Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-82854 |
| Alert Source | GitHub Advisory - Critical vulnerability |
| CVE Year | 2026 |
| Publication Date | 2026-08-31 |
| Vendor | Nodemailer |
| Product | Nodemailer (npm), versions before 8.0.4 |
| CVSS Score | 9.8 (Critical) |
| EPSS Score | No data |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
Source: NVD / GitHub Advisory
Nodemailer before version 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.size parameter.
The mechanism is straightforward: when an application passes a custom envelope object with a size property to sendMail(), that value is concatenated into the SMTP MAIL FROM command (as SIZE=...) without stripping control characters. If the value contains CRLF characters, an attacker terminates the current protocol command and appends their own.
Exploitation requires the application to pass envelope.size derived from external input. That limits the reach — not every application builds its own envelope object — but where it does, the vector is fully remote and requires no authentication against the library itself.
One consequence is sending messages outside the application’s control through the organisation’s authenticated SMTP server — borrowing a trusted sender reputation for phishing.
Fix: Nodemailer 8.0.4.
Required Actions
- Upgrade Nodemailer to 8.0.4 or later. Check transitive dependencies too — Nodemailer is often pulled in by higher-level frameworks and libraries, not only directly.
- Review the code for
sendMail()calls using a customenvelopeobject. If thesizevalue derives from user input, treat that as a priority. - Run
npm auditacross your Node.js projects to inventory versions across the application portfolio. - Check SMTP server logs for unusual command sequences or messages sent to recipients outside the expected range.
Who Is Affected?
The vulnerability affects Node.js applications using the Nodemailer library in versions older than 8.0.4.
Nodemailer is the default way to send mail from Node.js applications — transactional email, notifications, password resets and order confirmations. In practice that means virtually every web application built in this ecosystem: online stores, SaaS platforms, customer portals and internal systems.
Given that scale of use, treat this as an inventory task rather than a point fix: the question is not “do we use Nodemailer” but “in how many applications, and at which versions”.
Sources
Need help securing your systems? nFlo team offers vulnerability management and web application penetration testing services. Contact us.
