Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.size parameter. (CVE-2026-82854)

Nodemailer before version 8.0.4 is vulnerable to SMTP command injection due to improper sanitization of the envelope.size parameter. When a custom envelope object with a size property containing carriage return and line feed (CRLF) characters is passed to the sendMail() API, the value is concatenated directly into the SMTP MAIL FROM command as SIZE= without sanitization. This allows an attacker to inject arbitrary SMTP commands, such as RCPT TO, potentially adding attacker-controlled recipients silently. The vulnerability requires that the application exposes the envelope size to attacker-controlled input, as the default Nodemailer envelope does not include the size property.

Successful exploitation can lead to injection of arbitrary SMTP commands, compromising the integrity of email sending operations. This can allow attackers to add unauthorized recipients to emails, potentially leading to information disclosure or abuse of the mail server. The CVSS score of 9.8 indicates critical impact with high confidentiality, integrity, and availability consequences.

A fix is available in Nodemailer version 8.0.4 and later. Users should upgrade to version 8.0.4 or newer to remediate this vulnerability. Until upgraded, ensure that applications do not pass attacker-controlled input to the envelope.size parameter or sanitize this input to prevent injection of CRLF characters.