VULNERABILITY INTELLIGENCE
CVE-2021-23400
CVSS score6.3 MEDIUM
EPSS probability1.39%
CISA KEVNot currently listed
Published2021-06-29
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Description
The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain newlines and carriage returns is passed into an address object.
Weakness classification
- nvd@nist.gov: CWE-74
Primary references
- report@snyk.io — Patch, Third Party Advisory
- report@snyk.io — Third Party Advisory
- report@snyk.io — Exploit, Patch, Third Party Advisory
- report@snyk.io — Exploit, Patch, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Exploit, Patch, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Exploit, Patch, Third Party Advisory