Description
The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain newlines and carriage returns is passed into an address object.
Remediation
References
https://github.com/nodemailer/nodemailer/commit/7e02648cc8cd863f5085bad3cd09087bccf84b9f
https://github.com/nodemailer/nodemailer/issues/1289
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1314737
https://snyk.io/vuln/SNYK-JS-NODEMAILER-1296415
Related Vulnerabilities
CVE-2023-0871 Vulnerability in maven package org.opennms.core:org.opennms.core.xml
CVE-2023-47321 Vulnerability in maven package org.silverpeas.core:silverpeas-core-web
CVE-2019-10797 Vulnerability in maven package org.wso2.transport.http:org.wso2.transport.http.netty
CVE-2022-3952 Vulnerability in maven package com.manydesigns:portofino-microservice-launcher
CVE-2023-26136 Vulnerability in maven package org.webjars.bowergithub.salesforce:tough-cookie