Live › vulnerability › CVE-2026-121424
Nodemailer's address parser ends nested RFC 5322 comments at the first closing parenthesis, so an address hidden inside a comment can be read differently by Nodemailer than by a validator. An attacker can use this to bypass recipient allow lists and receive mail or spoof senders.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 15:21 UTC. All times on this page are UTC.
Applications that use Nodemailer or mailparser to send mail to addresses that come from users, or that rely on recipient allow lists to restrict who receives mail. Services that only send to fixed internal addresses are less exposed. unknown whether other sources add further conditions.
No product ranges from the sources yet.
npm ls nodemailernodemailer in the dependency tree of any service that sends mail or uses mailparser10.1.4 or later (affected range is from 3.0.0 before 10.1.4)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that allows remote attackers to redirect recipients by ending nested RFC 5322 comments at the first closing parenthesis. Attackers can submit addresses whose nested comment hides an attacker address, bypassing conformant validators and recipient allow lists to receive mail or spoof senders in mailparser.
This page as .md · .json · in your agent: get_signal("CVE-2026-121424")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.