Every CVE Search/ Get API key

CVE-2026-121425

Nodemailer 3.0.0 before 10.1.4 Recipient Injection via addressparser Group Parsing

8.3 High

Nodemailer from 3.0.0 before 10.1.4 contains a parsing flaw in addressparser that ends an RFC 5322 group at a semicolon inside quoted display names or comments. Attackers can submit crafted group addresses that conformant validators approve, redirecting mail to attacker-chosen recipients and bypassing recipient allow lists.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
Low
Availability
None

Exploit likelihood

0.32%Unchanged since Nov 4, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.3

Nodemailer 3.0.0 before 10.1.4 Recipient Injection via addressparser Group Parsing

Nodemailer from 3.0.0 before 10.1.4 contains a parsing flaw in addressparser that ends an RFC 5322 group at a semicolon inside quoted display names or comments. Attackers can submit crafted group addresses that conformant validators approve, redirecting mail to attacker-chosen recipients and bypassing recipient allow lists.

Record
CVE-2026-121425
CVSS 4.0
8.3 HighCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Weakness
CWE-20
Updated
2026-11-03
EUVDEUVD-2026-115957 8.3

Nodemailer from 3.0.0 before 10.1.4 contains a parsing flaw in addressparser that ends an RFC 5322 group at a semicolon inside quoted display names or comments. Attackers can submit crafted group addresses that conformant validators approve, redirecting mail to attacker-chosen recipients and bypassing recipient allow lists.

Record
EUVD-2026-115957
CVSS 4.0
8.3 HighCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-q9mw-f56c-cmvf 8.3

Nodemailer from 3.0.0 before 10.1.4 contains a parsing flaw in addressparser that ends an RFC...

Nodemailer from 3.0.0 before 10.1.4 contains a parsing flaw in addressparser that ends an RFC 5322 group at a semicolon inside quoted display names or comments. Attackers can submit crafted group addresses that conformant validators approve, redirecting mail to attacker-chosen recipients and bypassing recipient allow lists.

Record
GHSA-q9mw-f56c-cmvf
CVSS 4.0
8.3 HighCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Weakness
CWE-20
Updated
2026-11-03
NVD 8.3

Nodemailer from 3.0.0 before 10.1.4 contains a parsing flaw in addressparser that ends an RFC 5322 group at a semicolon inside quoted display names or comments. Attackers can submit crafted group addresses that conformant validators approve, redirecting mail to attacker-chosen recipients and bypassing recipient allow lists.

Record
CVE-2026-121425
CVSS 4.0
8.3 HighCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Weakness
CWE-20
Updated
2026-11-03
OSV 8.3

Nodemailer 3.0.0 before 10.1.4 Recipient Injection via addressparser Group Parsing

Nodemailer from 3.0.0 before 10.1.4 contains a parsing flaw in addressparser that ends an RFC 5322 group at a semicolon inside quoted display names or comments. Attackers can submit crafted group addresses that conformant validators approve, redirecting mail to attacker-chosen recipients and bypassing recipient allow lists.

Record
CVE-2026-121425
CVSS 4.0
8.3 HighCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-20
Updated
2026-11-05
OSVDEBIAN-CVE-2026-121425 8.3

Nodemailer from 3.0.0 before 10.1.4 contains a parsing flaw in addressparser that ends an RFC 5322 group at a semicolon inside quoted display names or comments. Attackers can submit crafted group addresses that conformant validators approve, redirecting mail to attacker-chosen recipients and bypassing recipient allow lists.

Record
DEBIAN-CVE-2026-121425
CVSS 4.0
8.3 HighCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-04
OSVUBUNTU-CVE-2026-121425 8.3

Nodemailer from 3.0.0 before 10.1.4 contains a parsing flaw in addressparser that ends an RFC 5322 group at a semicolon inside quoted display names or comments. Attackers can submit crafted group addresses that conformant validators approve, redirecting mail to attacker-chosen recipients and bypassing recipient allow lists.

