Mail-Mime-Parser (< 3.0.9, 4.x < 4.0.6) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/mail-mime-parser--3.0.9-4.x--4.0.6/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 04 Nov 2026 14:47:58 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgzbateson mail-mime-parser: CRLF header injection (CVE-2026-121946)https://feed.craftedsignal.io/briefs/2026-11-zbateson-crlf-injection/Wed, 04 Nov 2026 14:47:58 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-zbateson-crlf-injection/The zbateson mail-mime-parser library contains a CRLF header injection vulnerability in message-building helpers that fail to strip CR and LF characters.CVE-2026-121946 identifies a CRLF header injection vulnerability in zbateson mail-mime-parser versions before 3.0.9 and 4.x before 4.0.6. The vulnerability exists because message-building helpers fail to strip CR and LF characters.

Impact

Attackers supplying crafted MIME type, charset, encoding, micalg, or protocol values can inject extra header lines, such as a forged Bcc, into outgoing messages.

]]>highadvisory