CVE-2026-121425
Nodemailer 3.0.0 before 10.1.4 Recipient Injection via addressparser Group Parsing
Nodemailer from 3.0.0 before 10.1.4 contains a parsing flaw in addressparser that ends an RFC 5322 group at a semicolon inside quoted display names or comments. Attackers can submit crafted group addresses that conformant validators approve, redirecting mail to attacker-chosen recipients and bypassing recipient allow lists.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Nodemailer 3.0.0 before 10.1.4 Recipient Injection via addressparser Group Parsing
Nodemailer from 3.0.0 before 10.1.4 contains a parsing flaw in addressparser that ends an RFC 5322 group at a semicolon inside quoted display names or comments. Attackers can submit crafted group addresses that conformant validators approve, redirecting mail to attacker-chosen recipients and bypassing recipient allow lists.
- Record
CVE-2026-121425- CVSS 4.0
- 8.3 High
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-20
- Updated
- 2026-11-03
EUVDEUVD-2026-115957
Nodemailer from 3.0.0 before 10.1.4 contains a parsing flaw in addressparser that ends an RFC 5322 group at a semicolon inside quoted display names or comments. Attackers can submit crafted group addresses that conformant validators approve, redirecting mail to attacker-chosen recipients and bypassing recipient allow lists.
- Record
EUVD-2026-115957- CVSS 4.0
- 8.3 High
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-q9mw-f56c-cmvf
Nodemailer from 3.0.0 before 10.1.4 contains a parsing flaw in addressparser that ends an RFC...
Nodemailer from 3.0.0 before 10.1.4 contains a parsing flaw in addressparser that ends an RFC 5322 group at a semicolon inside quoted display names or comments. Attackers can submit crafted group addresses that conformant validators approve, redirecting mail to attacker-chosen recipients and bypassing recipient allow lists.
- Record
GHSA-q9mw-f56c-cmvf- CVSS 4.0
- 8.3 High
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-20
- Updated
- 2026-11-03
NVD
Nodemailer from 3.0.0 before 10.1.4 contains a parsing flaw in addressparser that ends an RFC 5322 group at a semicolon inside quoted display names or comments. Attackers can submit crafted group addresses that conformant validators approve, redirecting mail to attacker-chosen recipients and bypassing recipient allow lists.
- Record
CVE-2026-121425- CVSS 4.0
- 8.3 High
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-20
- Updated
- 2026-11-03
OSV
Nodemailer 3.0.0 before 10.1.4 Recipient Injection via addressparser Group Parsing
Nodemailer from 3.0.0 before 10.1.4 contains a parsing flaw in addressparser that ends an RFC 5322 group at a semicolon inside quoted display names or comments. Attackers can submit crafted group addresses that conformant validators approve, redirecting mail to attacker-chosen recipients and bypassing recipient allow lists.
- Record
CVE-2026-121425- CVSS 4.0
- 8.3 High
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-20
- Updated
- 2026-11-05
OSVDEBIAN-CVE-2026-121425
Nodemailer from 3.0.0 before 10.1.4 contains a parsing flaw in addressparser that ends an RFC 5322 group at a semicolon inside quoted display names or comments. Attackers can submit crafted group addresses that conformant validators approve, redirecting mail to attacker-chosen recipients and bypassing recipient allow lists.
- Record
DEBIAN-CVE-2026-121425- CVSS 4.0
- 8.3 High
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-04
Show 6 moreShow less
OSVUBUNTU-CVE-2026-121425
Nodemailer from 3.0.0 before 10.1.4 contains a parsing flaw in addressparser that ends an RFC 5322 group at a semicolon inside quoted display names or comments. Attackers can submit crafted group addresses that conformant validators approve, redirecting mail to attacker-chosen recipients and bypassing recipient allow lists.
- Record
UBUNTU-CVE-2026-121425- CVSS 4.0
- 8.3 High
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N - Updated
- 2026-11-05
OSVCLSA-2026-1793102196No score
TuxCare security update for nodemailer (6 CVEs)
TuxCare rebuilt nodemailer to address 6 CVEs. Fixed in 9.1.0-tuxcare.7.
