CVE-2026-121424
Nodemailer 3.0.0 before 10.1.4 Address Parsing Bypass via Nested Comments
Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that allows remote attackers to redirect recipients by ending nested RFC 5322 comments at the first closing parenthesis. Attackers can submit addresses whose nested comment hides an attacker address, bypassing conformant validators and recipient allow lists to receive mail or spoof senders in mailparser.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Nodemailer 3.0.0 before 10.1.4 Address Parsing Bypass via Nested Comments
Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that allows remote attackers to redirect recipients by ending nested RFC 5322 comments at the first closing parenthesis. Attackers can submit addresses whose nested comment hides an attacker address, bypassing conformant validators and recipient allow lists to receive mail or spoof senders in mailparser.
- Record
CVE-2026-121424- CVSS 4.0
- 8.3 High
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-20
- Updated
- 2026-11-03
EUVDEUVD-2026-115956
Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that allows remote attackers to redirect recipients by ending nested RFC 5322 comments at the first closing parenthesis. Attackers can submit addresses whose nested comment hides an attacker address, bypassing conformant validators and recipient allow lists to receive mail or spoof senders in mailparser.
- Record
EUVD-2026-115956- CVSS 4.0
- 8.3 High
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-f6c5-wvmr-hc29
Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser...
Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that allows remote attackers to redirect recipients by ending nested RFC 5322 comments at the first closing parenthesis. Attackers can submit addresses whose nested comment hides an attacker address, bypassing conformant validators and recipient allow lists to receive mail or spoof senders in mailparser.
- Record
GHSA-f6c5-wvmr-hc29- CVSS 4.0
- 8.3 High
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-20
- Updated
- 2026-11-03
NVD
Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that allows remote attackers to redirect recipients by ending nested RFC 5322 comments at the first closing parenthesis. Attackers can submit addresses whose nested comment hides an attacker address, bypassing conformant validators and recipient allow lists to receive mail or spoof senders in mailparser.
- Record
CVE-2026-121424- CVSS 4.0
- 8.3 High
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-20
- Updated
- 2026-11-03
OSV
Nodemailer 3.0.0 before 10.1.4 Address Parsing Bypass via Nested Comments
Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that allows remote attackers to redirect recipients by ending nested RFC 5322 comments at the first closing parenthesis. Attackers can submit addresses whose nested comment hides an attacker address, bypassing conformant validators and recipient allow lists to receive mail or spoof senders in mailparser.
- Record
CVE-2026-121424- CVSS 4.0
- 8.3 High
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-20
- Updated
- 2026-11-05
OSVDEBIAN-CVE-2026-121424
Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that allows remote attackers to redirect recipients by ending nested RFC 5322 comments at the first closing parenthesis. Attackers can submit addresses whose nested comment hides an attacker address, bypassing conformant validators and recipient allow lists to receive mail or spoof senders in mailparser.
- Record
DEBIAN-CVE-2026-121424- CVSS 4.0
- 8.3 High
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-04
OSVUBUNTU-CVE-2026-121424
Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that allows remote attackers to redirect recipients by ending nested RFC 5322 comments at the first closing parenthesis. Attackers can submit addresses whose nested comment hides an attacker address, bypassing conformant validators and recipient allow lists to receive mail or spoof senders in mailparser.
