The vulnerability is a classic SMTP command injection where an attacker can insert carriage return and line feed characters into the HELO/EHLO name parameter. When the name is concatenated directly into the SMTP command, an attacker can append additional SMTP commands, enabling manipulation of email headers and potentially forging sender addresses. This increases the risk of phishing campaigns that appear to originate from trusted domains, undermining the integrity and authenticity of email communications. The weakness is classified as CWE-93, which indicates a lack of sanitization for input that is sent to a command processor.

Any application using Nodemailer versions earlier than 8.0.5 is affected. The library must be replaced or updated to the version 8.0.5 or later; no other environments or components are listed as impacted beyond the Nodemailer package itself.

The CVSS score of 6.9 indicates a medium severity, reflecting the potential for widespread phishing. The EPSS score is not available, so exact exploitation frequency is unknown. The vulnerability is not yet in the CISA KEV catalog, indicating that there are no confirmed large‑scale attacks, but the attack vector is inferred to be the network, as malicious SMTP commands can be sent during a normal SMTP session. An attacker would need network access to the target SMTP server or to an application that uses Nodemailer to send mail on their behalf. Successful exploitation would grant the attacker the ability to send emails that appear to come from their chosen address, thereby compromising the integrity and authenticity of the mail system.