Header injection in nodemailer

HIGH 8.8CVE-2021-23400 · GHSA-hwqf-gcqm-7353 · Published 29/06/2021 · updated 17/06/2026

In short

CVE-2021-23400 is a HIGH (CVSS 8.8) vulnerability affecting nodemailer (nodemailer), nodemailer.
Chance of exploitation in the next 30 days (EPSS): 1.4%, higher than 72.4% of all vulnerabilities.
Fix: update to 6.6.1 or later.

Package	Affected versions	Patched versions
nodemailer nodemailer	`< 6.6.1`	`6.6.1`
nodemailer npm	`< 6.6.1`	`6.6.1`

Description

The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain newlines and carriage returns is passed into an address object.

NVD description

The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain newlines and carriage returns is passed into an address object.

References

nvd.nist.gov/vuln/detail/CVE-2021-23400 · ADVISORY
nodemailer/nodemailer · WEB
nodemailer/nodemailer commit 7e02648 · WEB
snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1314737 · WEB
snyk.io/vuln/SNYK-JS-NODEMAILER-1296415 · WEB

More vulnerabilities in nodemailer

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

nodemailer

< 6.6.1

6.6.1

nodemailer

npm

< 6.6.1

6.6.1

Description

The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain newlines and carriage returns is passed into an address object.

NVD description

The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain newlines and carriage returns is passed into an address object.

More vulnerabilities in nodemailer

See all →