CVE-2021-23400

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain newlines and carriage returns is passed into an address object.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74

Affected software

No affected versions have been published.

Timeline

Published: Jun 29, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-234016.1This affects all versions of package Flask-User. When using the make_safe_url function, it is possible to bypass URL validation and redirect CVE-2021-234029.8All versions of package record-like-deep-assign are vulnerable to Prototype Pollution via the main functionality.CVE-2021-234039.8All versions of package ts-nodash are vulnerable to Prototype Pollution via the Merge() function due to lack of validation input.CVE-2021-234048.8This affects all versions of package sqlite-web. The SQL dashboard area allows sensitive actions to be performed without validating that the CVE-2021-234058.8This affects the package pimcore/pimcore before 10.0.7. This issue exists due to the absence of check on the storeId parameter in the method CVE-2021-234069.8This affects the package pac-resolver before 5.0.0. This can occur when used with untrusted input, due to unsafe PAC file handling. **NOTE:*CVE-2021-234077.5This affects the package elFinder.Net.Core from 0 and before 1.2.4. The user-controlled file name is not properly sanitized before it is use CVE-2021-234084.3This affects the package com.graphhopper:graphhopper-web-bundle before 3.2, from 4.0-pre1 and before 4.0. The URL parser could be tricked in CVE-2021-234097.5The package github.com/pires/go-proxyproto before 0.6.0 are vulnerable to Denial of Service (DoS) via creating connections without the proxy CVE-2021-23413.1Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that a CVE-2021-234116.1Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the main functionality. It accepts input that can result CVE-2021-234129.8All versions of package gitlogplus are vulnerable to Command Injection via the main functionality, as options attributes are appended to the