CVE-2026-82853

The record

Nodemailer versions before 8.0.5 contain an SMTP command injection vulnerability in the transport name option used in EHLO/HELO commands. The name parameter is concatenated directly into SMTP commands without sanitizing carriage return and line feed characters, allowing attackers to inject arbitrary SMTP commands for email spoofing and phishing attacks.

Affected packages

Related vulnerabilities

• CVE-2026-114720 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command… CWE-93
• CVE-2026-55467 OpenPrinting CUPS is an open source printing system for Linux and other Unix-like… CWE-93
• CVE-2026-102938 virtualenv is a tool for creating isolated virtual python environments. CWE-93
• CVE-2026-86813 The MetForm WordPress plugin before 4.1.9 does not properly neutralize newline characters… CWE-93
• CVE-2026-19862 The JetFormBuilder WordPress plugin before 3.6.5.2 does not validate or strip line breaks… CWE-93
• CVE-2026-48019 Laravel is a web application framework. CWE-93
• CVE-2026-75925 Improper neutralization of CRLF sequences in IXON VPN Client before version 1.4.7 allows… CWE-93
• CVE-2026-84379 HTTPX2 is a next generation HTTP client for Python. CWE-93