GHSA-vvjj-xcjg-gr5g

What it actually does

Nodemailer is vulnerable to SMTP command injection when attacker-controlled input reaches the transport `name` option used in the SMTP `EHLO`/`HELO` greeting. If the value contains carriage-return/line-feed sequences, the SMTP client can emit additional attacker-supplied SMTP commands to the mail server as part of the same connection. The impact is constrained by what the connected SMTP server accepts and by the privileges, relay permissions, and authentication context of the configured mail account, but it can allow unintended SMTP protocol actions such as manipulating mail transaction flow or attempting unauthorized message submission through a trusted application path.

Why it matters to the business

Applications that use affected Nodemailer versions and allow untrusted data to influence SMTP transport configuration could have their mail-sending workflow abused. Consequences may include unauthorized or malformed email delivery attempts, mail relay abuse, sender reputation damage, confusing audit trails in mail infrastructure, and disruption to transactional email. The CVSS score is moderate and there is no known KEV listing or mature public exploitation reported, but Nodemailer is a common npm dependency, so exposure should be assessed wherever application code dynamically builds mail transports.

How an attack unfolds

An attacker first needs a path to influence the Nodemailer SMTP transport `name` option, either directly through application input or indirectly through configuration values derived from user-controllable data. They then include CRLF characters followed by SMTP protocol text in that value. When the vulnerable Nodemailer version opens an SMTP session, it sends the crafted value in the `EHLO` or `HELO` command. Because the injected line breaks are not safely neutralized, the SMTP server may interpret subsequent attacker-controlled text as separate SMTP commands. Successful exploitation depends on the SMTP server state machine, authentication requirements, relay policy, and whether the application exposes the vulnerable option to untrusted input.

How to fix it

Upgrade Nodemailer to version 8.0.5 or later. For npm-based projects, update the direct dependency and regenerate lockfiles, then redeploy all affected services. If Nodemailer is present transitively, update the parent package or use package-manager override/resolution mechanisms until the dependency tree resolves to a fixed version. As defense in depth, do not allow untrusted input to set SMTP transport options, especially the `name` option; validate hostname-like values against a strict allowlist or hostname regex; reject or strip CR, LF, and other control characters from mail transport configuration; and restrict SMTP credentials to the minimum relay permissions required.

How to confirm the fix worked

Confirm that dependency manifests and lockfiles resolve `nodemailer` to 8.0.5 or later using tools such as `npm ls nodemailer`, software composition analysis, or CI dependency checks. Review application code for `createTransport` calls and verify that the SMTP transport `name` option is static, trusted, or strictly validated. Add regression tests that attempt to pass values containing `\r`, `\n`, `%0d`, `%0a`, or encoded CRLF into any mail configuration path and confirm they are rejected or neutralized. Where feasible, inspect outbound SMTP traffic in a test environment and verify that `EHLO`/`HELO` is emitted as a single valid greeting line with no attacker-controlled extra commands.

Typical attack path

1. Identify an application using Nodemailer below version 8.0.5 for SMTP delivery.
2. Find an input, configuration field, tenant setting, integration setting, or API parameter that influences the Nodemailer transport `name` option.
3. Submit a crafted value containing CRLF sequences followed by additional SMTP command text.
4. Trigger application behavior that causes Nodemailer to initiate an SMTP connection.
5. Nodemailer sends `EHLO` or `HELO` with the injected line breaks to the SMTP server.
6. The SMTP server interprets injected lines as additional SMTP commands if its protocol handling and session state allow it.
7. Attacker attempts to cause unauthorized SMTP actions, mail relay behavior, malformed message submission, or mail-flow disruption.

How to detect it

To determine whether exploitation already occurred, review application logs for recent changes to SMTP configuration or mail transport settings containing CRLF encodings, control characters, or suspicious SMTP keywords. Inspect mail server logs for malformed or unusual `EHLO`/`HELO` greetings from application hosts, especially greetings followed immediately by unexpected `MAIL FROM`, `RCPT TO`, `DATA`, `RSET`, `VRFY`, `EXPN`, or `QUIT` commands in the same session. Correlate anomalies with spikes in outbound mail, rejected relay attempts, unusual sender or recipient domains, authentication by application SMTP accounts at abnormal times, or messages lacking expected application metadata. If packet captures or SMTP gateway telemetry are available, search for SMTP greetings containing embedded line breaks or URL-encoded CRLF patterns that resolve to multi-line command injection. Also examine audit logs for user- or API-driven updates to email integration settings around suspicious mail activity.

• nodemailer < 8.0.5
• EHLO.*\\r\\n
• HELO.*\\r\\n
• %0d%0aMAIL FROM
• %0D%0AMAIL FROM
• %0d%0aRCPT TO
• %0D%0ARCPT TO
• %0d%0aDATA
• %0D%0ADATA
• %0d%0aRSET
• %0D%0ARSET
• %0d%0aVRFY
• %0D%0AVRFY
• %0d%0aEXPN
• %0D%0AEXPN
• %0d%0aQUIT
• %0D%0AQUIT
• EHLO * MAIL FROM
• HELO * MAIL FROM

What your security team should do

• Inventory applications and services that include `nodemailer`, prioritizing internet-facing applications, multi-tenant applications, and systems where users can configure email settings.
• Upgrade all affected deployments to `nodemailer` 8.0.5 or later and verify lockfiles and deployed artifacts reflect the fixed version.
• Search codebases for dynamic use of the Nodemailer transport `name` option and remove any dependency on untrusted input.
• Add validation to reject CRLF and other control characters in SMTP-related configuration fields.
• Review SMTP relay permissions and restrict service accounts to approved sender domains, recipient scopes, and rate limits.
• Monitor mail infrastructure for anomalous `EHLO`/`HELO` lines, unexpected SMTP command sequencing, and unusual mail submission volume from application accounts.
• Add dependency scanning gates to CI/CD to prevent reintroduction of vulnerable Nodemailer versions.