Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-41gn-4tcp-3uep
Vulnerability ID VCID-41gn-4tcp-3uep
Aliases CVE-2021-23400
GHSA-hwqf-gcqm-7353
Summary Header injection in nodemailer
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00536 https://api.first.org/data/v1/epss?cve=CVE-2021-23400
epss 0.00536 https://api.first.org/data/v1/epss?cve=CVE-2021-23400
epss 0.00536 https://api.first.org/data/v1/epss?cve=CVE-2021-23400
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-hwqf-gcqm-7353
cvssv3.1 6.3 https://github.com/nodemailer/nodemailer/commit/7e02648cc8cd863f5085bad3cd09087bccf84b9f
generic_textual MODERATE https://github.com/nodemailer/nodemailer/commit/7e02648cc8cd863f5085bad3cd09087bccf84b9f
cvssv3.1 6.3 https://github.com/nodemailer/nodemailer/issues/1289
generic_textual MODERATE https://github.com/nodemailer/nodemailer/issues/1289
cvssv3.1 6.3 https://nvd.nist.gov/vuln/detail/CVE-2021-23400
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2021-23400
cvssv3.1 6.3 https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1314737
generic_textual MODERATE https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1314737
cvssv3.1 6.3 https://snyk.io/vuln/SNYK-JS-NODEMAILER-1296415
generic_textual MODERATE https://snyk.io/vuln/SNYK-JS-NODEMAILER-1296415
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2021-23400
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23400
https://github.com/nodemailer/nodemailer/commit/7e02648cc8cd863f5085bad3cd09087bccf84b9f
https://github.com/nodemailer/nodemailer/issues/1289
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1314737
https://snyk.io/vuln/SNYK-JS-NODEMAILER-1296415
990485 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=990485
CVE-2021-23400 https://nvd.nist.gov/vuln/detail/CVE-2021-23400
GHSA-hwqf-gcqm-7353 https://github.com/advisories/GHSA-hwqf-gcqm-7353
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L Found at https://github.com/nodemailer/nodemailer/commit/7e02648cc8cd863f5085bad3cd09087bccf84b9f
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L Found at https://github.com/nodemailer/nodemailer/issues/1289
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L Found at https://nvd.nist.gov/vuln/detail/CVE-2021-23400
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L Found at https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1314737
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L Found at https://snyk.io/vuln/SNYK-JS-NODEMAILER-1296415
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.67913
EPSS Score 0.00536
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T20:27:19.449469+00:00 GHSA Importer Import https://github.com/advisories/GHSA-hwqf-gcqm-7353 38.6.0