{"id":"CVE-2026-121946","kind":"vulnerability","aliases":["CVE-2026-121946"],"related":[],"title":"mail-mime-parser: CRLF injection lets attackers forge headers in outgoing mail","description":"zbateson mail-mime-parser before 3.0.9 and 4.x before 4.0.6 contains a CRLF header injection vulnerability in message-building helpers that fail to strip CR and LF characters. Attackers supplying crafted MIME type, charset, encoding, micalg, or protocol values can inject extra header lines such as a forged Bcc into outgoing messages.","summary":"The mail-mime-parser PHP library fails to strip carriage return and line feed characters from MIME type, charset, encoding, micalg, or protocol values when building messages. An attacker who supplies crafted values can inject extra header lines, such as a forged Bcc, into outgoing messages.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["composer","email","mail-mime-parser","package","php"],"not_affected_if":["fixed-header-values","parsing-only-usage"],"how_to_check":"- Check the installed version of `zbateson/mail-mime-parser` in `composer.lock` or with `composer show zbateson/mail-mime-parser`\n- Look for code that passes user-supplied values into MIME type, charset, encoding, micalg or protocol settings when building messages","fix":"- `zbateson/mail-mime-parser` before `3.0.9`: move to `3.0.9` or later\n- `zbateson/mail-mime-parser` 4.x before `4.0.6`: move to `4.0.6` or later","status":"open","published_at":"2026-11-04T13:17:29+00:00","first_seen_at":"2026-11-04T13:27:04+00:00","triaged_at":"2026-11-04T13:28:00+00:00","updated_at":"2026-11-04T13:28:00+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-04T13:28:00Z","model":"claude-haiku-5-5","output":{"fix":"- `zbateson/mail-mime-parser` before `3.0.9`: move to `3.0.9` or later\n- `zbateson/mail-mime-parser` 4.x before `4.0.6`: move to `4.0.6` or later","reach":"unknown","title":"mail-mime-parser: CRLF injection lets attackers forge headers in outgoing mail","impact":"medium","summary":"The mail-mime-parser PHP library fails to strip carriage return and line feed characters from MIME type, charset, encoding, micalg, or protocol values when building messages. An attacker who supplies crafted values can inject extra header lines, such as a forged Bcc, into outgoing messages.","audience":"developers","category":"package","nicknames":[],"who_cares":["php","composer","email","mail-mime-parser"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"forged headers such as Bcc added to outgoing messages","analyst_note":"","how_to_check":"- Check the installed version of `zbateson/mail-mime-parser` in `composer.lock` or with `composer show zbateson/mail-mime-parser`\n- Look for code that passes user-supplied values into MIME type, charset, encoding, micalg or protocol settings when building messages","plain_action":"","needs_analyst":false,"not_affected_if":["parsing-only-usage","fixed-header-values"],"who_is_affected":"Applications that use the mail-mime-parser library to build outgoing email and pass user-controlled values into MIME header fields are exposed. Apps that only parse incoming mail or send fixed header values are unlikely to be affected. unknown whether other usage patterns are exposed.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000735,"input_tokens":4253,"output_tokens":619,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-121946':16A,19A '-2026':15A,18A '3.0.9':81C '4':83C '4.0.6':86C 'attack':8A,57B,106C 'bcc':71B,126C 'build':54B,96C 'carriag':38B 'charact':43B,105C 'charset':47B,111C 'compos':20B 'contain':87C 'cr':102C 'craft':60B,108C 'crlf':5A,89C 'cve':14A,17A 'email':21B 'encod':48B,112C 'extra':64B,119C 'fail':35B,99C 'feed':42B 'forg':9A,70B,125C 'header':10A,65B,90C,120C 'helper':97C 'inject':6A,63B,91C,118C 'let':7A 'lf':104C 'librari':34B 'line':41B,66B,121C 'mail':2A,13A,23B,30B,77C 'mail-mime-pars':1A,22B,29B,76C 'messag':55B,74B,95C,129C 'message-build':94C 'micalg':49B,113C 'mime':3A,24B,31B,45B,78C,109C 'outgo':12A,73B,128C 'packag':26B 'parser':4A,25B,32B,79C 'php':27B,33B 'protocol':51B,115C 'return':39B 'strip':37B,101C 'suppli':59B,107C 'type':46B,110C 'valu':52B,61B,116C 'vulner':92C 'x':84C 'zbateson':75C","nicknames":[],"mitigations":[],"who_affected":"Applications that use the mail-mime-parser library to build outgoing email and pass user-controlled values into MIME header fields are exposed. Apps that only parse incoming mail or send fixed header values are unlikely to be affected. unknown whether other usage patterns are exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["composer","email","high","mailmimeparser","package","php"],"campaign_type":null,"first_public_at":"2026-09-28T20:59:37+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121946","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121946","severity":null,"published_at":"2026-11-04T13:17:29+00:00","modified_at":"2026-11-04T13:17:29+00:00","first_seen_at":"2026-11-04T13:27:04+00:00","fetched_at":"2026-11-04T13:27:04+00:00","note":null}],"documents":[{"id":67095,"url":"https://github.com/zbateson/mail-mime-parser/commit/1fa840ef367958e991e6840b4e3ffd41aca9d147","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":67096,"url":"https://github.com/zbateson/mail-mime-parser/commit/b032920875c6cb35bb2ddd7abfd7e98608d75bc0","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":67097,"url":"https://github.com/zbateson/mail-mime-parser/commit/c31c62ccc3e66a7a7da0d79954ef83807f9daa20","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":67098,"url":"https://github.com/zbateson/mail-mime-parser/commit/f385b2923023a9a7b69003468e363a4661f1c85a","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":67099,"url":"https://github.com/zbateson/mail-mime-parser/security/advisories/GHSA-gmgm-r6fh-fq6g","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-28T20:59:37+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":67100,"url":"https://www.vulncheck.com/advisories/zbateson-mail-mime-parser-before-3.0.9-and-4-x-before-4.0.6-crlf-header-injection-via-message-builders","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}