CVE-2026-82853

Executive Summary

CVE-2026-82853 is an SMTP command injection vulnerability in Nodemailer versions prior to 8.0.5, caused by unsanitized carriage return (CR) and line feed (LF) characters in the transport name parameter that is concatenated into EHLO/HELO commands. An attacker who can control the transport name option can inject arbitrary SMTP commands, enabling email spoofing and phishing campaigns against recipients. The vulnerability carries a CVSS score of 4.9 (medium severity) due to the high privilege requirement, but the integrity impact is rated as high. No public PoC, exploit code, or Nuclei template exists as of the report date, and the CVE is not listed on CISA's Known Exploited Vulnerabilities catalog.

Technical Analysis

Vulnerability Mechanism

Nodemailer is a widely used Node.js email-sending library. The vulnerability resides in the way Nodemailer constructs SMTP session initiation commands — specifically the EHLO (Extended Hello) and fallback HELO (Hello) commands. According to the NVD description, the transport name option is concatenated directly into these SMTP commands without sanitizing carriage return (\r) and line feed (\n) characters.

The SMTP protocol, defined in RFC 5321, uses CRLF (\r\n) as the line terminator. Each SMTP command is terminated by CRLF, and any data following the CRLF on the same "line" is treated as a new command by the receiving mail server. This is the classic injection primitive for protocol-level command injection.

In practice, the affected code path likely constructs a command string similar to:

EHLO <name>

where <name> is the user-supplied transport name option. If an attacker supplies a value containing \r\n, the resulting command becomes:

EHLO <legitimate_prefix>\r\nINJECTED_COMMAND\r\n

The receiving SMTP server parses INJECTED_COMMAND as a separate, legitimate SMTP command. Because the server trusts the client's input at this stage of the session, the injected command is processed with the same privileges as any other client-issued SMTP command.

Attack Surface

The attack surface is any application that:

1. Uses Nodemailer versions before 8.0.5.
2. Passes user-controlled or attacker-influenced input into the transport name option.
3. Uses the SMTP transport (as opposed to sendmail or other transports).

The critical prerequisite is that the attacker must have some level of control over the name parameter. This could occur in applications that:

• Allow administrators to configure SMTP connection settings via a web UI.
• Dynamically generate transport names from user profiles, domain names, or other external inputs.
• Use container orchestration or configuration management systems that inject metadata into environment variables ultimately consumed by Nodemailer.

The CVSS vector reflects this: PR:H (high privileges required) — the attacker needs some privileged access, but the network attack vector (AV:N) and low attack complexity (AC:L) mean that once that prerequisite is met, exploitation is straightforward.

Technical Detail Gaps

The NVD description is sparse on implementation specifics — it does not provide the exact function name, parameter name beyond "name option," or the exact code path. Per accuracy rules, we do not speculate on internal Nodemailer API names beyond the term "transport name option" used in the description. The vulnerability class is CWE-93 (Improper Neutralization of CRLF Sequences — "CRLF Injection").

Exploitation Scenarios

Prerequisites:

1. Target application uses Nodemailer < 8.0.5.
2. Attacker must have high-privilege access (authenticated admin, config management access, or other control over transport configuration).

Step 1 — Reconnaissance/Target Identification: The attacker identifies applications using Nodemailer. Methods include:

• Fingerprinting via SMTP banner responses (e.g., X-Powered-By headers in emails, SMTP greeting string anomalies).
• Scanning GitHub/GitLab for public repositories referencing Nodemailer dependencies.
• Examining package-lock.json or yarn.lock files exposed via misconfigured web servers or source code leaks.
• Using Shodan to find exposed Node.js application servers and probing their SMTP connectivity.

Step 2 — Triggering the Flaw: The attacker gains access to a configuration interface that controls the SMTP transport settings. This could be an admin panel, a REST API accepting configuration updates, or an environment variable injection point. The attacker sets the name parameter (transport name) to a crafted payload containing CRLF sequences.

Step 3 — Payload/Execution (Class-Level): The attacker injects a payload such as:

legit_name\r\nMAIL FROM:<spoofed@attacker.com>\r\nRCPT TO:<victim@target.com>\r\nDATA\r\nSubject: Urgent\r\n\r\nPhishing content...

Because the CRLF is not sanitized, the SMTP server receives the injected commands as if they were legitimate client-issued commands after the initial EHLO. The attacker can then:

• Spoof the MAIL FROM envelope address.
• Specify arbitrary RCPT TO recipients.
• Inject DATA commands to send phishing emails with forged sender addresses.

