Nodemailer npm Package Vulnerability: Critical SMTP Injection Risk
- Severity
- CRITICAL
- CVSS
- 9.8
- Affected component
- nodemailer (npm)
- Affected versions
- < 8.0.9 or < 6.4.16 or < 6.9.9 or < 8.0.4 or < 6.6.1 or < 7.0.7 or < 9.0.1 or < 8.0.8 or >= 3.0.0, < 7.0.11 or < 8.0.5 or < 8.0.9
- Patched version
- 8.0.4
An early warning has been issued for a critical vulnerability in the Nodemailer npm package. Versions prior to 8.0.4 are reportedly vulnerable to SMTP command injection through the unsanitized envelope.size parameter.
What happened
The Nodemailer npm package, versions before 8.0.4, is under investigation for a critical vulnerability. This vulnerability allows SMTP command injection through the unsanitized envelope.size parameter, potentially enabling an attacker to inject arbitrary SMTP commands such as RCPT TO to add attacker-controlled recipients.
The vulnerability has been assigned the identifier CVE-2026-82854 with a CVSS score of 9.8, indicating a critical severity level. The issue has been flagged but is not yet confirmed to be exploited in the wild.
What to do about it
- Upgrade to Nodemailer version 8.0.4 or later to mitigate the vulnerability.
- Review your project dependencies to identify any usage of affected Nodemailer versions.
- If using Nodemailer in your projects, ensure all instances are updated to the patched version.
- Monitor the primary sources for any updates or additional information regarding the vulnerability.
How 0Day would have caught this
nodemailer is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You may be affected if your project uses Nodemailer versions before 8.0.9 or before 6.4.16 or before 6.9.9 or before 8.0.4 or before 6.6.1 or before 7.0.7 or before 9.0.1 or before 8.0.8 or versions between 3.0.0 and 7.0.11 or before 8.0.5 or before 8.0.9.
What should I do right now?
Upgrade to Nodemailer version 8.0.4 or later to mitigate the vulnerability. Review your project dependencies and ensure all instances of Nodemailer are updated to the patched version.
Is this vulnerability confirmed?
This is an early warning and the vulnerability is under investigation. It is not yet confirmed.