HTTP Header Injection (nodemailer)
At a glance
- Source
- NVD
- EPSS
- EPSS 1.39 % · percentile 72 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- snyk
- NVD status
- Modified
Description
The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain newlines and carriage returns is passed into an address object.
Weaknesses (CWE)
- CWE-74 — Improper Neutralization of Special Elements in Output Used by a Downstream Component
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P | snyk |
| CVSS 3.1 | MEDIUM 6.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L | NVD · report@snyk.io (Secondary) |
| CVSS 3.1 | HIGH 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-hwqf-gcqm-7353 — Header injection in nodemailer
European references
- ENISA EUVD · EUVD-2021-2533
- GCVE · GCVE-0-2021-23400
Affected configurations (NVD CPE)
cpe:2.3:a:nodemailer:nodemailer:*:*:*:*:*:node.js:*:*< 6.6.1
Affected products
| Product | Versions |
|---|---|
| nodemailer | affected unspecified < 6.6.1 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |