{"id":"CVE-2026-121946","title":"zbateson mail-mime-parser before 3.0.9 and 4.x before 4.0.6 CRLF Header Injection via Message Builders","summary":"zbateson mail-mime-parser before 3.0.9 and 4.x before 4.0.6 contains a CRLF header injection vulnerability in message-building helpers that fail to strip CR and LF characters. Attackers supplying crafted MIME type, charset, encoding, mic…","severity":"high","cvss":7.2,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","cvssSource":"cna","cwe":["CWE-93"],"vendor":"zbateson","product":"mail-mime-parser","affected":["mail-mime-parser >= 0.3.0 < 3.0.9","mail-mime-parser >= 4.0.0 < 4.0.6"],"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"partial","timestamp":"2026-11-04T18:48:57.168802Z"},"exploitAvailable":true,"published":"2026-11-04","updated":"2026-11-04","sourceUpdated":"2026-11-04T18:49:31.556Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-121946","references":[{"url":"https://github.com/zbateson/mail-mime-parser/security/advisories/GHSA-gmgm-r6fh-fq6g","label":"GitHub Security Advisory (GHSA-gmgm-r6fh-fq6g)"},{"url":"https://github.com/zbateson/mail-mime-parser/commit/f385b2923023a9a7b69003468e363a4661f1c85a"},{"url":"https://github.com/zbateson/mail-mime-parser/commit/1fa840ef367958e991e6840b4e3ffd41aca9d147"},{"url":"https://github.com/zbateson/mail-mime-parser/commit/c31c62ccc3e66a7a7da0d79954ef83807f9daa20"},{"url":"https://github.com/zbateson/mail-mime-parser/commit/b032920875c6cb35bb2ddd7abfd7e98608d75bc0"},{"url":"https://github.com/zbateson/mail-mime-parser/blob/4.0.5/src/Message/Helper/MultipartHelper.php#L270-L273"},{"url":"https://www.vulncheck.com/advisories/zbateson-mail-mime-parser-before-3.0.9-and-4-x-before-4.0.6-crlf-header-injection-via-message-builders","label":"VulnCheck Advisory: zbateson mail-mime-parser before 3.0.9 and 4.x before 4.0.6 CRLF Header Injection via Message Builders"}],"tags":["cve.org","exploit-available"],"ingestedAt":"2026-11-05T21:36:00.499Z","epss":0.00325,"epssPercentile":0.2572,"slug":"CVE-2026-121946","body":"## Overview\n\nzbateson mail-mime-parser before 3.0.9 and 4.x before 4.0.6 contains a CRLF header injection vulnerability in message-building helpers that fail to strip CR and LF characters. Attackers supplying crafted MIME type, charset, encoding, micalg, or protocol values can inject extra header lines such as a forged Bcc into outgoing messages.\n\n## Affected\n\n- `mail-mime-parser >= 0.3.0 < 3.0.9`\n- `mail-mime-parser >= 4.0.0 < 4.0.6`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":52,"depthScoreParts":{"impact":39.6,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[]}