Nodemailer versions prior to 8.0.9 lack proper sanitization of carriage return and line feed characters in list comment fields, enabling attackers who control the list.*.comment parameters to insert arbitrary message headers into RFC822 emails. This capability allows forging of header fields such as From, To, or Bcc, potentially redirecting email flow, sending spoofed messages, or altering message semantics in a way that can mislead mail clients or bypass basic security checks.

The vulnerability impacts the Nodemailer mail‑sending library, specifically versions before 8.0.9. Any project that uses Nodemailer to construct emails and supplies untrusted user input to comment fields is exposed. All deployments of Nodemailer that have not applied version 8.0.9 or later revisions are affected.

The CVSS score of 5.3 indicates a medium severity. EPSS data is not available, so exploitation probability is unknown, and the vulnerability is not listed in the CISA KEV catalogue. The likely attack vector requires an attacker to influence the content of list.*.comment fields—typically through an application that accepts user-supplied values for these fields. If that application is exposed to unauthenticated users or a malicious actor can inject data, additional headers can be injected into outbound messages. The lack of automatic sanitization means the exploitation does not require privileged access or exploits beyond normal input handling.