GHSA-c7w3-x93f-qmm8

What it actually does

Nodemailer improperly handles the `envelope.size` parameter when constructing SMTP commands. If an application allows attacker-controlled input to influence this value, the attacker may inject SMTP command delimiters or additional SMTP commands into the outbound mail transaction. This is a command-injection issue at the SMTP protocol layer rather than operating-system command execution; impact depends on the SMTP server, relay policy, authentication context, and how the affected application builds mail envelopes.

Why it matters to the business

Applications using vulnerable Nodemailer versions may allow attackers to manipulate outbound email behavior, potentially causing unauthorized email transmission, message tampering, abuse of trusted mail infrastructure, spam or phishing relay activity, sender reputation damage, mail delivery disruptions, and incident response costs. Although this issue is not currently listed in CISA KEV and no public exploit maturity is indicated, email infrastructure abuse can have high operational impact because trusted application mail channels are often whitelisted by users, partners, and receiving mail systems.

How an attack unfolds

An attacker first finds an application feature that sends email using Nodemailer and identifies whether any user-controlled value can reach the mail envelope `size` field. They then submit a crafted value containing SMTP control characters or command separators intended to alter the SMTP conversation. When the vulnerable Nodemailer version constructs the SMTP command, the unsanitized value is embedded into the command stream. The downstream SMTP server may interpret the injected content as additional SMTP commands, allowing the attacker to influence the mail transaction beyond the application's intended behavior. The practical result may include unauthorized recipient manipulation, relay abuse, message handling changes, or SMTP-session disruption, depending on relay configuration and server-side protections.

How to fix it

Upgrade Nodemailer to version 8.0.4 or later. For npm-based projects, update the direct dependency and regenerate the lockfile so deployments cannot resolve back to a vulnerable version. If immediate upgrade is not possible, ensure `envelope.size` is never populated from user-controlled input, strictly validate it as a bounded positive integer, reject any value containing non-digits or control characters, and prefer omitting the field unless explicitly required. Add defense-in-depth controls on SMTP relays, including authenticated submission, recipient/domain restrictions, rate limits, command pipelining protections where applicable, and monitoring for abnormal outbound mail behavior.

How to confirm the fix worked

Confirm all deployed applications and build artifacts resolve `nodemailer` to 8.0.4 or later using package lockfiles, software composition analysis, container image scans, and runtime dependency inspection. Search application code for Nodemailer transport calls and explicit `envelope` objects, especially assignments to `envelope.size`, and verify the value is either absent, internally calculated, or strictly numeric. In a non-production test environment, attempt to submit control characters such as CRLF sequences into any field that could influence `envelope.size` and confirm the application rejects the input or Nodemailer safely handles it after upgrade. Review SMTP relay logs before and after remediation for malformed commands, unexpected recipients, and anomalous outbound mail volume.

Typical attack path

1. Identify a web application, API, job processor, or service that sends email through Nodemailer.
2. Determine whether user-controllable input can influence the Nodemailer envelope options, especially `envelope.size`.
3. Craft an input value containing SMTP metacharacters, line breaks, or command-like content designed to alter the SMTP command sequence.
4. Trigger the application to send an email using the vulnerable Nodemailer version.
5. Observe whether the SMTP relay accepts unexpected commands, altered recipients, abnormal message flow, or transaction errors.
6. Use successful injection to abuse the trusted mail path, disrupt mail delivery, or manipulate outbound SMTP behavior.

How to detect it

To determine whether exploitation already occurred, correlate application events that trigger outbound email with SMTP relay logs. Focus on periods where vulnerable Nodemailer versions were deployed and inspect SMTP server logs for malformed SMTP commands, embedded line breaks in command parameters, unexpected extra SMTP commands during a single mail transaction, abnormal recipient counts, unusual bounce patterns, spikes in outbound mail volume, or mail sent to domains not normally contacted by the application. Review application logs for validation errors, unusual values submitted to email-sending endpoints, and stack traces or SMTP errors around `MAIL FROM`, `SIZE`, `RCPT TO`, or transaction sequencing. If relay logs preserve raw SMTP dialogue, search for CRLF-style command injection patterns and SMTP commands appearing where a numeric SIZE parameter should appear. Also review outbound mail queues, abuse desk complaints, DMARC/SPF/DKIM failure reports, and sender reputation alerts for signs of relay abuse.

• nodemailer@<8.0.4
• envelope.size
• MAIL FROM
• SIZE=
• RCPT TO:
• DATA
• RSET
• VRFY
• EXPN
• SMTP command injection
• Invalid command
• bad sequence of commands
• 503 Bad sequence of commands
• 500 Syntax error
• 501 Syntax error in parameters or arguments
• CRLF
• \r\nMAIL FROM
• \r\nRCPT TO
• \r\nDATA
• \r\nRSET

What your security team should do

• Inventory applications, services, serverless functions, containers, and build pipelines that include the npm package `nodemailer`.
• Prioritize upgrading all affected deployments to `nodemailer` 8.0.4 or later and ensure lockfiles are updated and redeployed.
• Search codebases for `envelope.size` usage and remove or strictly validate any path where it can be influenced by external input.
• Review outbound SMTP relay policies to limit abuse from application credentials, including recipient restrictions, rate limits, and alerting on unusual sending patterns.
• Add SCA checks to CI/CD to prevent reintroduction of vulnerable Nodemailer versions.
• Review recent mail server logs for malformed SMTP sessions, injected-looking SMTP commands, abnormal recipient expansion, bounce storms, or spikes in outbound messages.
• If suspicious activity is found, rotate affected SMTP credentials or API tokens, preserve SMTP/application logs, and investigate whether unauthorized emails were sent.