CVE-2026-82661 Nodemailer CRLF Injection via List-* Header Comments
Attackers can inject CRLF sequences into email headers via list comments, altering message semantics and client behavior in Nodemailer.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-82661?
CVE-2026-82661 is a medium-severity vulnerability in nodemailer, published on 31 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Nodemailer before 8.0.9 fails to sanitize carriage return and line feed characters in list comment fields, allowing attackers to inject arbitrary message headers. An attacker with control over list.*.comment parameters can inject CRLF sequences to create additional headers in generated RFC822 messages, altering mail client behavior and message semantics.
Weakness: CWE-93
Which versions are affected by CVE-2026-82661?
2 open source packages ship an affected version, including nodemailer.
| Package | Affected | Fixed in |
|---|---|---|
nodemailer npm | All versions | 8.0.9 |
nodemailer npm | All versions | 8.0.9 |
How do I fix CVE-2026-82661?
Upgrade nodemailer to 8.0.9 or later.
Is CVE-2026-82661 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-82661 exists.
Sources
Also known as CLSA-2026-1784596338, DEBIAN-CVE-2026-82661, ECHO-72a1-437a-b6a9, GHSA-268h-hp4c-crq3, GHSA-2jv2-wqrj-g6x7, MINI-2w55-h3h4-vr8p and 17 more.