zbateson mail-mime-parser: CRLF header injection (CVE-2026-121946)
The zbateson mail-mime-parser library contains a CRLF header injection vulnerability in message-building helpers that fail to strip CR and LF characters.
CVE search metadata
CVE search record: CVE-2026-121946. Severity: high. CVSS: 7.2. KEV: no. Product: mail-mime-parser (< 3.0.9, 4.x < 4.0.6). Brief: zbateson mail-mime-parser: CRLF header injection (CVE-2026-121946). Brief link: https://feed.craftedsignal.io/briefs/2026-11-zbateson-crlf-injection/
Triage facts
Revision 1- Applicability
- mail-mime-parser (< 3.0.9, 4.x < 4.0.6)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 4, 14:47 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
CVE-2026-121946 identifies a CRLF header injection vulnerability in zbateson mail-mime-parser versions before 3.0.9 and 4.x before 4.0.6. The vulnerability exists because message-building helpers fail to strip CR and LF characters.
Impact
Attackers supplying crafted MIME type, charset, encoding, micalg, or protocol values can inject extra header lines, such as a forged Bcc, into outgoing messages.