Nodemailer versions before 8.0.5 contain an SMTP command injection vulnerability in the transport name option used in EHLO/HELO commands. (CVE-2026-82853)

Nodemailer versions prior to 8.0.5 are affected by an SMTP command injection vulnerability (CVE-2026-82853) in the transport name option used during EHLO/HELO SMTP commands. The root cause is the direct concatenation of the name parameter into SMTP commands without sanitizing CR and LF characters, which enables injection of arbitrary SMTP commands. This vulnerability can be exploited to perform email spoofing and phishing attacks. The CVSS 3.1 base score is 4.9, indicating moderate impact primarily on integrity. There is no vendor advisory or patch information provided, and no known exploits in the wild have been reported.

The vulnerability allows attackers with high privileges to inject arbitrary SMTP commands via the transport name option, potentially leading to email spoofing and phishing attacks. Confidentiality and availability are not impacted, but integrity is affected. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using untrusted input for the transport name option or sanitize input to prevent injection of carriage return and line feed characters.