GitHub Advisoryadvisory · npm

GHSA-hwqf-gcqm-7353 Header injection in nodemailer

MEDIUM Published 2021-12-10 Modified 2021-06-30 Official page ↗
Aliases
CVE-2021-23400
Ecosystem
npm
Packages
nodemailer
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Weaknesses
CWE-74
Reviewed
2021-06-30

Affected packages

• npm nodemailer: < 6.6.1 → fixed in 6.6.1

Description

The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain newlines and carriage returns is passed into an address object.

Related

Alias · CVE (1)

  • CVE-2021-23400 The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain newlines and… vulnerability

Weakness · CWE (1)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References