This vulnerability allows arbitrary SMTP commands to be injected through an unsanitized envelope.size field supplied to sendMail(). By embedding CRLF characters, an attacker can inject commands such as RCPT TO, silently adding recipients and potentially delivering unused email traffic or facilitating spam. The flaw is a classic example of command injection (CWE-93) and can lead to unauthorized mail delivery, data leakage, and system abuse.

The flaw exists in the Nodemailer library prior to version 8.0.4. Any application that uses Nodemailer and accepts externally controllable envelope.size values is impacted. The default configuration in older releases does not include a size value, so the risk is contingent on the application explicitly providing this parameter.

The vulnerability carries a CVSS score of 9.3, indicating critical severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. Exploitation requires the attacker to control or influence the envelope.size value; once injected, arbitrary SMTP commands are executed during the mail transaction, facilitating silent message delivery or other attacks. The likely attack vector is through application input that is reflected in the SMTP conversation, making it a network-based exploit.