- Record
CLSA-2026-1793102196- Updated
- 2026-11-07
OSVCLSA-2026-1793102593No score
TuxCare security update for nodemailer (7 CVEs)
TuxCare rebuilt nodemailer to address 7 CVEs. Fixed in 9.0.1-tuxcare.5.
- Record
CLSA-2026-1793102593- Updated
- 2026-11-07
OSVCLSA-2026-1793102824No score
TuxCare security update for nodemailer (6 CVEs)
TuxCare rebuilt nodemailer to address 6 CVEs. Fixed in 6.10.1-tuxcare.15.
- Record
CLSA-2026-1793102824- Updated
- 2026-11-07
OSVCLSA-2026-1793109772No score
TuxCare security update for nodemailer (4 CVEs)
TuxCare rebuilt nodemailer to address 4 CVEs. Fixed in 9.0.6-tuxcare.6.
- Record
CLSA-2026-1793109772- Updated
- 2026-11-07
OSVCLSA-2026-1794409427No score
TuxCare security update for nodemailer (7 CVEs)
TuxCare rebuilt nodemailer to address 7 CVEs. Fixed in 7.0.13-tuxcare.1.
- Record
CLSA-2026-1794409427- Updated
- 2026-11-11
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
nodemailerTuxCare:npm From an advisory covering 3 CVEs | 9.1.0-tuxcare.0 up to 9.1.0-tuxcare.7, plus listed versions 9.1.09.1.0-tuxcare.19.1.0-tuxcare.29.1.0-tuxcare.39.1.0-tuxcare.49.1.0-tuxcare.59.1.0-tuxcare.6 | 9.1.0-tuxcare.7 |
nodemailerTuxCare:npm From an advisory covering 4 CVEs | 9.0.1-tuxcare.0 up to 9.0.1-tuxcare.5, plus listed versions 9.0.19.0.1-tuxcare.19.0.1-tuxcare.29.0.1-tuxcare.39.0.1-tuxcare.4 | 9.0.1-tuxcare.5 |
nodemailerTuxCare:npm From an advisory covering 3 CVEs | 6.10.1-tuxcare.0 up to 6.10.1-tuxcare.15, plus listed versions 6.10.16.10.1-tuxcare.16.10.1-tuxcare.106.10.1-tuxcare.116.10.1-tuxcare.12 Show 10 moreShow less6.10.1-tuxcare.136.10.1-tuxcare.146.10.1-tuxcare.26.10.1-tuxcare.36.10.1-tuxcare.46.10.1-tuxcare.56.10.1-tuxcare.66.10.1-tuxcare.76.10.1-tuxcare.86.10.1-tuxcare.9 | 6.10.1-tuxcare.15 |
nodemailerTuxCare:npm From an advisory covering 2 CVEs | 9.0.6-tuxcare.0 up to 9.0.6-tuxcare.6, plus listed versions 9.0.69.0.6-tuxcare.19.0.6-tuxcare.29.0.6-tuxcare.39.0.6-tuxcare.49.0.6-tuxcare.5 | 9.0.6-tuxcare.6 |
nodemailerTuxCare:npm From an advisory covering 7 CVEs | 7.0.13-tuxcare.0 up to 7.0.13-tuxcare.1, plus listed versions 7.0.13 | 7.0.13-tuxcare.1 |
node-nodemailerDebian:12 | All versions, plus listed versions 10.0.0+~8.0.1-110.0.10+~8.0.1-110.0.10+~8.0.2-110.0.13+~8.0.2-110.0.14+~8.0.2-1 Show 25 moreShow less10.1.7+~8.0.2-16.10.0+~6.4.17-16.8.0+~6.4.6-16.9.13+~6.4.14-16.9.15+~6.4.16-16.9.16+~6.4.16-16.9.4+~6.4.9-16.9.4+~6.4.9-26.9.4+~6.4.9-36.9.4+~6.4.9-47.0.10+~7.0.2-17.0.12+~7.0.5-17.0.5+~7.0.1-17.0.6+~7.0.1-17.0.9+~7.0.2-17.0.9+~7.0.2-28.0.11+~8.0.1-18.0.2+~7.0.11-18.0.3+~7.0.11-18.0.4+~7.0.11-18.0.4+~7.0.11-29.0.0+~8.0.1-19.0.3+~8.0.1-19.0.5+~8.0.1-19.0.6+~8.0.1-1 | None known |
