CVE-2026-121946 · Package
NO FIX YET · SEE WHAT TO DO
The mail-mime-parser PHP library fails to strip carriage return and line feed characters from MIME type, charset, encoding, micalg, or protocol values when building messages. An attacker who supplies crafted values can inject extra header lines, such as a forged Bcc, into outgoing messages.
first public Sep 28, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Applications that use the mail-mime-parser library to build outgoing email and pass user-controlled values into MIME header fields are exposed. Apps that only parse incoming mail or send fixed header values are unlikely to be affected. unknown whether other usage patterns are exposed.
Not affected if fixed-header-values, parsing-only-usage
Who cares composer, email, mail-mime-parser, php
zbateson/mail-mime-parser in composer.lock or with composer show zbateson/mail-mime-parserzbateson/mail-mime-parser before 3.0.9: move to 3.0.9 or laterzbateson/mail-mime-parser 4.x before : move to or laterzbateson mail-mime-parser before 3.0.9 and 4.x before 4.0.6 contains a CRLF header injection vulnerability in message-building helpers that fail to strip CR and LF characters. Attackers supplying crafted MIME type, charset, encoding, micalg, or protocol values can inject extra header lines such as a forged Bcc into outgoing messages.
4.0.64.0.6This page as .md · .json · in your agent: get_signal("CVE-2026-121946") · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.