https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-08T23:02:49.899411+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-82661 fkie_cve-2026-82661 2026-10-08T23:02:52.428560+00:00

Nodemailer before 8.0.9 fails to sanitize carriage return and line feed characters in list comment fields, allowing attackers to inject arbitrary message headers. An attacker with control over list.*.comment parameters can inject CRLF sequences to create additional headers in generated RFC822 messages, altering mail client behavior and message semantics.

 https://vulnerability.circl.lu/vuln/ghsa-2jv2-wqrj-g6x7 GHSA-2jv2-wqrj-g6x7 2026-10-08T23:02:52.428692+00:00

Nodemailer before 8.0.9 fails to sanitize carriage return and line feed characters in list comment fields, allowing attackers to inject arbitrary message headers. An attacker with control over list.*.comment parameters can inject CRLF sequences to create additional headers in generated RFC822 messages, altering mail client behavior and message semantics.

 https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-82661 UBUNTU-CVE-2026-82661 2026-10-08T23:02:52.428748+00:00

Affected: Ubuntu:20.04:LTS: node-nodemailer, Ubuntu:22.04:LTS: node-nodemailer, Ubuntu:24.04:LTS: node-nodemailer, Ubuntu:26.04:LTS: node-nodemailer

Nodemailer before 8.0.9 fails to sanitize carriage return and line feed characters in list comment fields, allowing attackers to inject arbitrary message headers. An attacker with control over list.*.comment parameters can inject CRLF sequences to create additional headers in generated RFC822 messages, altering mail client behavior and message semantics.