Nodemailer before 8.0.9 fails to sanitize carriage return and line feed characters in list comment fields, allowing attackers to inject arbitrary… (CVE-2026-82661)

The vulnerability in Nodemailer prior to version 8.0.9 involves improper sanitization of carriage return (CR) and line feed (LF) characters in list comment fields. An attacker with control over these parameters can inject CRLF sequences, enabling the creation of additional headers in generated RFC822 email messages. This can lead to altered mail client behavior and changes in message semantics, potentially impacting the integrity of email communications.

The vulnerability allows an attacker with limited privileges (PR:L) and no user interaction (UI:N) to inject arbitrary headers into email messages generated by Nodemailer. This can lead to altered message semantics and mail client behavior, potentially causing confusion or misinterpretation of emails. The confidentiality and integrity impacts are low, and there is no impact on availability.

A fix is available in Nodemailer version 8.0.9 that properly sanitizes carriage return and line feed characters in list comment fields. Users should upgrade to version 8.0.9 or later to remediate this vulnerability. Patch status is not explicitly confirmed in the provided data, but the version boundary indicates the fix is in 8.0.9. No vendor advisory content was provided to contradict this.