Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.size parameter. When an application passes a custom envelope object with a size property containing CRLF characters to sendMail(), the value is concatenated into the SMTP MAIL FROM command (as SIZE=...) without sanitization, allowing injection of arbitrary SMTP commands such as RCPT TO to silently add attacker-controlled recipients. Exploitation requires the application to expose the envelope size to attacker-controlled input, as Nodemailer does not include size in the default auto-constructed envelope.

Nodemailer versions before 8.0.4 are vulnerable to SMTP command injection via the unsanitized envelope.size parameter. When an application passes a custom envelope object with a size property containing CRLF characters to sendMail(), the value is injected into the SMTP MAIL FROM command without sanitization. This allows attackers to inject arbitrary SMTP commands, such as RCPT TO, to silently add attacker-controlled email recipients. Exploitation requires the application to expose the envelope size field to attacker-controlled input. Notably, Nodemailer does not include size in its default auto-constructed envelope, limiting the attack surface to applications that explicitly set this field. The fix is available in Nodemailer version 8.0.4.