{"id":"CVE-2026-121424","kind":"vulnerability","aliases":["CVE-2026-121424"],"related":[],"title":"Nodemailer: address parser lets attackers redirect email to hidden recipients","description":"Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that allows remote attackers to redirect recipients by ending nested RFC 5322 comments at the first closing parenthesis. Attackers can submit addresses whose nested comment hides an attacker address, bypassing conformant validators and recipient allow lists to receive mail or spoof senders in mailparser.","summary":"Nodemailer's address parser ends nested RFC 5322 comments at the first closing parenthesis, so an address hidden inside a comment can be read differently by Nodemailer than by a validator. An attacker can use this to bypass recipient allow lists and receive mail or spoof senders.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["email","node.js","nodemailer","package"],"not_affected_if":["fixed-recipients","no-nodemailer"],"how_to_check":"- Check the installed Nodemailer version with `npm ls nodemailer`\n- Look for `nodemailer` in the dependency tree of any service that sends mail or uses mailparser\n- Review whether recipient allow lists validate addresses before they reach Nodemailer","fix":"- Nodemailer: move to `10.1.4` or later (affected range is from `3.0.0` before `10.1.4`)","status":"open","published_at":"2026-11-03T15:17:32+00:00","first_seen_at":"2026-11-03T15:21:59+00:00","triaged_at":"2026-11-03T15:22:43+00:00","updated_at":"2026-11-03T15:22:43+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-03T15:22:43Z","model":"claude-haiku-5-5","output":{"fix":"- Nodemailer: move to `10.1.4` or later (affected range is from `3.0.0` before `10.1.4`)","reach":"internet","title":"Nodemailer: address parser lets attackers redirect email to hidden recipients","impact":"medium","summary":"Nodemailer's address parser ends nested RFC 5322 comments at the first closing parenthesis, so an address hidden inside a comment can be read differently by Nodemailer than by a validator. An attacker can use this to bypass recipient allow lists and receive mail or spoof senders.","audience":"developers","category":"package","nicknames":[],"who_cares":["nodemailer","node.js","email"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"mail sent to attacker address; sender spoofed","analyst_note":"Confirm whether attacker-controlled address input reaches Nodemailer unvalidated; read the vendor advisory on GitHub and the VulnCheck advisory for the exact conditions.","how_to_check":"- Check the installed Nodemailer version with `npm ls nodemailer`\n- Look for `nodemailer` in the dependency tree of any service that sends mail or uses mailparser\n- Review whether recipient allow lists validate addresses before they reach Nodemailer","plain_action":"","needs_analyst":true,"not_affected_if":["fixed-recipients","no-nodemailer"],"who_is_affected":"Applications that use Nodemailer or mailparser to send mail to addresses that come from users, or that rely on recipient allow lists to restrict who receives mail. Services that only send to fixed internal addresses are less exposed. unknown whether other sources add further conditions.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000732,"input_tokens":4208,"output_tokens":623,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-121424':13A,16A '-2026':12A,15A '10.1.4':72C '3.0.0':70C '5322':28B,91C 'address':2A,23B,37B,75C,101C,108C 'addresspars':79C 'allow':60B,81C,114C 'attack':5A,53B,83C,98C,107C 'bypass':58B,109C 'close':33B,96C 'comment':29B,41B,92C,104C 'conform':110C 'contain':73C 'cve':11A,14A 'differ':45B 'email':7A,17B 'end':25B,88C 'first':32B,95C 'hidden':9A,38B 'hide':105C 'insid':39B 'let':4A 'list':61B,115C 'mail':64B,118C 'mailpars':123C 'nest':26B,89C,103C 'node.js':18B 'nodemail':1A,19B,21B,47B,68C 'packag':20B 'parenthesi':34B,97C 'pars':76C 'parser':3A,24B 'read':44B 'receiv':63B,117C 'recipi':10A,59B,86C,113C 'redirect':6A,85C 'remot':82C 'rfc':27B,90C 'sender':67B,121C 'spoof':66B,120C 'submit':100C 'use':55B 'valid':51B,111C 'vulner':77C 'whose':102C","nicknames":[],"mitigations":[],"who_affected":"Applications that use Nodemailer or mailparser to send mail to addresses that come from users, or that rely on recipient allow lists to restrict who receives mail. Services that only send to fixed internal addresses are less exposed. unknown whether other sources add further conditions.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["email","high","nodejs","nodemailer","package"],"first_public_at":"2026-10-19T12:05:44+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121424","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121424","severity":null,"published_at":"2026-11-03T15:17:32+00:00","modified_at":"2026-11-03T15:17:32+00:00","first_seen_at":"2026-11-03T15:21:59+00:00","fetched_at":"2026-11-03T15:21:59+00:00","note":null}],"documents":[{"id":58373,"url":"https://github.com/nodemailer/nodemailer/security/advisories/GHSA-8c8m-p3m8-cjg8","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-19T12:05:44+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":58374,"url":"https://www.vulncheck.com/advisories/nodemailer-3.0.0-before-10.1.4-address-parsing-bypass-via-nested-comments","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}