CVE-2026-121426
Nodemailer 3.0.0 before 10.1.4 Recipient Domain Confusion via addressparser
Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that ends an angle-addr at a '>' inside a quoted local part, comment or domain literal. Attackers can submit addresses that validate as an allowed domain but are delivered to an attacker-controlled domain, bypassing recipient allow lists and disclosing message content.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Nodemailer 3.0.0 before 10.1.4 Recipient Domain Confusion via addressparser
Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that ends an angle-addr at a '>' inside a quoted local part, comment or domain literal. Attackers can submit addresses that validate as an allowed domain but are delivered to an attacker-controlled domain, bypassing recipient allow lists and disclosing message content.
- Record
CVE-2026-121426- CVSS 4.0
- 8.3 High
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-20
- Updated
- 2026-11-07
EUVDEUVD-2026-115958
Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that ends an angle-addr at a '>' inside a quoted local part, comment or domain literal. Attackers can submit addresses that validate as an allowed domain but are delivered to an attacker-controlled domain, bypassing recipient allow lists and disclosing message content.
- Record
EUVD-2026-115958- CVSS 4.0
- 8.3 High
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-07
GitHub AdvisoriesGHSA-crhf-rr59-7pch
Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser...
Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that ends an angle-addr at a '>' inside a quoted local part, comment or domain literal. Attackers can submit addresses that validate as an allowed domain but are delivered to an attacker-controlled domain, bypassing recipient allow lists and disclosing message content.
- Record
GHSA-crhf-rr59-7pch- CVSS 4.0
- 8.3 High
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-20
- Updated
- 2026-11-03
NVD
Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that ends an angle-addr at a '>' inside a quoted local part, comment or domain literal. Attackers can submit addresses that validate as an allowed domain but are delivered to an attacker-controlled domain, bypassing recipient allow lists and disclosing message content.
- Record
CVE-2026-121426- CVSS 4.0
- 8.3 High
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-20
- Updated
- 2026-11-07
OSV
Nodemailer 3.0.0 before 10.1.4 Recipient Domain Confusion via addressparser
Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that ends an angle-addr at a '>' inside a quoted local part, comment or domain literal. Attackers can submit addresses that validate as an allowed domain but are delivered to an attacker-controlled domain, bypassing recipient allow lists and disclosing message content.
- Record
CVE-2026-121426- CVSS 4.0
- 8.3 High
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-20
- Updated
- 2026-11-08
OSVDEBIAN-CVE-2026-121426
Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that ends an angle-addr at a '>' inside a quoted local part, comment or domain literal. Attackers can submit addresses that validate as an allowed domain but are delivered to an attacker-controlled domain, bypassing recipient allow lists and disclosing message content.
- Record
DEBIAN-CVE-2026-121426- CVSS 4.0
- 8.3 High
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-07
Show 6 moreShow less
OSVUBUNTU-CVE-2026-121426
Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that ends an angle-addr at a '>' inside a quoted local part, comment or domain literal. Attackers can submit addresses that validate as an allowed domain but are delivered to an attacker-controlled domain, bypassing recipient allow lists and disclosing message content.
- Record
UBUNTU-CVE-2026-121426- CVSS 4.0
- 8.3 High
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N - Updated
- 2026-11-05
OSVCLSA-2026-1793102196No score
TuxCare security update for nodemailer (6 CVEs)
TuxCare rebuilt nodemailer to address 6 CVEs. Fixed in 9.1.0-tuxcare.7.
- Record
CLSA-2026-1793102196- Updated
- 2026-11-07
OSVCLSA-2026-1793102593No score
TuxCare security update for nodemailer (7 CVEs)
TuxCare rebuilt nodemailer to address 7 CVEs. Fixed in 9.0.1-tuxcare.5.
- Record
CLSA-2026-1793102593- Updated
- 2026-11-07
OSVCLSA-2026-1793102824No score
TuxCare security update for nodemailer (6 CVEs)
TuxCare rebuilt nodemailer to address 6 CVEs. Fixed in 6.10.1-tuxcare.15.
- Record
CLSA-2026-1793102824- Updated
- 2026-11-07
OSVCLSA-2026-1793109772No score
TuxCare security update for nodemailer (4 CVEs)
TuxCare rebuilt nodemailer to address 4 CVEs. Fixed in 9.0.6-tuxcare.6.
- Record
CLSA-2026-1793109772- Updated
- 2026-11-07
OSVCLSA-2026-1794409427No score
TuxCare security update for nodemailer (7 CVEs)
TuxCare rebuilt nodemailer to address 7 CVEs. Fixed in 7.0.13-tuxcare.1.
