{"cve":"CVE-2021-23400","nvd":{"published":"2021-06-29T12:15:08.363","modified":"2026-06-17T03:38:41.593","status":"Modified","description":"The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain newlines and carriage returns is passed into an address object.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","score":8.8},"cwes":["CWE-74"],"references":["https://github.com/nodemailer/nodemailer/commit/7e02648cc8cd863f5085bad3cd09087bccf84b9f","https://github.com/nodemailer/nodemailer/issues/1289","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1314737","https://snyk.io/vuln/SNYK-JS-NODEMAILER-1296415","https://github.com/nodemailer/nodemailer/commit/7e02648cc8cd863f5085bad3cd09087bccf84b9f"],"products":["nodemailer:nodemailer"],"source":"nvd","synced_at":"2026-10-19T21:20:07.141963181+00:00"},"epss":{"cve":"CVE-2021-23400","score":0.01392,"percentile":0.72365,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-hwqf-gcqm-7353","url":"https://osv.dev/vulnerability/GHSA-hwqf-gcqm-7353","summary":"Header injection in nodemailer","modified":"2025-01-14T09:12:20.581301Z","packages":[{"ecosystem":"npm","name":"nodemailer","purl":"pkg:npm/nodemailer","ranges":["<6.6.1"],"fixed":["6.6.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}