Note: No public PoC exists; this attack chain is inferred from the vulnerability class (SMTP command injection via CRLF) and standard SMTP protocol mechanics.

Step 4 — Post-Exploitation Impact: The attacker uses the compromised Nodemailer instance as an open email relay for spoofed emails. This can be used for:

• Targeted phishing campaigns against the organization's customers or partners — using the legitimately configured mail infrastructure (and its IP reputation) to bypass SPF/DKIM/DMARC checks that would otherwise flag the sender.
• Business email compromise (BEC) style attacks — impersonating executives or vendors.
• Mass spam distribution, potentially leading to the organization's domain being blacklisted.

Impact Assessment

Business Impact:

• Integrity Impact (High): The CVSS integrity subscore is the primary driver of severity (I:H). Attackers can send forged emails that appear to originate from the organization's legitimate domain and infrastructure, undermining the trustworthiness of all email communication.
• Confidentiality Impact (None): The vulnerability does not allow data exfiltration directly.
• Availability Impact (None): No denial-of-service mechanism described.

Affected Systems:

• All applications using Nodemailer < 8.0.5 with the SMTP transport.
• Environments where the name parameter is derived from any input source beyond a hardcoded administrator-controlled constant.

Blast Radius:

• If the Nodemailer instance is used to send transactional or critical business emails (e.g., password resets, financial notifications), spoofed emails could trick recipients into revealing credentials or executing fraudulent actions.
• Reputational damage from the organization's mail servers being used as a spam/ phishing relay.
• Potential for domain/IP blacklisting by major email providers, disrupting legitimate business communications for an extended period.

The CVSS score of 4.9 (Medium) underestimates the real-world impact for organizations where email authenticity is critical, given that the prerequisite of high privileges is often met by administrators of mail systems who are the legitimate users of configuration interfaces.

Detection Guidance

Sigma Rule

title: Nodemailer SMTP Command Injection - Transport Name CRLF
id: 92a3c7d4-ef2d-4b4a-9f3c-2c1b6f0a8e41
status: experimental
description: Detects suspicious SMTP traffic associated with Nodemailer EHLO/HELO commands containing CRLF injection attempts.
author: Valters IT Security Research
date: 2026/03/01
logsource:
  category: network_connection
  product: smtp
detection:
  selection:
    - protocol: smtp
      dest_port: [25, 465, 587, 2525]
      smtp_command: 'EHLO*'
    - protocol: smtp
      dest_port: [25, 465, 587, 2525]
      smtp_command: 'HELO*'
  filter_good:
    smtp_command:
      - 'EHLO *'
      - 'HELO *'
  condition: selection and not filter_good
  fields:
    - src_ip
    - dest_ip
    - smtp_command
falsepositives:
  - Legacy SMTP clients sending malformed EHLO/HELO commands
  - Application-specific transport configurations containing unusual characters
level: high
tags:
  - attack.t1190
  - cve.2026-82853
  - cwe.93

YARA Rule

rule Nodemailer_SMTP_CRLF_Injection
{
    meta:
        author = "Valters IT Security Research"
        description = "Detects Nodemailer transport name parameters containing CRLF sequences for SMTP command injection"
        cve = "CVE-2026-82853"
        cwe = "CWE-93"
        date = "2026-03-01"
        severity = "high"

    strings:
        $smtp_hello = /(EHLO|HELO)\s+\S*/
        $crlf = "\x0d\x0a"
        $smtp_mail = /MAIL FROM:\s*<[^>]*>/ nocase
        $smtp_rcpt = /RCPT TO:\s*<[^>]*>/ nocase
        $smtp_data = "DATA" nocase
        $transport_name = /name\s*[=:]\s*[\x22\x27]?[^\x22\x27]*/ nocase

    condition:
        $smtp_hello and $crlf and (
            $smtp_mail or $smtp_rcpt or $smtp_data
        ) and $transport_name
}

Suricata IDS Rule

alert smtp any any -> any 25,465,587,2525 (msg:"CVE-2026-82853 Nodemailer SMTP Command Injection via Transport Name"; flow:to_server,established; content:"EHLO"; nocase; pcre:"/EHLO\s+[^\r\n]*\x0d\x0a(MAIL FROM|RCPT TO|DATA)/i"; classtype:attempted-admin; sid:100082853; rev:1; reference:cve,2026-82853;)

Elastic Detection

sequence by source.ip with maxspan=5s
  [ network where protocol == "smtp" and destination.port in (25, 465, 587, 2525) and
    network.direction == "outbound" and
    process.executable != null and
    process.command_line like~ "*nodemailer*" ]
  [ network where protocol == "smtp" and destination.port in (25, 465, 587, 2525) and
    network.direction == "outbound" and
    event.action == "network-connection" ]

Note: EQL detection for this exploit is best achieved via application-level logging of the transport name parameter. The above rule flags outbound SMTP connections from processes associated with Nodemailer. For precise detection, monitor application logs for configuration events where the name option contains \r or \n.

