CVE-2026-82854

Nodemailer before 8.0.4 fails to sanitize the envelope.size parameter, which is concatenated directly into the SMTP MAIL FROM command (as the SIZE=... argument) when a message is sent. If an application passes sendMail() a custom envelope object whose size property contains attacker-controlled CRLF characters, the injected bytes break out of the MAIL FROM line and allow arbitrary SMTP commands to be injected, such as RCPT TO. This lets an attacker silently add attacker-controlled recipients to emails sent by the application, meaning the attacker can receive copies of the message content or otherwise manipulate the SMTP session. Only applications that expose the envelope size to attacker-controlled input are exploitable, because Nodemailer's default auto-constructed envelope never includes a size property. There is no public proof-of-concept, the flaw is not in the CISA KEV, and EPSS estimates roughly a 1.1% chance of exploitation within 30 days, so no confirmed in-the-wild exploitation is currently known.

What to do: Upgrade Nodemailer to 8.0.4 or later. Until patched, audit any code that passes a custom envelope object to sendMail() and strip or reject CRLF characters in a user-supplied size value, or omit the size property entirely. Defenders should also check mail server logs for unexpected extra RCPT TO recipients on messages sent via Nodemailer.