LiveActive security incident?Get immediate response
CVE Record

CVE-2021-23400: HTTP Header Injection

The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain newlines and carriage returns is passed into an address object.

MediumCVSS 6.3Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

Nodemailer before 6.6.1 can mishandle untrusted email address data containing carriage returns or newlines. In affected applications, this can allow HTTP header injection through address objects. The issue is moderate, but it matters where public forms or workflows feed user-controlled address fields into Nodemailer.

Executive priority

Prioritize remediation for customer-facing or automated email workflows that accept user-provided recipient or sender details. This is not a known actively exploited emergency from the supplied sources, but it is a practical input-handling flaw in a common mail library.

Technical view

The vulnerability is an HTTP Header Injection flaw in Nodemailer before 6.6.1. Sources describe exposure when unsanitized user input containing CRLF characters is passed into an address object. The CVSS 3.1 score is 6.3, with network attack vector, low complexity, no privileges required, and user interaction required.

Likely exposure

Exposure is most likely in Node.js applications using Nodemailer before 6.6.1 where users can influence address object fields such as names or email addresses. Evidence for other affected products is limited to the supplied webjar reference, not a separate product claim.

Exploitation context

The source bundle does not show CISA KEV listing or active exploitation. The CVSS vector includes proof-of-concept maturity, so treat exploitation as plausible in exposed input paths, but do not assume observed attacks from the provided evidence.

Researcher notes

Focus review on object-form address construction and any path where display names or addresses are built from request data. The supplied evidence supports Nodemailer before 6.6.1 and a CRLF-based header injection condition, but does not provide broader exploitation telemetry.

Mitigation direction

  • Upgrade Nodemailer to version 6.6.1 or later.
  • Review vendor guidance and linked upstream fix notes.
  • Reject carriage returns and newlines in address object inputs.
  • Normalize and validate user-supplied email names and addresses.
  • Pin dependency versions and refresh lockfiles after upgrading.

Validation and detection

  • Inventory applications that depend on Nodemailer.
  • Confirm installed versions are not earlier than 6.6.1.
  • Trace public input into Nodemailer address objects.
  • Check validation blocks CRLF characters before email construction.
  • Run regression tests for email-sending workflows.
Prepared
Confidence
high
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-23400 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
6.3 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
5Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
6.3CVSS 3.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P2.83.4Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

6.3Medium
CVSS 3.1 vector shape for CVE-2021-23400Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/anodemailerunspecifiedListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.