Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.size parameter. When an application passes a custom envelope object with a size property containing CRLF characters to sendMail(), the value is concatenated into the SMTP MAIL FROM command (as SIZE=...) without sanitization, allowing injection of arbitrary SMTP commands such as RCPT TO to silently add attacker-controlled recipients. Exploitation requires the application to expose the envelope size to attacker-controlled input, as Nodemailer does not include size in the default auto-constructed envelope.
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
Nodemailer versions before 8.0.4 contain a critical SMTP command injection vulnerability in how they handle the envelope.size parameter. When applications pass a custom envelope object with a size property to sendMail(), unsanitized CRLF characters in that parameter are concatenated directly into the SMTP MAIL FROM command. This allows attackers to inject arbitrary SMTP commands—most dangerously RCPT TO commands—to silently add unauthorized recipients to emails. The vulnerability has a CVSS score of 9.8 (critical) and affects any application using vulnerable Nodemailer versions that expose user-controlled input to the envelope size parameter. This is particularly dangerous in multi-tenant environments, notification systems, and user-facing applications where email routing is security-sensitive.
While this CVE doesn't currently map to specific MITRE ATT&CK techniques in public databases, Casky's AI-powered analysis would identify the attack pattern as a form of application-layer command injection (related to CWE-93). Practitioners using Casky would see this vulnerability surface during code analysis workflows when the platform's Claude-backed reasoning engine detects unsanitized parameter concatenation into protocol commands, unsafe string formatting in email envelope construction, or direct user input flowing into SMTP command building. The skill mapping would flag suspicious patterns like missing input validation on envelope objects, absence of CRLF filtering, and direct parameter interpolation into mail commands—helping security teams catch similar injection flaws before they reach production.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-82854. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation