CRLF Header Injection Vulnerability in mail-mime-parser

The zbateson/mail-mime-parser library (versions < 3.0.6 and 4.0.0 through 4.0.1) contains a CRLF header injection vulnerability, identified as CVE-2026-61815. The flaw exists because the library fails to properly sanitize carriage-return (CR) and line-feed (LF) characters from attachment filenames during both the parsing of inbound MIME messages and the construction of outbound messages.

An attacker can exploit this by crafting a malicious attachment filename containing encoded CRLF characters. When an application parses a message containing such a filename and subsequently re-attaches or re-forwards the file, the library inadvertently serializes the CRLF characters into the email headers. This allows the attacker to inject arbitrary email headers, such as 'Bcc', enabling the silent exfiltration of email content to an attacker-controlled address. This vulnerability affects any application logic that retrieves a filename from a parsed message and uses it to construct a new MIME part.

Impact

Successful exploitation allows for the silent exfiltration of sensitive email communications via unauthorized 'Bcc' header injection. Any enterprise application that automatically processes, forwards, or re-attaches files from inbound emails using the vulnerable library version is at risk.

Recommendation

Prioritized, concrete actions:

• Upgrade the zbateson/mail-mime-parser library to version 3.0.6 or 4.0.2 immediately.
• If immediate patching is not feasible, implement a strict sanitization routine to strip CR and LF characters from any filename retrieved via getFilename() before using it in any outbound email construction, such as: preg_replace('/[\r\n]+/', ' ', $filename).
• Conduct a code review of downstream applications using mail-mime-parser to identify instances where filenames parsed from inbound messages are reused in outgoing mail construction.