https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T15:01:46.855555+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-361729 EUVD-2026-361729 2026-10-03T15:01:46.923412+00:00 EUVD-2026-361729 https://cve.radiocsirt.org/vuln/fkie_cve-2026-82853 fkie_cve-2026-82853 2026-10-03T15:01:46.923462+00:00

Nodemailer versions before 8.0.5 contain an SMTP command injection vulnerability in the transport name option used in EHLO/HELO commands. The name parameter is concatenated directly into SMTP commands without sanitizing carriage return and line feed characters, allowing attackers to inject arbitrary SMTP commands for email spoofing and phishing attacks.

 https://cve.radiocsirt.org/vuln/ghsa-q8rv-95x3-46j5 GHSA-q8rv-95x3-46j5 2026-10-03T15:01:46.923499+00:00

Nodemailer versions before 8.0.5 contain an SMTP command injection vulnerability in the transport name option used in EHLO/HELO commands. The name parameter is concatenated directly into SMTP commands without sanitizing carriage return and line feed characters, allowing attackers to inject arbitrary SMTP commands for email spoofing and phishing attacks.

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-82853 UBUNTU-CVE-2026-82853 2026-10-03T15:01:46.923516+00:00

Affected: Ubuntu:20.04:LTS: node-nodemailer, Ubuntu:22.04:LTS: node-nodemailer, Ubuntu:24.04:LTS: node-nodemailer, Ubuntu:26.04:LTS: node-nodemailer

Nodemailer versions before 8.0.5 contain an SMTP command injection vulnerability in the transport name option used in EHLO/HELO commands. The name parameter is concatenated directly into SMTP commands without sanitizing carriage return and line feed characters, allowing attackers to inject arbitrary SMTP commands for email spoofing and phishing attacks.