Record
UBUNTU-CVE-2026-121425
CVSS 4.0
8.3 HighCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Updated
2026-11-05

Affected products

Affected packages

Affected packages
PackageAffectedFixed
node-nodemailer
Debian:12
 All versions, plus listed versions
10.0.0+~8.0.1-110.0.10+~8.0.1-110.0.10+~8.0.2-110.0.13+~8.0.2-110.0.14+~8.0.2-1
Show 25 moreShow less
10.1.7+~8.0.2-16.10.0+~6.4.17-16.8.0+~6.4.6-16.9.13+~6.4.14-16.9.15+~6.4.16-16.9.16+~6.4.16-16.9.4+~6.4.9-16.9.4+~6.4.9-26.9.4+~6.4.9-36.9.4+~6.4.9-47.0.10+~7.0.2-17.0.12+~7.0.5-17.0.5+~7.0.1-17.0.6+~7.0.1-17.0.9+~7.0.2-17.0.9+~7.0.2-28.0.11+~8.0.1-18.0.2+~7.0.11-18.0.3+~7.0.11-18.0.4+~7.0.11-18.0.4+~7.0.11-29.0.0+~8.0.1-19.0.3+~8.0.1-19.0.5+~8.0.1-19.0.6+~8.0.1-1
 None known
node-nodemailer
Debian:13
 All versions, plus listed versions
10.0.0+~8.0.1-110.0.10+~8.0.1-110.0.10+~8.0.2-110.0.13+~8.0.2-110.0.14+~8.0.2-1
Show 18 moreShow less
10.1.7+~8.0.2-16.10.0+~6.4.17-16.10.0+~6.4.17-1+deb13u17.0.10+~7.0.2-17.0.12+~7.0.5-17.0.5+~7.0.1-17.0.6+~7.0.1-17.0.9+~7.0.2-17.0.9+~7.0.2-28.0.11+~8.0.1-18.0.2+~7.0.11-18.0.3+~7.0.11-18.0.4+~7.0.11-18.0.4+~7.0.11-29.0.0+~8.0.1-19.0.3+~8.0.1-19.0.5+~8.0.1-19.0.6+~8.0.1-1
 None known
node-nodemailer
Debian:14
 All versions, plus listed versions
10.0.0+~8.0.1-110.0.10+~8.0.1-110.0.10+~8.0.2-110.0.13+~8.0.2-110.0.14+~8.0.2-1
Show 17 moreShow less
10.1.7+~8.0.2-16.10.0+~6.4.17-17.0.10+~7.0.2-17.0.12+~7.0.5-17.0.5+~7.0.1-17.0.6+~7.0.1-17.0.9+~7.0.2-17.0.9+~7.0.2-28.0.11+~8.0.1-18.0.2+~7.0.11-18.0.3+~7.0.11-18.0.4+~7.0.11-18.0.4+~7.0.11-29.0.0+~8.0.1-19.0.3+~8.0.1-19.0.5+~8.0.1-19.0.6+~8.0.1-1
 None known
node-nodemailer
Ubuntu:20.04:LTS
 All versions, plus listed versions
6.3.0-26.3.1-16.4.0-16.4.1-16.4.2-16.4.5-1
 None known
node-nodemailer
Ubuntu:22.04:LTS
 All versions, plus listed versions
6.4.17-36.7.0-16.7.0-26.7.1+~6.4.4-1
 None known
node-nodemailer
Ubuntu:24.04:LTS
 All versions, plus listed versions
6.9.4+~6.4.9-26.9.4+~6.4.9-3ubuntu16.9.4+~6.4.9-4
 None known
node-nodemailer
Ubuntu:26.10
 All versions, plus listed versions
8.0.4+~7.0.11-18.0.4+~7.0.11-29.0.0+~8.0.1-19.0.3+~8.0.1-19.0.5+~8.0.1-1
 None known
node-nodemailer
Ubuntu:26.04:LTS
 All versions, plus listed versions
7.0.5+~7.0.1-17.0.9+~7.0.2-27.0.10+~7.0.2-17.0.12+~7.0.5-18.0.4+~7.0.11-1
 None known

History

History
RecordedChangedSources
affected, aliases, referencesOSV
affected, aliases, referencesOSV
referencesNVD, OSV
publishedEUVD, NVD
referencesCVE List
facts, publishedEUVD
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-121425 is a high vulnerability (CVSS 8.3) in Nodemailer, published November 3, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.32%, the 25th percentile. No source names a fixed version.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open