CVE-2026-82854

creationtimestamp| type| source ---|---|--- 2026-08-31 09:40:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3muemf4tokp2y 2026-08-31 10:07:22+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3muenvxe2542b 2026-08-31 11:00:39+00:00| seen|...

DEBIAN-CVE-2026-82854

Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.size parameter. When an application passes a custom envelope object with a size property containing CRLF characters to sendMail, the value is concatenated into the SMTP MAIL FROM command as SIZE=...