Skip to content
Sign in
8.3 High

CVE-2026-121426 Nodemailer 3.0.0 before 10.1.4 Recipient Domain Confusion via addressparser

Description

Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that ends an angle-addr at a '>' inside a quoted local part, comment or domain literal. Attackers can submit addresses that validate as an allowed domain but are delivered to an attacker-controlled domain, bypassing recipient allow lists and disclosing message content.

CVSS 4.0 detail

Vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Exploitable remotely over the network, without an account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector
Network
Attack complexity
High
Attack requirements
Present
Privileges required
None
Interaction
None
Confidentiality
High
Integrity
Low
Availability
None
Confidentiality of other systems
None
Integrity of other systems
None
Availability of other systems
None

Affected products and versions

Product Affected versions Fixed in
nodemailer 10.1 earliest → < 10.1.4 10.1.4
nodemailer 3.0 3.0.0 → < 10.1.4 10.1.4

Other CVEs of nodemailer

The 25 CVEs of nodemailer →
CVE-2026-121424 Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that allows remote… 8.3 High CVE-2026-121425 Nodemailer from 3.0.0 before 10.1.4 contains a parsing flaw in addressparser that ends an RFC 5322 group at a… 8.3 High CVE-2026-110872 Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP… 8.2 High CVE-2026-110871 Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that… 7.1 High
Track this CVE