{"action":"Upgrade nodemailer to 8.0.4 or later.","affected":[{"fixed":"8.0.4","introduced":"0"}],"component":"nodemailer","cve_ids":["CVE-2026-82854"],"ecosystem":"npm","epss":0.01975,"exploited":false,"fixed_versions":["8.0.4"],"ghsa_id":"GHSA-c7w3-x93f-qmm8","id":"tcs_01M5KFJ4S5QK7WFR408Y7ADG4S","modified_at":"2026-09-10T03:50:38.497772249Z","published_at":"2026-03-26T22:26:46Z","references":["https://osv.dev/vulnerability/GHSA-c7w3-x93f-qmm8","https://github.com/nodemailer/nodemailer/security/advisories/GHSA-c7w3-x93f-qmm8","https://github.com/nodemailer/nodemailer/commit/2d7b9710e63555a1eb13d721296c51186d4b5651","https://github.com/nodemailer/nodemailer"],"severity":{"label":"low"},"sources":[{"source":"osv","source_id":"GHSA-c7w3-x93f-qmm8","url":"https://osv.dev/vulnerability/GHSA-c7w3-x93f-qmm8"}],"summary":"Nodemailer has SMTP command injection due to unsanitized `envelope.size` parameter"}