additional header lines into the generated message. A related address-parsing gap lets a crafted address normalize differently for the header and the envelope, so a message can be routed to an unintended recipient. The fix strips control characters from emitted headers, encodes DEL, escapes List-* comment specials, validates normalized header keys and DKIM tags, and normalizes parsed addresses so the header and envelope agree.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and your application incorporates externally influenced input into message header values, List-* header comments, DKIM signing fields, header key callbacks, or recipient addresses.