CVE-2021-23400 HTTP Header Injection
Attackers can inject HTTP headers via unsanitized input in nodemailer, potentially manipulating email delivery or metadata.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-23400?
CVE-2021-23400 is a medium-severity vulnerability in nodemailer, published on 29 Jun 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain newlines and carriage returns is passed into an address object.
Weakness: CWE-74
Which versions are affected by CVE-2021-23400?
2 open source packages ship an affected version, including nodemailer. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
nodemailer npm | All versions | 6.6.1 |
nodemailer npm | All versions | 6.6.1 |
Products include Nodemailer Nodemailer.
How do I fix CVE-2021-23400?
Upgrade nodemailer to 6.6.1 or later.
Is CVE-2021-23400 being exploited?
There is no known exploitation of CVE-2021-23400 in the wild and no public exploit code.
Other vulnerabilities in nodemailer
Sources
Also known as DEBIAN-CVE-2021-23400, GHSA-hwqf-gcqm-7353, UBUNTU-CVE-2021-23400.