---
id: "CVE-2026-121946"
kind: "vulnerability"
aliases: ["CVE-2026-121946"]
title: "mail-mime-parser: CRLF injection lets attackers forge headers in outgoing mail"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["composer", "email", "mail-mime-parser", "package", "php"]
not_affected_if: ["fixed-header-values", "parsing-only-usage"]
published_at: "2026-11-04T13:17:29+00:00"
first_seen_at: "2026-11-04T13:27:04+00:00"
updated_at: "2026-11-04T13:28:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121946", "first_seen_at": "2026-11-04T13:27:04+00:00"}]
---

# mail-mime-parser: CRLF injection lets attackers forge headers in outgoing mail

The mail-mime-parser PHP library fails to strip carriage return and line feed characters from MIME type, charset, encoding, micalg, or protocol values when building messages. An attacker who supplies crafted values can inject extra header lines, such as a forged Bcc, into outgoing messages.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of `zbateson/mail-mime-parser` in `composer.lock` or with `composer show zbateson/mail-mime-parser`
- Look for code that passes user-supplied values into MIME type, charset, encoding, micalg or protocol settings when building messages

## Fix

- `zbateson/mail-mime-parser` before `3.0.9`: move to `3.0.9` or later
- `zbateson/mail-mime-parser` 4.x before `4.0.6`: move to `4.0.6` or later

## Timeline

- 2026-11-04T13:27:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121946

## Documents

- [advisory] Vendor advisory: github.com https://github.com/zbateson/mail-mime-parser/security/advisories/GHSA-gmgm-r6fh-fq6g
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/zbateson-mail-mime-parser-before-3.0.9-and-4-x-before-4.0.6-crlf-header-injection-via-message-builders
- [fix] Patch: github.com https://github.com/zbateson/mail-mime-parser/commit/1fa840ef367958e991e6840b4e3ffd41aca9d147
- [fix] Patch: github.com https://github.com/zbateson/mail-mime-parser/commit/b032920875c6cb35bb2ddd7abfd7e98608d75bc0
- [fix] Patch: github.com https://github.com/zbateson/mail-mime-parser/commit/c31c62ccc3e66a7a7da0d79954ef83807f9daa20
- [fix] Patch: github.com https://github.com/zbateson/mail-mime-parser/commit/f385b2923023a9a7b69003468e363a4661f1c85a

## From the sources

zbateson mail-mime-parser before 3.0.9 and 4.x before 4.0.6 contains a CRLF header injection vulnerability in message-building helpers that fail to strip CR and LF characters. Attackers supplying crafted MIME type, charset, encoding, micalg, or protocol values can inject extra header lines such as a forged Bcc into outgoing messages.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_