Splunk SPL Query

index=network sourcetype=cisco:asa OR sourcetype=pan:traffic OR sourcetype=suricata
| where dest_port IN (25, 465, 587, 2525)
| regex smtp_command="(?i)(EHLO|HELO)\\s+[^\\r\\n]*\\r\\n(MAIL FROM|RCPT TO|DATA)"
| table _time, src_ip, dest_ip, dest_port, smtp_command
| sort - _time

Alternative — application log-based detection:

index=app_logs sourcetype=nodemailer*
| where name LIKE "%\r%" OR name LIKE "%\n%"
| table _time, host, application, name
| sort - _time

Wazuh OSSEC Rule

<group name="nodemailer_smtp,">
  <rule id="701866" level="10">
    <decoded_as>json</decoded_as>
    <field name="event_type">^smtp$</field>
    <field name="dest_port">^(25|465|587|2525)$</field>
    <regex>\\r\\n(MAIL FROM|RCPT TO|DATA)</regex>
    <description>CVE-2026-82853 - Nodemailer SMTP command injection attempt detected</description>
    <group>attack.t1190,smtp_injection,cwe_93,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED) — A single source (OSV) claims a patch exists in Nodemailer 8.0.5, but this has not been independently confirmed. Proceed with caution and verify the fix in your environment.

1. Immediate Mitigations

• Input validation: Implement server-side validation to reject any transport name value containing \r, \n, or %0d, %0a (URL-encoded forms). Apply this at all layers where the parameter is accepted (web UI, API, config file parsing).
• Configuration lockdown: Restrict access to SMTP configuration interfaces to only essential personnel. Apply least-privilege principles to any API or administrative endpoint that can modify transport settings.
• Email monitoring: Temporarily increase monitoring for anomalous outbound SMTP volume and unusual MAIL FROM / RCPT TO patterns from the mail service, as emails sent from a compromised instance may be detectable via spikes in mail flow.

2. Patch/Upgrade Steps

1. Verify the patch claim: Check the official Nodemailer GitHub repository for release notes for version 8.0.5.
2. Upgrade Nodemailer to version 8.0.5 or later in all affected applications:

   npm install nodemailer@^8.0.5
   

3. If using a package manager lockfile, regenerate it to ensure transitive dependencies are also updated.
4. Test the upgraded version in a staging environment to confirm normal SMTP integration and that the transport name parameter is properly sanitized.

3. Long-Term Hardening

• Centralize configuration: Use a central secrets management system (Vault, AWS Secrets Manager) to manage SMTP credentials and transport configuration, reducing the attack surface for direct parameter manipulation.
• Adopt email authentication standards: Ensure SPF, DKIM, and DMARC are properly configured and enforced on outbound mail. This limits the effectiveness of email spoofing via this vector even if exploitation occurs.
• Continuous dependency scanning: Integrate automated dependency scanning (Snyk, Renovate, Dependabot) into CI/CD pipelines to catch vulnerable Nodemailer versions before deployment.
• Network egress control: Restrict outbound SMTP traffic to only authorized mail servers and IP ranges; implement anomaly detection on SMTP traffic patterns.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-82853
2. OSV Database Entry: https://osv.dev/vulnerability/CVE-2026-82853
3. Nodemailer GitHub Repository: https://github.com/nodemailer/nodemailer (verify 8.0.5 release notes)
4. CWE-93 Reference (MITRE): https://cwe.mitre.org/data/definitions/93.html
5. RFC 5321 — SMTP Protocol Specification: https://www.rfc-editor.org/rfc/rfc5321

Threat Actor Campaigns / Exploit-in-the-Wild: No known threat actor campaigns have been publicly attributed to CVE-2026-82853 as of this report. The CVE is not listed on CISA's KEV catalog, and no public exploit code, PoC, or Nuclei template exists. The EPSS score is 0.00735 (51.9th percentile), indicating a low but non-trivial probability of exploitation in the wild.