GHSA-hwqf-gcqm-7353
Header injection in nodemailer
At a glance
- Published
- Updated
- CVE
- CVE-2021-23400
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Description
The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain newlines and carriage returns is passed into an address object.
Affected packages
| Package | Versions |
|---|---|
| npm · nodemailer | introduced 0, fixed 6.6.1 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2021-23400 ADVISORY
- https://github.com/nodemailer/nodemailer/issues/1289 WEB
- https://github.com/nodemailer/nodemailer/commit/7e02648cc8cd863f5085bad3cd09087bccf84b9f WEB
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1314737 WEB
- https://snyk.io/vuln/SNYK-JS-NODEMAILER-1296415 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |