p PatchFirst

CVE-2021-23400

CVE-2021-23400 · HTTP Header Injection

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain newlines and carriage returns is passed into an address object.

CVSS 6.3 · Medium · EPSS 1.4% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • nodemailer

    Versions
    • ≥ unspecified, < 6.6.1: Affected (custom)

    Update to 6.6.1

  • node-nodemailer Debian:12

    Affected ranges
    • ECOSYSTEM: < 6.4.17-3

    Update to 6.4.17-3

  • node-nodemailer Debian:13

    Affected ranges
    • ECOSYSTEM: < 6.4.17-3

    Update to 6.4.17-3

  • node-nodemailer Debian:14

    Affected ranges
    • ECOSYSTEM: < 6.4.17-3

    Update to 6.4.17-3

  • nodemailer npm

    Affected ranges
    • SEMVER: < 6.6.1

    Update to 6.6.1

  • node-nodemailer Ubuntu:20.04:LTS

    Versions
    • 6.3.0-2
    • 6.3.1-1
    • 6.4.0-1
    • 6.4.1-1
    • 6.4.2-1
    • 6.4.5-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-nodemailer Ubuntu:22.04:LTS

    Versions
    • 6.4.17-3
    • 6.7.0-1
    • 6.7.0-2
    • 6.7.1+~6.4.4-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →