{"id":"CVE-2026-121425","kind":"vulnerability","aliases":["CVE-2026-121425"],"related":[],"title":"Nodemailer: address parser flaw lets crafted emails bypass recipient allow lists","description":"Nodemailer from 3.0.0 before 10.1.4 contains a parsing flaw in addressparser that ends an RFC 5322 group at a semicolon inside quoted display names or comments. Attackers can submit crafted group addresses that conformant validators approve, redirecting mail to attacker-chosen recipients and bypassing recipient allow lists.","summary":"Nodemailer's addressparser ends RFC 5322 group addresses early at a semicolon inside quoted names or comments. An attacker can submit crafted addresses that pass validation and redirect mail to recipients of their choosing, bypassing allow lists.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["email","node.js","nodemailer","package"],"not_affected_if":["hardcoded-recipients","no-user-supplied-addresses"],"how_to_check":"- Check the installed version with `npm ls nodemailer` and compare it to the fixed range.\n- Search your lockfiles and dependency trees for `nodemailer` below `10.1.4`.\n- Review any code that validates recipient addresses and relies on Nodemailer's parsing.","fix":"- Nodemailer: upgrade to `10.1.4` or later (affected range is `3.0.0` up to but not including `10.1.4`).","status":"open","published_at":"2026-11-03T15:17:33+00:00","first_seen_at":"2026-11-03T15:21:59+00:00","triaged_at":"2026-11-03T15:22:42+00:00","updated_at":"2026-11-03T15:22:42+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-03T15:22:42Z","model":"claude-haiku-5-5","output":{"fix":"- Nodemailer: upgrade to `10.1.4` or later (affected range is `3.0.0` up to but not including `10.1.4`).","reach":"internet","title":"Nodemailer: address parser flaw lets crafted emails bypass recipient allow lists","impact":"medium","summary":"Nodemailer's addressparser ends RFC 5322 group addresses early at a semicolon inside quoted names or comments. An attacker can submit crafted addresses that pass validation and redirect mail to recipients of their choosing, bypassing allow lists.","audience":"developers","category":"package","nicknames":[],"who_cares":["nodemailer","node.js","email"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"mail is redirected to attacker-chosen recipients, bypassing allow lists","analyst_note":"Confirm exploitation preconditions and whether the vendor advisory at github.com or the VulnCheck advisory adds detail on the attack path.","how_to_check":"- Check the installed version with `npm ls nodemailer` and compare it to the fixed range.\n- Search your lockfiles and dependency trees for `nodemailer` below `10.1.4`.\n- Review any code that validates recipient addresses and relies on Nodemailer's parsing.","plain_action":"","needs_analyst":true,"not_affected_if":["hardcoded-recipients","no-user-supplied-addresses"],"who_is_affected":"Applications that use Nodemailer to send mail and accept addresses from users, or that rely on recipient allow lists enforced by its address parser. Apps that send only to hardcoded internal addresses are much less exposed. unknown whether other sources add further detail.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000733,"input_tokens":4195,"output_tokens":628,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-121425':14A,17A '-2026':13A,16A '10.1.4':63C '3.0.0':61C '5322':27B,74C 'address':2A,29B,44B,90C 'addresspars':24B,69C 'allow':10A,57B,105C 'approv':94C 'attack':40B,85C,99C 'attacker-chosen':98C 'bypass':8A,56B,103C 'choos':55B 'chosen':100C 'comment':38B,84C 'conform':92C 'contain':64C 'craft':6A,43B,88C 'cve':12A,15A 'display':81C 'earli':30B 'email':7A,18B 'end':25B,71C 'flaw':4A,67C 'group':28B,75C,89C 'insid':34B,79C 'let':5A 'list':11A,58B,106C 'mail':50B,96C 'name':36B,82C 'node.js':19B 'nodemail':1A,20B,22B,59C 'packag':21B 'pars':66C 'parser':3A 'pass':46B 'quot':35B,80C 'recipi':9A,52B,101C,104C 'redirect':49B,95C 'rfc':26B,73C 'semicolon':33B,78C 'submit':42B,87C 'valid':47B,93C","nicknames":[],"mitigations":[],"who_affected":"Applications that use Nodemailer to send mail and accept addresses from users, or that rely on recipient allow lists enforced by its address parser. Apps that send only to hardcoded internal addresses are much less exposed. unknown whether other sources add further detail.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["email","high","nodejs","nodemailer","package"],"first_public_at":"2026-10-19T12:05:55+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121425","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121425","severity":null,"published_at":"2026-11-03T15:17:33+00:00","modified_at":"2026-11-03T15:17:33+00:00","first_seen_at":"2026-11-03T15:21:59+00:00","fetched_at":"2026-11-03T15:21:59+00:00","note":null}],"documents":[{"id":58375,"url":"https://github.com/nodemailer/nodemailer/security/advisories/GHSA-m943-m63m-w62w","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-19T12:05:55+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":58376,"url":"https://www.vulncheck.com/advisories/nodemailer-3.0.0-before-10.1.4-recipient-injection-via-addressparser-group-parsing","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}