EUVD-2026-78403

fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization...

Improper Validation of Specified Quantity in Input

Overview nodemailer is an Easy as cake e-mail sending from your Node.js applications Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input via the addressparser module's handling of quoted local-part addresses. When an address of the form...

Encoding Error

Overview fast-uri is a Dependency-free RFC 3986 URI toolbox Affected versions of this package are vulnerable to Encoding Error in the mailto parser process. An attacker can inject unauthorized recipients or manipulate the subject and body fields by crafting a URI with percent-encoded reserved fie...

CVE-2026-86818

fast-uri v4.1.3–4.1.4, a dependency-free RFC 3986 URI parser for Node.js used by Fastify and ajv , suffers from a percent-encoded field-name desynchronization in its mailto parser. At parse time, reserved field names (to, subject, body) are compared in their still-percent-encoded form and thus no...

CVE-2026-82854

Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.size parameter. When an application passes a custom envelope object with a size property containing CRLF characters to sendMail, the value is concatenated into the SMTP MAIL FROM command as SIZE=...

CVE-2026-82854 Nodemailer before 8.0.3 SMTP Command Injection via envelope.size

Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.size parameter. When an application passes a custom envelope object with a size property containing CRLF characters to sendMail, the value is concatenated into the SMTP MAIL FROM command as SIZE=...

EUVD-2026-68442

Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.size parameter. When an application passes a custom envelope object with a size property containing CRLF characters to sendMail, the value is concatenated into the SMTP MAIL FROM command as SIZE=...

Linux Distros Unpatched Vulnerability : CVE-2026-82854

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.size parameter. When an application passes a custom envelope...

osTicket < 1.14.8, 1.15.x < 1.15.4 Multiple Vulnerabilities

osTicket is prone to multiple vulnerabilities. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...