GHSA-vvjj-xcjg-gr5g — Nodemailer Vulnerable to SMTP Command Injection via CRLF in Transport name Option (EHLO/HELO)

Affected: npm: nodemailer

### Summary

Nodemailer versions up to and including 8.0.4 are vulnerable to SMTP command injection via CRLF sequences in the transport `name` configuration option. The `name` value is used directly in the EHLO/HELO SMTP command without any sanitization for carriage return and line feed characters (`\r\n`). An attacker who can influence this option can inject arbitrary SMTP commands, enabling unauthorized email sending, email spoofing, and phishing attacks.

### Details

The vulnerability exists in `lib/smtp-connection/index.js`. When establishing an SMTP connection, the `name` option is concatenated directly into the EHLO command:

```javascript // lib/smtp-connection/index.js, line 71 this.name = this.options.name || this._getHostname();

// line 1336 this._sendCommand('EHLO ' + this.name); ```

The `_sendCommand` method writes the string directly to the socket followed by `\r\n` (line 1082):

```javascript this._socket.write(Buffer.from(str + '\r\n', 'utf-8')); ```

If the `name` option contains `\r\n` sequences, each injected line is interpreted by the SMTP server as a separate command. Unlike the `envelope.from` and `envelope.to` fields which are validated for `\r\n` (line 1107-1119), and unlike `envelope.size` which was recently fixed (GHSA-c7w3-x93f-qmm8) by casting to a number, the `name` parameter receives no CRLF sanitization whatsoever.

This is distinct from the previously reported GHSA-c7w3-x93f-qmm8 (envelope.size injection) as it affects a different parameter…

Most recent entries from all

GHSA-vvjj-xcjg-gr5g — Nodemailer Vulnerable to SMTP Command Injection via CRLF in Transport name Option (EHLO/HELO)