What is CVE-2026-82853?

CVE-2026-82853 is a medium-severity vulnerability in Nodemailer, classified under CRLF Injection. CVSS score: 4.9/10. Published 2026-08-31.

How severe is CVE-2026-82853?

Medium severity. CVSS v3 base score is 4.9 out of 10.

Vulnerability in Nodemailer

CVE-2026-82853

Nodemailer versions before 8.0.5 contain an SMTP command injection vulnerability in the transport name option used in EHLO/HELO commands. The name parameter is concatenated directly into SMTP commands without sanitizing carriage return and line feed characters, allowing attackers to inject arbitrary SMTP commands for email spoofing and phishing attacks.

Vulnerability class: CRLF Injection

EPSS: 0.007 (51.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.9 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N.

Affected products

Nodemailer

Weakness classification (CWE)

CWE-93 — CRLF Injection

References

disclosure@vulncheck.com (vendor-advisory)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-82853?: CVE-2026-82853 is a medium-severity vulnerability in Nodemailer, classified under CRLF Injection. CVSS score: 4.9/10. Published 2026-08-31.
How severe is CVE-2026-82853?: Medium severity. CVSS v3 base score is 4.9 out of 10.