CVE-2026-82661

Executive Summary

CVE-2026-82661 is a CRLF injection vulnerability in Nodemailer, a widely used Node.js email-sending library, affecting versions prior to 8.0.9. The flaw resides in the library's failure to sanitize carriage return (CR) and line feed (LF) characters within list comment fields, enabling attackers with control over the list.*.comment parameters to inject arbitrary message headers into generated RFC822 (email) messages. Successful exploitation alters mail client behavior and message semantics, potentially leading to phishing, spoofing, or bypass of email client security controls.

The vulnerability carries a CVSS score of 5.4 (Medium) with a low EPSS score of 0.00190, indicating limited in-the-wild exploitation activity at the time of reporting. No public PoC, Nuclei template, or exploit code is currently available, and the CVE is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. The attack does not require user interaction but requires low-privilege authenticated access, and can result in limited confidentiality and integrity impacts.

Technical Analysis

The vulnerability class is CRLF injection (CWE-93), a well-understood injection flaw where unsanitized carriage return (0x0D) and line feed (0x0A) characters are embedded into data that is subsequently processed as part of a protocol or structured message. In this case, Nodemailer versions before 8.0.9 fail to sanitize these characters in list comment fields — parameters named with the list.*.comment pattern, which are used to provide human-readable descriptions for RFC 2919/2369 list headers (e.g., List-Unsubscribe, List-Archive, List-Help).

The attack mechanism is as follows: an application using Nodemailer accepts user-supplied or attacker-controlled values for list.*.comment fields, which the library subsequently string-concatenates into the email headers of generated RFC822 messages. Because CR and LF characters are not stripped, normalized, or encoded, an attacker can terminate the current header line prematurely and introduce new header lines of their choosing.

This is significant because email headers are parsed by mail clients and server-side mail transfer agents (MTAs) as structured metadata. Injected headers can:

• Override or duplicate existing headers, altering how clients display message content
• Introduce headers that trigger client-specific behaviors (e.g., auto-reply directives, security warnings, or content-type manipulation)
• Manipulate Reply-To, From, X-Priority, or other semantic headers to shift the perceived origin or precedence of mail
• Potentially alter how mail clients render HTML content, enabling phishing or spoofing

The low privilege requirement (PR:L) in the CVSS vector indicates that an attacker needs some level of authenticated application access to reach the vulnerable parameter — for example, a user-controllable comment field in a mailing-list subscription form or profile settings UI. The attack vector is network-based (AV:N), the complexity is low (AC:L), and no user interaction is required (UI:N). The integrity impact is low (I:L), as header injection permits semantic alteration of outgoing messages, and confidentiality impact is limited (C:L), potentially via header-based data exfiltration or content-transmission manipulation.

The patch (per a single OSV source, confidence 2/4) is implemented in Nodemailer 8.0.9, which presumably sanitizes or encodes CR/LF characters in list comment fields before header construction. Insufficient technical detail is available to confirm the exact sanitization method (e.g., rejection, stripping, or RFC 2047 encoding).

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (CRLF header injection) and the NVD description. All steps are described at the abstraction level supported by the data provided.

Step 1 — Reconnaissance / Target Identification: An attacker identifies a web application built on Node.js that uses Nodemailer versions prior to 8.0.9 as its email dispatch engine. Common targets include contact forms, forum notification systems, e-commerce order confirmation pipelines, newsletters, or any service that sends automated emails. The attacker locates an application endpoint that accepts user input eventually routed to a Nodemailer list.*.comment parameter — typically a mailing-list management interface, or a setting where users can customize email subscription metadata.

Step 2 — Triggering the Flaw: The attacker submits a crafted comment value containing CRLF sequences followed by header-name/value pairs. Because the library concatenates the comment string directly into the RFC822 header block without sanitization, the crafted input prematurely terminates the current list header line and inserts one or more new headers. Due to the privilege requirement (PR:L), the attacker must have a valid low-privilege account or access to an input surface that accepts list comment data.

