---
id: "CVE-2026-121424"
kind: "vulnerability"
aliases: ["CVE-2026-121424"]
title: "Nodemailer: address parser lets attackers redirect email to hidden recipients"
severity: "high"
cvss: 8.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["email", "node.js", "nodemailer", "package"]
not_affected_if: ["fixed-recipients", "no-nodemailer"]
published_at: "2026-11-03T15:17:32+00:00"
first_seen_at: "2026-11-03T15:21:59+00:00"
updated_at: "2026-11-03T15:22:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121424", "first_seen_at": "2026-11-03T15:21:59+00:00"}]
---

# Nodemailer: address parser lets attackers redirect email to hidden recipients

Nodemailer's address parser ends nested RFC 5322 comments at the first closing parenthesis, so an address hidden inside a comment can be read differently by Nodemailer than by a validator. An attacker can use this to bypass recipient allow lists and receive mail or spoof senders.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Nodemailer version with `npm ls nodemailer`
- Look for `nodemailer` in the dependency tree of any service that sends mail or uses mailparser
- Review whether recipient allow lists validate addresses before they reach Nodemailer

## Fix

- Nodemailer: move to `10.1.4` or later (affected range is from `3.0.0` before `10.1.4`)

## Timeline

- 2026-11-03T15:21:59+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121424

## Documents

- [advisory] Vendor advisory: github.com https://github.com/nodemailer/nodemailer/security/advisories/GHSA-8c8m-p3m8-cjg8
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/nodemailer-3.0.0-before-10.1.4-address-parsing-bypass-via-nested-comments

## From the sources

Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that allows remote attackers to redirect recipients by ending nested RFC 5322 comments at the first closing parenthesis. Attackers can submit addresses whose nested comment hides an attacker address, bypassing conformant validators and recipient allow lists to receive mail or spoof senders in mailparser.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_