CVE-2021-23400

HTTP Header Injection

Medium · published June 29, 2021

CVSS v3.1
6.3
EPSS
1%
Percentile
72.1
In the wild
Unconfirmed
What it is

The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain newlines and carriage returns is passed into an address object.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P
CVSS v4.0
Not supplied
EPSS
0.01392 · 72.1th percentile
Published
2021-06-29T11:45Z
EPSS history
Timeline
  • 29 JUN 11:45Z
    HTTP Header Injection
    cvelistv5