A critical SMTP command injection vulnerability in Nodemailer allows unauthenticated remote attackers to manipulate mail delivery and inject unauthorized recipients.

This vulnerability is a CRLF injection (CWE-93) occurring when a custom envelope object containing a size property with CRLF characters is passed to the sendMail function. An unauthenticated attacker can leverage this to inject arbitrary SMTP commands into the MAIL FROM stream.

The ability to inject arbitrary SMTP commands poses a severe risk to organizational communication integrity and security. Successful exploitation could lead to unauthorized data exfiltration, the addition of malicious recipients to sensitive communications, or the bypass of mail delivery security policies. With a CVSS score of 9.8, this flaw represents a critical risk that could facilitate phishing campaigns or internal information disclosure.

Immediate Action: Update the Nodemailer package to version 8.0.3 or later immediately to incorporate the necessary sanitization of the envelope.size parameter.

Proactive Monitoring: Review application logs for unusual SMTP command structures or unexpected recipient addresses in outgoing mail streams. Monitor for application-level input validation errors related to email envelope construction.

Compensating Controls: Implement strict input validation at the application layer to ensure that any custom envelope parameters do not contain CRLF characters. Utilize a Web Application Firewall (WAF) to inspect outgoing traffic for malicious SMTP command injection patterns.

Public Exploit Available: Unknown

Given the critical CVSS severity of 9.8 and the potential for unauthorized mail manipulation, this vulnerability should be treated as a high-priority remediation task. Organizations utilizing Nodemailer should verify their current version and apply the update to 8.0.3 or later as soon as possible to prevent potential SMTP command injection attacks.