medium6.3
CVE-2021-23400
Header injection in nodemailer
Impact
The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain newlines and carriage returns is passed into an address object.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | nodemailer | < 6.6.1 | 6.6.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Nodemailer | Nodemailer | before 6.6.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/nodemailer/nodemailer/commit/7e02648cc8cd863f5085bad3cd09087bccf84b9f
- https://github.com/nodemailer/nodemailer/issues/1289
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1314737
- https://snyk.io/vuln/SNYK-JS-NODEMAILER-1296415
- https://github.com/advisories/GHSA-hwqf-gcqm-7353
- https://nvd.nist.gov/vuln/detail/CVE-2021-23400