CyberRota Analysis
AI-GeneratedNodemailer versions prior to 8.0.9 are vulnerable due to inadequate sanitization of carriage return and line feed characters in list comment fields, enabling attackers to inject arbitrary message headers. This can lead to manipulation of RFC822 messages, potentially altering mail client behavior and compromising message integrity. Organizations using affected versions of Nodemailer should prioritize updating to mitigate risks associated with email spoofing and header injection attacks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Nodemailer before 8.0.9 fails to sanitize carriage return and line feed characters in list comment fields, allowing attackers to inject arbitrary message headers. An attacker with control over list.*.comment parameters can inject CRLF sequences to create additional headers in generated RFC822 messages, altering mail client behavior and message semantics.