Step 3 — Payload Execution: The attack payload is a user-supplied string containing %0d%0a (URL-encoded CRLF) sequences followed by arbitrary header data. At the vulnerability-class level, injection of two consecutive CRLF sequences could terminate the entire header section and potentially begin a new message body, though the NVD description specifically scopes the impact to header injection and mail client behavior. Example high-level payloads target header fields that alter message rendering, such as content-type overrides or additional Reply-To directives.

Step 4 — Post-Exploitation Impact: Successful CRLF injection results in the generation of compromised RFC822 messages with attacker-controlled headers. The mail client receiving such messages may display misleading metadata, report incorrect sender information, or trigger automatic processing directives. In enterprise contexts, this could facilitate targeted phishing campaigns with forged header semantics, or induce mail clients to render messages in a manner that increases social-engineering click-through rates. Given the low integrity impact rating, the attacker does not gain full message-body control but can meaningfully influence header-derived behavior.

Impact Assessment

From a CVSS perspective (5.4 Medium), the vulnerability offers a network attack vector with low attack complexity, authenticated low-privilege access, no user interaction, and partial confidentiality and integrity impacts without any availability impact. The vector string AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N reflects that the primary business impact is on message-integrity trust and, to a limited degree, disclosure.

Affected Systems: All applications using Nodemailer versions prior to 8.0.9 that pass unfiltered user input into list comment parameters. Given Nodemailer's popularity in the Node.js ecosystem — with hundreds of thousands of monthly downloads — the potential installation footprint is broad, particularly in enterprise email-automation and notification services.

Blast Radius: The direct blast radius is limited to outgoing email message generation. The security boundary that is crossed is the trust boundary between application user input and email protocol message structure. Successful exploitation does not result in server-side code execution, database compromise, or lateral network movement; however, the integrity of outbound email is compromised, which can undermine the trust that receiving mail clients and users place in organizational communications. In enterprises where email security is predicated on header-based filtering or client-side semantic detection, injected headers could enable bypass of spam/phishing detection that relies on header consistency.

Business Impact: Organizations relying on Nodemailer for transactional or bulk email face potential reputation damage, delivery-routing anomalies, and increased susceptibility of their email recipients to phishing attacks — particularly if the injected headers are used to disguise the message's true origin or to alter mail client security. The low EPSS score (0.00190) suggests that, at present, exploitation in the wild is rare and the risk of immediate campaign activity is low; however, the availability of a claimed patch implies coordinated disclosure and an expected uptick in targeted scans once security scanners integrate a check for Nodemailer version 8.0.9.

Detection Guidance

The following detection rules target the application layer (email generation and web request parsing) and network layer where possible. Since CRLF injection more commonly manifests in logged application parameters and generated email content, detection will be most effective when layered across web-application logs, SMTP transaction logs, and host-level process logging.

Sigma Rule

title: Nodemailer CRLF Injection in List Comment Parameters
id: 5312e4f6-8a1b-4c0d-9e2f-3a4b5c6d7e8f
status: experimental
description: Detects potential CRLF injection attempts targeting Nodemailer list.*.comment parameters. Applies to web application access logs and application audit logs.
logsource:
    category: webserver
    product: apache
detection:
    selection_crlf_encoded:
        - http.params:
              contains: '%0d%0a'
              contains: '%0D%0A'
        - http.request.params|contains|all:
              - 'list.'
              - '.comment'
    selection_crlf_raw:
        - http.params:
              regex: 'list\.[a-zA-Z0-9_]+\.comment=.*\x0d\x0a'
    condition: selection_crlf_encoded or selection_crlf_raw
level: medium
falsepositives:
    - Legitimate multi-line comment input in some rare form-filling scenarios (unlikely given strict RFC822 header formatting).
fields:
    - src_ip
    - http.user_agent
    - http.request.method
    - http.params
tags:
    - attack.t1190
    - cve.2026.82661
    - cwe.93

