fix: sanitize envelope size to prevent SMTP command injection

andris9 · andris9 · commit 2d7b9710e635 · 2026-03-25T09:11:10.000+02:00
Cast envelope.size to a number before concatenating into the MAIL FROM
command, preventing CRLF injection of arbitrary SMTP commands.
diff --git a/lib/smtp-connection/index.js b/lib/smtp-connection/index.js
@@ -1159,7 +1159,10 @@ class SMTPConnection extends EventEmitter {
         }
 
         if (this._envelope.size && this._supportedExtensions.includes('SIZE')) {
-            args.push('SIZE=' + this._envelope.size);
+            const sizeValue = Number(this._envelope.size) || 0;
+            if (sizeValue > 0) {
+                args.push('SIZE=' + sizeValue);
+            }
         }
 
         // If the server supports DSN and the envelope includes an DSN prop
diff --git a/test/smtp-connection/smtp-connection-test.js b/test/smtp-connection/smtp-connection-test.js
@@ -1395,6 +1395,24 @@ describe('SMTP-Connection Tests', () => {
                 );
             });
 
+            it('should sanitize CRLF in envelope size to prevent SMTP injection', (t, done) => {
+                client.send(
+                    {
+                        from: 'test@valid.sender',
+                        to: ['test@valid.recipient'],
+                        size: '100\r\nRCPT TO:<attacker@evil.com>'
+                    },
+                    'test',
+                    (err, info) => {
+                        assert.ok(!err);
+                        assert.deepStrictEqual(info.accepted, ['test@valid.recipient']);
+                        assert.ok(!info.accepted.includes('attacker@evil.com'));
+                        assert.ok(!info.rejected.includes('attacker@evil.com'));
+                        done();
+                    }
+                );
+            });
+
             it('should return error for no valid recipients', (t, done) => {
                 client.send(
                     {

Original file line number	Diff line number	Diff line change
`@@ -1159,7 +1159,10 @@ class SMTPConnection extends EventEmitter {`
`1159`	`1159`	`}`
`1160`	`1160`
`1161`	`1161`	`if (this._envelope.size && this._supportedExtensions.includes('SIZE')) {`
`1162`		`- args.push('SIZE=' + this._envelope.size);`
	`1162`	`+ const sizeValue = Number(this._envelope.size) \|\| 0;`
	`1163`	`+ if (sizeValue > 0) {`
	`1164`	`+ args.push('SIZE=' + sizeValue);`
	`1165`	`+ }`
`1163`	`1166`	`}`
`1164`	`1167`
`1165`	`1168`	`// If the server supports DSN and the envelope includes an DSN prop`