Vulnerability class

CRLF injection

Unfiltered line breaks that add headers to a message.

1 write-up, 1 vulnerability

CVE-2026-34975

8.5 · High

31 Mar 2026 7 min

Email header injection in Plunk through raw MIME construction in SESService

Plunk copied the sender name, subject, custom headers and attachment names into raw MIME without filtering line breaks, letting API users add headers.

CRLF injection
Email
npm

Vulnerabilities

Identifier	Product	Vulnerability	CVSS	Published
CVE-2026-34975	Plunk	CRLF injection in raw MIME headers	8.5 High	31 Mar 2026

All vulnerabilities