YARA Rule

rule Nodemailer_CRLF_Injection_List_Comment
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects CRLF injection payload patterns in list comment parameters targeting Nodemailer < 8.0.9"
        cve = "CVE-2026-82661"
        cwe = "CWE-93"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-82661"
        date = "2026-01-01"
        severity = "medium"

    strings:
        // URL-encoded CRLF variations
        $enc1 = "%0d%0a" ascii
        $enc2 = "%0D%0A" ascii
        // Raw CRLF sequences
        $raw1 = "\x0d\x0a" ascii
        // Request parameter pattern
        $param1 = "list." ascii
        $param2 = ".comment" ascii
        // Common injected header names
        $hdr1 = "Content-Type:" ascii
        $hdr2 = "Reply-To:" ascii
        $hdr3 = "X-Priority:" ascii
        $hdr4 = "Disposition-Notification-To:" ascii

    condition:
        uint16(0) == 0x0A0D or
        (any of ($enc*) and $param1 and $param2) or
        (any of ($raw*) and $param1 and $param2) or
        (any of ($enc*) and any of ($hdr*)) or
        (any of ($raw*) and any of ($hdr*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-82661 Nodemailer CRLF Injection in List Comment Fields"; flow:to_server,established; content:"list."; http_uri; content:".comment"; http_uri; pcre:"/list\.[a-zA-Z0-9_]+\.comment=.*%0[dD]%0[aA]/Ui"; classtype:attempted-admin; sid:2026826611; rev:1; metadata:cve CVE-2026-82661, cwe CWE-93, attack_target web-server, tag crlf-injection;)

alert smtp any any -> any any (msg:"CVE-2026-82661 Nodemailer CRLF Injection - SMTP Header Artifacts"; flow:to_server,established; content:"List-Help:"; nocase; content:"|0d 0a|"; within:4096; pcre:"/(Content-Type|Reply-To|X-Priority|Disposition-Notification-To|Bcc|Cc):/i"; classtype:attempted-admin; sid:2026826612; rev:1; metadata:cve CVE-2026-82661, cwe CWE-93, tag header-injection;)

Note: The first rule monitors HTTP-layer parameters that may be feeding the vulnerable Nodemailer input. The second rule inspects SMTP protocol streams for characteristics of generated headers that may contain injection artifacts.

Elastic Detection

# Elastic EQL detection rule for CVE-2026-82661
# Applies to web access logs where HTTP parameters are structured fields

eql:
    operation: any
    query: |
        any where 
            stringContains(http.params, "%0d%0a") or
            stringContains(http.params, "%0D%0A") or
            stringContains(http.params, "list.") and
            stringContains(http.params, ".comment") and
            (stringContains(http.params, "Content-Type:") or
             stringContains(http.params, "Reply-To:") or
             stringContains(http.params, "X-Priority:") or
             stringContains(http.params, "Disposition-Notification-To:"))

Splunk SPL Query

index=* sourcetype=access_combined OR sourcetype=iis OR sourcetype=apache
  (form_data="*list.*" form_data="*.comment*")
  (form_data="*%0d%0a*" OR form_data="*%0D%0A*" OR form_data="*%0d%0A*" OR form_data="*%0D%0a*")
  OR (uri_query="*list.*.comment*" uri_query="*%0d%0a*")
  | eval crlf_present = if(match(form_data, "(?i)(%0d%0a|%0D%0A)") OR match(uri_query, "(?i)(%0d%0a|%0D%0A)"), "yes", "no")
  | where crlf_present == "yes"
  | table _time, src_ip, user_agent, uri_path, form_data, status
  | stats count by src_ip, uri_path
  | sort - count

