CVE-2026-82854
1 advisory.
npm/nodemailer CVE-2026-82854: low, EPSS 1.98%
Nodemailer has SMTP command injection due to unsanitized `envelope.size` parameter
Action: Upgrade nodemailer to 8.0.4 or later.
npm i nodemailer@8.0.4Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 8.0.4 | - |
Fixed versions
| 8.0.4 |
Sources
- osv: GHSA-c7w3-x93f-qmm8
- https://github.com/nodemailer/nodemailer/security/advisories/GHSA-c7w3-x93f-qmm8
- https://github.com/nodemailer/nodemailer/commit/2d7b9710e63555a1eb13d721296c51186d4b5651
- https://github.com/nodemailer/nodemailer
CVE-2026-82854 · published · modified · JSON