https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T02:52:08.629733+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-363240 EUVD-2026-363240 2026-10-04T02:52:08.633628+00:00 EUVD-2026-363240 https://cve.radiocsirt.org/vuln/fkie_cve-2026-82661 fkie_cve-2026-82661 2026-10-04T02:52:08.633660+00:00

Nodemailer before 8.0.9 fails to sanitize carriage return and line feed characters in list comment fields, allowing attackers to inject arbitrary message headers. An attacker with control over list.*.comment parameters can inject CRLF sequences to create additional headers in generated RFC822 messages, altering mail client behavior and message semantics.

 https://cve.radiocsirt.org/vuln/ghsa-2jv2-wqrj-g6x7 GHSA-2jv2-wqrj-g6x7 2026-10-04T02:52:08.633691+00:00

Nodemailer before 8.0.9 fails to sanitize carriage return and line feed characters in list comment fields, allowing attackers to inject arbitrary message headers. An attacker with control over list.*.comment parameters can inject CRLF sequences to create additional headers in generated RFC822 messages, altering mail client behavior and message semantics.

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-82661 UBUNTU-CVE-2026-82661 2026-10-04T02:52:08.633707+00:00

Affected: Ubuntu:20.04:LTS: node-nodemailer, Ubuntu:22.04:LTS: node-nodemailer, Ubuntu:24.04:LTS: node-nodemailer, Ubuntu:26.04:LTS: node-nodemailer

Nodemailer before 8.0.9 fails to sanitize carriage return and line feed characters in list comment fields, allowing attackers to inject arbitrary message headers. An attacker with control over list.*.comment parameters can inject CRLF sequences to create additional headers in generated RFC822 messages, altering mail client behavior and message semantics.