- Record
CLSA-2026-1794409427- Updated
- 2026-11-11
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
nodemailerTuxCare:npm From an advisory covering 3 CVEs | 9.1.0-tuxcare.0 up to 9.1.0-tuxcare.7, plus listed versions 9.1.09.1.0-tuxcare.19.1.0-tuxcare.29.1.0-tuxcare.39.1.0-tuxcare.49.1.0-tuxcare.59.1.0-tuxcare.6 | 9.1.0-tuxcare.7 |
nodemailerTuxCare:npm From an advisory covering 4 CVEs | 9.0.1-tuxcare.0 up to 9.0.1-tuxcare.5, plus listed versions 9.0.19.0.1-tuxcare.19.0.1-tuxcare.29.0.1-tuxcare.39.0.1-tuxcare.4 | 9.0.1-tuxcare.5 |
nodemailerTuxCare:npm From an advisory covering 3 CVEs | 6.10.1-tuxcare.0 up to 6.10.1-tuxcare.15, plus listed versions 6.10.16.10.1-tuxcare.16.10.1-tuxcare.106.10.1-tuxcare.116.10.1-tuxcare.12 Show 10 moreShow less6.10.1-tuxcare.136.10.1-tuxcare.146.10.1-tuxcare.26.10.1-tuxcare.36.10.1-tuxcare.46.10.1-tuxcare.56.10.1-tuxcare.66.10.1-tuxcare.76.10.1-tuxcare.86.10.1-tuxcare.9 | 6.10.1-tuxcare.15 |
nodemailerTuxCare:npm From an advisory covering 2 CVEs | 9.0.6-tuxcare.0 up to 9.0.6-tuxcare.6, plus listed versions 9.0.69.0.6-tuxcare.19.0.6-tuxcare.29.0.6-tuxcare.39.0.6-tuxcare.49.0.6-tuxcare.5 | 9.0.6-tuxcare.6 |
nodemailerTuxCare:npm From an advisory covering 7 CVEs | 7.0.13-tuxcare.0 up to 7.0.13-tuxcare.1, plus listed versions 7.0.13 | 7.0.13-tuxcare.1 |
node-nodemailerDebian:12 | All versions, plus listed versions 10.0.0+~8.0.1-110.0.10+~8.0.1-110.0.10+~8.0.2-110.0.13+~8.0.2-110.0.14+~8.0.2-1 Show 25 moreShow less10.1.7+~8.0.2-16.10.0+~6.4.17-16.8.0+~6.4.6-16.9.13+~6.4.14-16.9.15+~6.4.16-16.9.16+~6.4.16-16.9.4+~6.4.9-16.9.4+~6.4.9-26.9.4+~6.4.9-36.9.4+~6.4.9-47.0.10+~7.0.2-17.0.12+~7.0.5-17.0.5+~7.0.1-17.0.6+~7.0.1-17.0.9+~7.0.2-17.0.9+~7.0.2-28.0.11+~8.0.1-18.0.2+~7.0.11-18.0.3+~7.0.11-18.0.4+~7.0.11-18.0.4+~7.0.11-29.0.0+~8.0.1-19.0.3+~8.0.1-19.0.5+~8.0.1-19.0.6+~8.0.1-1 | None known |
node-nodemailerDebian:13 | All versions, plus listed versions 10.0.0+~8.0.1-110.0.10+~8.0.1-110.0.10+~8.0.2-110.0.13+~8.0.2-110.0.14+~8.0.2-1 Show 18 moreShow less10.1.7+~8.0.2-16.10.0+~6.4.17-16.10.0+~6.4.17-1+deb13u17.0.10+~7.0.2-17.0.12+~7.0.5-17.0.5+~7.0.1-17.0.6+~7.0.1-17.0.9+~7.0.2-17.0.9+~7.0.2-28.0.11+~8.0.1-18.0.2+~7.0.11-18.0.3+~7.0.11-18.0.4+~7.0.11-18.0.4+~7.0.11-29.0.0+~8.0.1-19.0.3+~8.0.1-19.0.5+~8.0.1-19.0.6+~8.0.1-1 | None known |
node-nodemailerDebian:14 | All versions, plus listed versions 10.0.0+~8.0.1-110.0.10+~8.0.1-110.0.10+~8.0.2-110.0.13+~8.0.2-110.0.14+~8.0.2-1 Show 17 moreShow less10.1.7+~8.0.2-16.10.0+~6.4.17-17.0.10+~7.0.2-17.0.12+~7.0.5-17.0.5+~7.0.1-17.0.6+~7.0.1-17.0.9+~7.0.2-17.0.9+~7.0.2-28.0.11+~8.0.1-18.0.2+~7.0.11-18.0.3+~7.0.11-18.0.4+~7.0.11-18.0.4+~7.0.11-29.0.0+~8.0.1-19.0.3+~8.0.1-19.0.5+~8.0.1-19.0.6+~8.0.1-1 | None known |
node-nodemailerUbuntu:20.04:LTS | All versions, plus listed versions 6.3.0-26.3.1-16.4.0-16.4.1-16.4.2-16.4.5-1 | None known |
node-nodemailerUbuntu:22.04:LTS | All versions, plus listed versions 6.4.17-36.7.0-16.7.0-26.7.1+~6.4.4-1 | None known |
node-nodemailerUbuntu:24.04:LTS | All versions, plus listed versions 6.9.4+~6.4.9-26.9.4+~6.4.9-3ubuntu16.9.4+~6.4.9-4 | None known |
node-nodemailerUbuntu:26.10 | All versions, plus listed versions 8.0.4+~7.0.11-18.0.4+~7.0.11-29.0.0+~8.0.1-19.0.3+~8.0.1-19.0.5+~8.0.1-1 | None known |
node-nodemailerUbuntu:26.04:LTS | All versions, plus listed versions 7.0.5+~7.0.1-17.0.9+~7.0.2-27.0.10+~7.0.2-17.0.12+~7.0.5-18.0.4+~7.0.11-1 | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases | OSV | |
| affected, aliases, published | EUVD, NVD, OSV | |
| references | CVE List | |
| affected, aliases, references | OSV | |
| affected, aliases, references | OSV | |
| references | OSV | |
| published | EUVD, NVD | |
| facts, published | EUVD | |
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-121426 is a high vulnerability (CVSS 8.3) in Nodemailer, published October 27, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 12th percentile. No source names a fixed version.
References
github.com/nodemailer/nodemailer/security/advisories/GHSA-85x2-q946-cp5h
vulncheck.com/advisories/nodemailer-3.0.0-before-10.1.4-recipient-domain-confusion-via-addressparser
nvd.nist.gov/vuln/detail/CVE-2026-121426
security-tracker.debian.org/tracker/CVE-2026-121426
ubuntu.com/security/CVE-2026-121426
cve.org/CVERecord?id=CVE-2026-121426