Packages / nodemailer / Security

ModerateVulnerabilityGHSA-hwqf-gcqm-7353CVE-2021-23400Published 10 Dec 2021

Header injection in nodemailer

Your version

Affected releases · nodemailer

  • 6.x6.0.0 – 6.6.0Fixed in 6.6.1
  • 5.x and older0.1.1 – 5.1.1No fix, no longer updated

On 6.x, the newest line:

npm install nodemailer@6.6.1
Every release on a timeline
10.x

  1. Not affected

    10.0.0 – 10.2.1

    27 releases, latest

6.x

  1. Affected

    6.0.0 – 6.6.0

    26 releases

  2. Fixed

    6.6.1 – 6.10.1

    34 releases

5.x

  1. Affected

    5.0.0 – 5.1.1

    4 releases

4.x

  1. Affected

    4.0.0 – 4.7.0

    23 releases

3.x

  1. Affected

    3.0.0 – 3.1.8

    12 releases

2.x

  1. Affected

    2.0.0 – 2.7.2

    19 releases

1.x

  1. Affected

    1.0.0 – 1.11.0

    24 releases

0.x

  1. Affected

    0.1.1 – 0.7.1

    102 releases

305 stable releases of nodemailer, oldest to newest, one row per major.

What happens

The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain newlines and carriage returns is passed into an address object.