High severity · published Jun 29, 2021
CVE-2021-23400
The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain newlines and carriage returns is passed into an address…
8.8
CVSS
1.4%
EPSS
No
On KEV
Description
The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain newlines and carriage returns is passed into an address object.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 72% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NO
Nodemailer · Nodemailer
before 6.6.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-23400
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-23400
Patch
https://github.com/nodemailer/nodemailer/commit/7e02648cc8cd863f5085bad3cd09087bccf84b9f
Third Party Advisory
https://github.com/nodemailer/nodemailer/issues/1289
Exploit
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1314737
Exploit
https://snyk.io/vuln/SNYK-JS-NODEMAILER-1296415
More from Nodemailer
9.8
CVE-2026-82854
Nodemailer before 8.0.3 SMTP Command Injection via envelope.size
9.8
CVE-2020-7769
This affects the package nodemailer before 6.4.16
7.5
CVE-2026-110869
Nodemailer 3.0.0 before 10.0.13 ReDoS via SMTP AUTH Mechanism Detection Regexes
7.5
CVE-2026-100700
nodemailer before 10.0.6 Denial of Service via addressparser
7.5
CVE-2026-92596
Nodemailer before 9.1.0 Denial of Service via addressparser