- Record
UBUNTU-CVE-2026-121424- CVSS 4.0
- 8.3 High
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N - Updated
- 2026-11-05
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
node-nodemailerDebian:12 |
All versions, plus listed versions 10.0.0+~8.0.1-110.0.10+~8.0.1-110.0.10+~8.0.2-110.0.13+~8.0.2-110.0.14+~8.0.2-1 Show 25 moreShow less10.1.7+~8.0.2-16.10.0+~6.4.17-16.8.0+~6.4.6-16.9.13+~6.4.14-16.9.15+~6.4.16-16.9.16+~6.4.16-16.9.4+~6.4.9-16.9.4+~6.4.9-26.9.4+~6.4.9-36.9.4+~6.4.9-47.0.10+~7.0.2-17.0.12+~7.0.5-17.0.5+~7.0.1-17.0.6+~7.0.1-17.0.9+~7.0.2-17.0.9+~7.0.2-28.0.11+~8.0.1-18.0.2+~7.0.11-18.0.3+~7.0.11-18.0.4+~7.0.11-18.0.4+~7.0.11-29.0.0+~8.0.1-19.0.3+~8.0.1-19.0.5+~8.0.1-19.0.6+~8.0.1-1 |
None known |
node-nodemailerDebian:13 |
All versions, plus listed versions 10.0.0+~8.0.1-110.0.10+~8.0.1-110.0.10+~8.0.2-110.0.13+~8.0.2-110.0.14+~8.0.2-1 Show 18 moreShow less10.1.7+~8.0.2-16.10.0+~6.4.17-16.10.0+~6.4.17-1+deb13u17.0.10+~7.0.2-17.0.12+~7.0.5-17.0.5+~7.0.1-17.0.6+~7.0.1-17.0.9+~7.0.2-17.0.9+~7.0.2-28.0.11+~8.0.1-18.0.2+~7.0.11-18.0.3+~7.0.11-18.0.4+~7.0.11-18.0.4+~7.0.11-29.0.0+~8.0.1-19.0.3+~8.0.1-19.0.5+~8.0.1-19.0.6+~8.0.1-1 |
None known |
node-nodemailerDebian:14 |
All versions, plus listed versions 10.0.0+~8.0.1-110.0.10+~8.0.1-110.0.10+~8.0.2-110.0.13+~8.0.2-110.0.14+~8.0.2-1 Show 17 moreShow less10.1.7+~8.0.2-16.10.0+~6.4.17-17.0.10+~7.0.2-17.0.12+~7.0.5-17.0.5+~7.0.1-17.0.6+~7.0.1-17.0.9+~7.0.2-17.0.9+~7.0.2-28.0.11+~8.0.1-18.0.2+~7.0.11-18.0.3+~7.0.11-18.0.4+~7.0.11-18.0.4+~7.0.11-29.0.0+~8.0.1-19.0.3+~8.0.1-19.0.5+~8.0.1-19.0.6+~8.0.1-1 |
None known |
node-nodemailerUbuntu:20.04:LTS |
All versions, plus listed versions 6.3.0-26.3.1-16.4.0-16.4.1-16.4.2-16.4.5-1 |
None known |
node-nodemailerUbuntu:22.04:LTS |
All versions, plus listed versions 6.4.17-36.7.0-16.7.0-26.7.1+~6.4.4-1 |
None known |
node-nodemailerUbuntu:24.04:LTS |
All versions, plus listed versions 6.9.4+~6.4.9-26.9.4+~6.4.9-3ubuntu16.9.4+~6.4.9-4 |
None known |
node-nodemailerUbuntu:26.10 |
All versions, plus listed versions 8.0.4+~7.0.11-18.0.4+~7.0.11-29.0.0+~8.0.1-19.0.3+~8.0.1-19.0.5+~8.0.1-1 |
None known |
node-nodemailerUbuntu:26.04:LTS |
All versions, plus listed versions 7.0.5+~7.0.1-17.0.9+~7.0.2-27.0.10+~7.0.2-17.0.12+~7.0.5-18.0.4+~7.0.11-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| affected, aliases, references | OSV | |
| references | CVE List, EUVD, NVD, OSV | |
| published | EUVD, NVD | |
| facts, published | EUVD | |
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-121424 is a high vulnerability (CVSS 8.3) in Nodemailer, published November 3, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 27th percentile. No source names a fixed version.
References
github.com/nodemailer/nodemailer/security/advisories/GHSA-8c8m-p3m8-cjg8
vulncheck.com/advisories/nodemailer-3.0.0-before-10.1.4-address-parsing-bypass-via-nested-comments
nvd.nist.gov/vuln/detail/CVE-2026-121424
security-tracker.debian.org/tracker/CVE-2026-121424
ubuntu.com/security/CVE-2026-121424
cve.org/CVERecord?id=CVE-2026-121424