A critical (CVSS 9.8) SMTP command injection flaw in Nodemailer lets attacker-controlled input in the envelope.size parameter smuggle arbitrary SMTP commands into outbound mail transactions.
What Is It
CVE-2026-82854 is a CRLF injection / SMTP command injection vulnerability (CWE-93, "Improper Neutralization of CRLF Sequences") in the Nodemailer Node.js mail library. When an application passes a custom envelope object to sendMail() and that object carries a size property containing CRLF characters, Nodemailer concatenates the value into the SMTP MAIL FROM command as SIZE=... without sanitization. The embedded newlines terminate the command line, letting an attacker append arbitrary SMTP verbs, most notably RCPT TO, to the in-flight transaction.
VulnCheck, the disclosing source, rates it CVSS 3.1 9.8 CRITICAL (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and CVSS 4.0 9.3 CRITICAL. The attack is network-based, requires no privileges, and needs no user interaction.
Why It Matters
Injected RCPT TO commands can add attacker-controlled recipients to messages the application believes are going somewhere else. In a reachable deployment, that can turn an affected mailer into a channel for exfiltrating message contents, password reset links, invoices, tokens, notifications, without touching the application's own recipient logic, and potentially without leaving an obvious trace in application-side mail logs. How much a given deployment actually exposes depends on what its outbound mail carries and on what SMTP-server-side controls and transport logging are in place.
CVE-2026-82854 does not appear in the CISA Known Exploited Vulnerabilities catalog as of publication, so there is no publicly confirmed active exploitation and no KEV-mandated remediation deadline at this time. That is an absence of evidence rather than an assurance that exploitation is not occurring.
What's Vulnerable
Per the vendor advisory data, nodemailer is affected at all versions below 8.0.3; 8.0.3 and later are listed as unaffected. Note the CVE description states the issue affects Nodemailer "before 8.0.4," which conflicts with the structured version range; treat 8.0.4 as the safe target until upstream clarifies.
Exploitation is not universal: it requires the application to expose the envelope size value to attacker-controlled input. Nodemailer does not include size in its default auto-constructed envelope, so deployments that never build a custom envelope appear unlikely to be reachable through this specific path. That should not be read as a guarantee of safety; indirect paths where user data reaches an envelope object through a framework, wrapper, or shared helper are easy to miss, so upgrading remains the reliable fix.
Patch Status
Upgrade Nodemailer to a fixed release, 8.0.4 satisfies both stated ranges. Applications that construct custom envelopes should additionally verify that no user-supplied data reaches envelope.size.
Sources
- Nodemailer GitHub Security Advisory GHSA-c7w3-x93f-qmm8; https://github.com/nodemailer/nodemailer/security/advisories/GHSA-c7w3-x93f-qmm8
- VulnCheck Advisory; https://www.vulncheck.com/advisories/nodemailer-before-8.0.3-smtp-command-injection-via-envelope-size
- NVD, CVE-2026-82854 (published 2026-08-31, status: Received)
- CISA Known Exploited Vulnerabilities Catalog; https://www.cisa.gov/known-exploited-vulnerabilities-catalog