GHSA-268h-hp4c-crq3
MediumSummary
A vulnerability in the Nodemailer library allows header injection via the `list.*.comment` field, which is not sanitized for CR (`\r`) and LF (`\n`) characters. An attacker can supply a malicious value in this field, leading to email header spoofing.
Risk Assessment
The risk involves the ability to manipulate email headers, which can be exploited for phishing, bypassing spam filters, or impersonating the sender.
Recommendation
It is recommended to immediately update the Nodemailer library to the latest version that includes a fix removing CR and LF characters from `list.*.comment` field values.
Original NVD description (English source)
### Summary Nodemailer constructs `List-*` headers from the caller-provided `list` message option using internally prepared header values. The `list.*.comment` field is inserted into those prepared values without removing CR (`\r`) or LF (`\n`) characters. Because prepared headers bypass the normal