{"id":"CVE-2026-125755","kind":"vulnerability","aliases":["CVE-2026-125755"],"related":[],"title":"Nodemailer: address parser truncates domains, letting mail reach attacker-chosen recipients","description":"Nodemailer 3.0.0 before 10.4.1 contains an address parsing flaw in addressparser that truncates domains at folding whitespace or comments before a dot, allowing attackers to bypass recipient domain restrictions. Attackers can submit crafted to, cc, bcc or replyTo addresses that pass RFC 5322 domain checks but deliver mail to an attacker-chosen address under the application's sender identity.","summary":"Nodemailer's addressparser cuts recipient domains at folding whitespace or comments before a dot, so a crafted to, cc, bcc or replyTo address passes domain checks. An attacker can then get mail delivered to an address of their choice under the application's sender identity.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"nodemailer","fixed":[],"affected":"","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["email","node.js","nodemailer","package"],"not_affected_if":["fixed-recipients","no-user-recipient-input"],"how_to_check":"- Look for the `nodemailer` package in your lockfile and check its version (for example `npm ls nodemailer`).\n- Check whether your app passes user-supplied to, cc, bcc or replyTo values to Nodemailer and relies on its domain checks to restrict recipients.","fix":"- `nodemailer` `10.4.1` (fixed version for the range before 10.4.1, per the NVD description)","status":"open","published_at":"2026-11-10T16:17:22+00:00","first_seen_at":"2026-11-10T16:22:34+00:00","triaged_at":"2026-11-10T16:23:20+00:00","updated_at":"2026-11-10T16:23:20+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-10T16:23:20Z","model":"claude-haiku-5-5","output":{"fix":"- `nodemailer` `10.4.1` (fixed version for the range before 10.4.1, per the NVD description)","reach":"internet","title":"Nodemailer: address parser truncates domains, letting mail reach attacker-chosen recipients","impact":"medium","summary":"Nodemailer's addressparser cuts recipient domains at folding whitespace or comments before a dot, so a crafted to, cc, bcc or replyTo address passes domain checks. An attacker can then get mail delivered to an address of their choice under the application's sender identity.","audience":"developers","category":"package","nicknames":[],"who_cares":["nodemailer","node.js","email"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker gets mail sent to their address under your sender identity","analyst_note":"Confirm the affected range and fixed version against the vendor advisory and release notes linked on github.com, and whether the NVD CVSS 8.3 matches the vendor's rating.","how_to_check":"- Look for the `nodemailer` package in your lockfile and check its version (for example `npm ls nodemailer`).\n- Check whether your app passes user-supplied to, cc, bcc or replyTo values to Nodemailer and relies on its domain checks to restrict recipients.","plain_action":"","product_name":"nodemailer","needs_analyst":true,"not_affected_if":["fixed-recipients","no-user-recipient-input"],"who_is_affected":"Applications that use Nodemailer 3.0.0 up to but not including 10.4.1 to send mail from user-supplied recipient fields, and that depend on domain restrictions to limit who receives it. Apps that send only to fixed, server-chosen addresses are less exposed. unknown for anything beyond what the NVD description states.","user_interaction":"no","product_ecosystem":"npm","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000802,"input_tokens":4669,"output_tokens":670,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-125755':15A,18A '-2026':14A,17A '10.4.1':72C '3.0.0':70C '5322':111C 'address':2A,46B,59B,75C,107C,122C 'addresspars':26B,79C 'allow':91C 'applic':65B,125C 'attack':10A,51B,92C,98C,120C 'attacker-chosen':9A,119C 'bcc':43B,104C 'bypass':94C 'cc':42B,103C 'check':49B,113C 'choic':62B 'chosen':11A,121C 'comment':34B,87C 'contain':73C 'craft':40B,101C 'cut':27B 'cve':13A,16A 'deliv':56B,115C 'domain':5A,29B,48B,82C,96C,112C 'dot':37B,90C 'email':20B 'flaw':77C 'fold':31B,84C 'get':54B 'ident':68B,128C 'let':6A 'mail':7A,55B,116C 'node.js':21B 'nodemail':1A,22B,24B,69C 'nodemailer':19A 'packag':23B 'pars':76C 'parser':3A 'pass':47B,109C 'reach':8A 'recipi':12A,28B,95C 'replyto':45B,106C 'restrict':97C 'rfc':110C 'sender':67B,127C 'submit':100C 'truncat':4A,81C 'whitespac':32B,85C","nicknames":[],"mitigations":[],"who_affected":"Applications that use Nodemailer 3.0.0 up to but not including 10.4.1 to send mail from user-supplied recipient fields, and that depend on domain restrictions to limit who receives it. Apps that send only to fixed, server-chosen addresses are less exposed. unknown for anything beyond what the NVD description states.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["nodemailer"],"ptokens":["nodemailer"],"labels":["email","high","nodejs","nodemailer","npm","package"],"campaign_type":null,"search_a":"'-125755':15A,18A '-2026':14A,17A 'address':2A 'attack':10A 'attacker-chosen':9A 'chosen':11A 'cve':13A,16A 'domain':5A 'let':6A 'mail':7A 'nodemail':1A 'nodemailer':19A 'parser':3A 'reach':8A 'recipi':12A 'truncat':4A","search_b":"'address':46B,59B 'addresspars':26B 'applic':65B 'attack':51B 'bcc':43B 'cc':42B 'check':49B 'choic':62B 'comment':34B 'craft':40B 'cut':27B 'deliv':56B 'domain':29B,48B 'dot':37B 'email':20B 'fold':31B 'get':54B 'ident':68B 'mail':55B 'node.js':21B 'nodemail':22B,24B 'packag':23B 'pass':47B 'recipi':28B 'replyto':45B 'sender':67B 'whitespac':32B","search_c":"'10.4.1':72C '3.0.0':70C '5322':111C 'address':75C,107C,122C 'addresspars':79C 'allow':91C 'applic':125C 'attack':92C,98C,120C 'attacker-chosen':119C 'bcc':104C 'bypass':94C 'cc':103C 'check':113C 'chosen':121C 'comment':87C 'contain':73C 'craft':101C 'deliv':115C 'domain':82C,96C,112C 'dot':90C 'flaw':77C 'fold':84C 'ident':128C 'mail':116C 'nodemail':69C 'pars':76C 'pass':109C 'recipi':95C 'replyto':106C 'restrict':97C 'rfc':110C 'sender':127C 'submit':100C 'truncat':81C 'whitespac':85C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T08:21:32+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125755","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125755","severity":null,"published_at":"2026-11-10T16:17:22+00:00","modified_at":"2026-11-10T16:17:22+00:00","first_seen_at":"2026-11-10T16:22:34+00:00","fetched_at":"2026-11-10T16:22:34+00:00","note":null}],"documents":[{"id":116127,"url":"https://github.com/nodemailer/nodemailer/commit/c2b9c41bb81b2294ebadd294ad15ff035a17d0a5","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":116128,"url":"https://github.com/nodemailer/nodemailer/releases/tag/v10.4.1","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":116129,"url":"https://github.com/nodemailer/nodemailer/security/advisories/GHSA-3q53-mvfw-q9v8","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-10T08:21:32+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":116130,"url":"https://www.vulncheck.com/advisories/nodemailer-3.0.0-before-10.4.1-recipient-allow-list-bypass-via-addressparser","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}