Description (CNA)
The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain newlines and carriage returns is passed into an address object.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n/a / nodemailer | affected unspecified before 6.6.1 |
CWE
No CWE identifiers supplied.
References
- https://snyk.io/vuln/SNYK-JS-NODEMAILER-1296415
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1314737
- https://github.com/nodemailer/nodemailer/issues/1289
- https://github.com/nodemailer/nodemailer/commit/7e02648cc8cd863f5085bad3cd09087bccf84b9f
ADP enrichment
No English description supplied.