CVE-2026-121946mediumCWE-93

CVE-2026-121946: medium-severity vulnerability in zbateson mail-mime-parser

zbateson mail-mime-parser before 3.0.9 and 4.x before 4.0.6 CRLF Header Injection via Message Builders

Published

Follow this CVE+ Monitor mail-mime-parser

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.9epss 0.3%
zbateson mail-mime-parser before 3.0.9 and 4.x before 4.0.6 contains a CRLF header injection vulnerability in message-building helpers that fail to strip CR and LF characters. Attackers supplying crafted MIME type, charset, encoding, micalg, or protocol values can inject extra header lines such as a forged Bcc into outgoing messages.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Affected products
zbateson · mail-mime-parser
Related CVEs — zbateson mail-mime-parser

In the same product, most dangerous first.

CVE-2026-61816HIGHzbateson/mail-mime-parser has uncontrolled resource consumption (CPU/memory DoS) parsing untrusted MIMEEPSS 0.4%CVE-2026-61815HIGHzbateson/mail-mime-parser has CRLF header injection via attachment filenameEPSS 0.2%