Live › vulnerability › CVE-2026-121426
Nodemailer's addressparser ends an address early at a '>' inside a quoted local part, comment or domain literal. An attacker can submit an address that passes a domain allow list but is delivered to an attacker-controlled domain, exposing message content.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 15:21 UTC. All times on this page are UTC.
Applications that use Nodemailer to send mail and rely on recipient domain allow lists, or that pass user-supplied addresses to it. Apps that send only to fixed, hardcoded addresses are less exposed. The sources do not say which default configurations are affected.
No product ranges from the sources yet.
npm ls nodemailernodemailer in package.json and lockfiles at version 3.0.0 up to but not including 10.1.4nodemailer 10.1.4 (fixed release, per the NVD description: versions from 3.0.0 before 10.1.4 are affected)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that ends an angle-addr at a '>' inside a quoted local part, comment or domain literal. Attackers can submit addresses that validate as an allowed domain but are delivered to an attacker-controlled domain, bypassing recipient allow lists and disclosing message content.
This page as .md · .json · in your agent: get_signal("CVE-2026-121426")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.