node-nodemailerDebian:13 | All versions, plus listed versions 10.0.0+~8.0.1-110.0.10+~8.0.1-110.0.10+~8.0.2-110.0.13+~8.0.2-110.0.14+~8.0.2-1 Show 18 moreShow less10.1.7+~8.0.2-16.10.0+~6.4.17-16.10.0+~6.4.17-1+deb13u17.0.10+~7.0.2-17.0.12+~7.0.5-17.0.5+~7.0.1-17.0.6+~7.0.1-17.0.9+~7.0.2-17.0.9+~7.0.2-28.0.11+~8.0.1-18.0.2+~7.0.11-18.0.3+~7.0.11-18.0.4+~7.0.11-18.0.4+~7.0.11-29.0.0+~8.0.1-19.0.3+~8.0.1-19.0.5+~8.0.1-19.0.6+~8.0.1-1 | None known |
node-nodemailerDebian:14 | All versions, plus listed versions 10.0.0+~8.0.1-110.0.10+~8.0.1-110.0.10+~8.0.2-110.0.13+~8.0.2-110.0.14+~8.0.2-1 Show 17 moreShow less10.1.7+~8.0.2-16.10.0+~6.4.17-17.0.10+~7.0.2-17.0.12+~7.0.5-17.0.5+~7.0.1-17.0.6+~7.0.1-17.0.9+~7.0.2-17.0.9+~7.0.2-28.0.11+~8.0.1-18.0.2+~7.0.11-18.0.3+~7.0.11-18.0.4+~7.0.11-18.0.4+~7.0.11-29.0.0+~8.0.1-19.0.3+~8.0.1-19.0.5+~8.0.1-19.0.6+~8.0.1-1 | None known |
node-nodemailerUbuntu:20.04:LTS | All versions, plus listed versions 6.3.0-26.3.1-16.4.0-16.4.1-16.4.2-16.4.5-1 | None known |
node-nodemailerUbuntu:22.04:LTS | All versions, plus listed versions 6.4.17-36.7.0-16.7.0-26.7.1+~6.4.4-1 | None known |
node-nodemailerUbuntu:24.04:LTS | All versions, plus listed versions 6.9.4+~6.4.9-26.9.4+~6.4.9-3ubuntu16.9.4+~6.4.9-4 | None known |
node-nodemailerUbuntu:26.10 | All versions, plus listed versions 8.0.4+~7.0.11-18.0.4+~7.0.11-29.0.0+~8.0.1-19.0.3+~8.0.1-19.0.5+~8.0.1-1 | None known |
node-nodemailerUbuntu:26.04:LTS | All versions, plus listed versions 7.0.5+~7.0.1-17.0.9+~7.0.2-27.0.10+~7.0.2-17.0.12+~7.0.5-18.0.4+~7.0.11-1 | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases | OSV | |
| affected, aliases, published | OSV | |
| affected, aliases, references | OSV | |
| affected, aliases, references | OSV | |
| references | NVD, OSV | |
| published | EUVD, NVD | |
| references | CVE List | |
| facts, published | EUVD | |
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-121425 is a high vulnerability (CVSS 8.3) in Nodemailer, published October 27, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.32%, the 25th percentile. No source names a fixed version.
References
github.com/nodemailer/nodemailer/security/advisories/GHSA-m943-m63m-w62w
vulncheck.com/advisories/nodemailer-3.0.0-before-10.1.4-recipient-injection-via-addressparser-group-parsing
nvd.nist.gov/vuln/detail/CVE-2026-121425
security-tracker.debian.org/tracker/CVE-2026-121425
ubuntu.com/security/CVE-2026-121425
cve.org/CVERecord?id=CVE-2026-121425