Wazuh OSSEC Rule

<group name="nodemaler_crlf_injection,">

  <!-- CVE-2026-82661: Nodemailer before 8.0.9 CRLF injection in list comment fields -->
  <rule id="100261" level="8">
    <decoded_as>json</decoded_as>
    <field name="url">\.list\.[a-zA-Z0-9_]+\.comment</field>
    <regex>%0[dD]%0[aA]</regex>
    <description>CVE-2026-82661: CRLF injection attempt in Nodemailer list comment parameter</description>
    <group>nodemaler_crlf_injection,cve_2026_82661,cwe_93,</group>
  </rule>

  <rule id="100262" level="8">
    <if_sid>100261</if_sid>
    <regex>Content-Type:|Reply-To:|X-Priority:|Disposition-Notification-To:</regex>
    <description>CVE-2026-82661: CRLF injection with additional header injection detected (suspicious header)</description>
    <group>nodemaler_crlf_injection,cve_2026_82661,cwe_93,</group>
  </rule>

</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED) — A single OSV source claims that Nodemailer 8.0.9 addresses the CRLF sanitization flaw. This has not been independently verified by the Valtersit research team. Organizations are advised to treat this as provisional and to verify the patch behavior in their own test environments.

1 — Immediate Mitigations:

• Disable or restrict user-controlled values in list.*.comment parameters. If the application does not require user-supplied list comments, hard-code or freeze these values to prevent any external input reaching the vulnerable surface.
• Add input validation and sanitization at the application layer. Before passing any value to Nodemailer list comment fields, apply a sanitization function that rejects or strips control characters (CR/LF, %0d, %0a in both upper and lowercase hexadecimal forms). Reject requests containing raw \r or \n bytes, or their percent-encoded equivalents.
• Deploy a Web Application Firewall (WAF) rule to block requests whose parameters contain CRLF encoding sequences in list-related fields (see detection rules above).

2 — Patch / Upgrade Steps:

• Locate the Nodemailer version in your dependency tree via npm list nodemailer (npm ls nodemailer for non-legacy listing).
• Upgrade to Nodemailer version 8.0.9 or newer: npm update nodemailer@latest or explicitly npm install nodemailer@8.0.9 --save.
• After upgrading, validate that the library rejects CRLF sequences in list.*.comment values. Run a unit test that submits a comment containing %0d%0aContent-Type: text/html and verify no such header appears in the generated message.
• Rebuild and redeploy the application; update container images/lockfiles accordingly.

3 — Long-Term Hardening:

• Adopt a dependency-scanning program (e.g., npm audit, Snyk, Dependabot) that alerts on vulnerable library versions immediately upon advisory publication.
• Enforce least-privilege access to application endpoints that control email-generation parameters — the PR:L (low privilege required) vector indicates the attack surface is authenticated but lower-trust, so review which authenticated roles genuinely need the ability to set list metadata.
• Review email-generation code paths to compress these values into a restricted allowlist format, minimizing free-form input.
• Include header-injection test cases in your CI/CD pipeline for any library that constructs RFC822/SMTP messages.

References

1. NVD Entry — https://nvd.nist.gov/vuln/detail/CVE-2026-82661 (National Vulnerability Database official description, CVSS vector and score 5.4)
2. OSV Advisory — https://osv.dev/vulnerability/CVE-2026-82661 (Source of patch claim: Nodemailer 8.0.9; single-source, unconfirmed)
3. CWE-93 — Improper Neutralization of CRLF Sequences — https://cwe.mitre.org/data/definitions/93.html (Vulnerability class reference)
4. Nodemailer Project — https://github.com/nodemailer/nodemailer (Official project home; check CHANGELOG for 8.0.9 release notes)
5. CISA KEV Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog (Confirmed entry NOT found for CVE-2026-82661 as of report date)

Threat Actor Campaigns / In-the-Wild Evidence: None identified at the time of writing. No PoC, exploit code, Nuclei template, or threat-intel data indicates active exploitation. The low EPSS percentile (8.7%) further corroborates minimal observed exploit attempts. However, the public disclosure of a patch implies the vulnerability is known to researchers and will likely be incorporated into scanner tooling soon, elevating the risk of automated discovery.