{"id":"CVE-2026-121424","aliases":["CLSA-2026-1793102000","CLSA-2026-1793102100","CLSA-2026-1793102196","CLSA-2026-1793102303","CLSA-2026-1793102402","CLSA-2026-1793102503","CLSA-2026-1793102593","CLSA-2026-1793102824","CLSA-2026-1793109577","CLSA-2026-1793109690","CLSA-2026-1793109772","CLSA-2026-1793790053","CLSA-2026-1794409427","DEBIAN-CVE-2026-121424","EUVD-2026-115956","GHSA-85x2-q946-cp5h","GHSA-8c8m-p3m8-cjg8","GHSA-f6c5-wvmr-hc29","GHSA-m943-m63m-w62w","UBUNTU-CVE-2026-121424"],"status":"published","title":"Nodemailer 3.0.0 before 10.1.4 Address Parsing Bypass via Nested Comments","description":"Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that allows remote attackers to redirect recipients by ending nested RFC 5322 comments at the first closing parenthesis. Attackers can submit addresses whose nested comment hides an attacker address, bypassing conformant validators and recipient allow lists to receive mail or spoof senders in mailparser.","severity":{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00337,"percentile":0.27525,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-436"],"published":"2026-10-23T21:51:18Z","modified":"2026-11-11T19:30:04Z","fixes":[{"ecosystem":"npm","package":"nodemailer","fixed_in":["10.1.4"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"nodemailer","fixed_in":["9.0.2-tuxcare.6","9.0.6-tuxcare.5","9.0.5-tuxcare.6","9.0.0-tuxcare.6","9.0.3-tuxcare.6","9.0.5-tuxcare.7","9.0.2-tuxcare.7","2.7.2-tuxcare.10"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"10.1.4"}]}]},{"source":"ghsa","ecosystem":"npm","package":"nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"10.1.4"}]}]},{"source":"ghsa","ecosystem":"npm","package":"nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"10.1.4"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.2-tuxcare.0"},{"fixed":"9.0.2-tuxcare.6"}]}],"versions":["9.0.2","9.0.2-tuxcare.1","9.0.2-tuxcare.2","9.0.2-tuxcare.3","9.0.2-tuxcare.4","9.0.2-tuxcare.5"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.6-tuxcare.0"},{"fixed":"9.0.6-tuxcare.5"}]}],"versions":["9.0.6","9.0.6-tuxcare.1","9.0.6-tuxcare.2","9.0.6-tuxcare.3","9.0.6-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.1.0-tuxcare.0"},{"fixed":"9.1.0-tuxcare.7"}]}],"versions":["9.1.0","9.1.0-tuxcare.1","9.1.0-tuxcare.2","9.1.0-tuxcare.3","9.1.0-tuxcare.4","9.1.0-tuxcare.5","9.1.0-tuxcare.6"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.5-tuxcare.0"},{"fixed":"9.0.5-tuxcare.6"}]}],"versions":["9.0.5","9.0.5-tuxcare.1","9.0.5-tuxcare.2","9.0.5-tuxcare.3","9.0.5-tuxcare.4","9.0.5-tuxcare.5"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-tuxcare.0"},{"fixed":"9.0.0-tuxcare.6"}]}],"versions":["9.0.0","9.0.0-tuxcare.1","9.0.0-tuxcare.2","9.0.0-tuxcare.3","9.0.0-tuxcare.4","9.0.0-tuxcare.5"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.3-tuxcare.0"},{"fixed":"9.0.3-tuxcare.6"}]}],"versions":["9.0.3","9.0.3-tuxcare.1","9.0.3-tuxcare.2","9.0.3-tuxcare.3","9.0.3-tuxcare.4","9.0.3-tuxcare.5"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.1-tuxcare.0"},{"fixed":"9.0.1-tuxcare.5"}]}],"versions":["9.0.1","9.0.1-tuxcare.1","9.0.1-tuxcare.2","9.0.1-tuxcare.3","9.0.1-tuxcare.4"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.10.1-tuxcare.0"},{"fixed":"6.10.1-tuxcare.15"}]}],"versions":["6.10.1","6.10.1-tuxcare.1","6.10.1-tuxcare.10","6.10.1-tuxcare.11","6.10.1-tuxcare.12","6.10.1-tuxcare.13","6.10.1-tuxcare.14","6.10.1-tuxcare.2","6.10.1-tuxcare.3","6.10.1-tuxcare.4","6.10.1-tuxcare.5","6.10.1-tuxcare.6","6.10.1-tuxcare.7","6.10.1-tuxcare.8","6.10.1-tuxcare.9"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.5-tuxcare.0"},{"fixed":"9.0.5-tuxcare.7"}]}],"versions":["9.0.5","9.0.5-tuxcare.1","9.0.5-tuxcare.2","9.0.5-tuxcare.3","9.0.5-tuxcare.4","9.0.5-tuxcare.5","9.0.5-tuxcare.6"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.2-tuxcare.0"},{"fixed":"9.0.2-tuxcare.7"}]}],"versions":["9.0.2","9.0.2-tuxcare.1","9.0.2-tuxcare.2","9.0.2-tuxcare.3","9.0.2-tuxcare.4","9.0.2-tuxcare.5","9.0.2-tuxcare.6"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.6-tuxcare.0"},{"fixed":"9.0.6-tuxcare.6"}]}],"versions":["9.0.6","9.0.6-tuxcare.1","9.0.6-tuxcare.2","9.0.6-tuxcare.3","9.0.6-tuxcare.4","9.0.6-tuxcare.5"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.2-tuxcare.0"},{"fixed":"2.7.2-tuxcare.10"}]}],"versions":["2.7.2","2.7.2-tuxcare.1","2.7.2-tuxcare.2","2.7.2-tuxcare.3","2.7.2-tuxcare.4","2.7.2-tuxcare.5","2.7.2-tuxcare.6","2.7.2-tuxcare.7","2.7.2-tuxcare.8","2.7.2-tuxcare.9"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.13-tuxcare.0"},{"fixed":"7.0.13-tuxcare.1"}]}],"versions":["7.0.13"],"bundled":7},{"source":"osv","ecosystem":"Debian:12","package":"node-nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.0.0+~8.0.1-1","10.0.10+~8.0.1-1","10.0.10+~8.0.2-1","10.0.13+~8.0.2-1","10.0.14+~8.0.2-1","10.1.7+~8.0.2-1","6.10.0+~6.4.17-1","6.8.0+~6.4.6-1","6.9.13+~6.4.14-1","6.9.15+~6.4.16-1","6.9.16+~6.4.16-1","6.9.4+~6.4.9-1","6.9.4+~6.4.9-2","6.9.4+~6.4.9-3","6.9.4+~6.4.9-4","7.0.10+~7.0.2-1","7.0.12+~7.0.5-1","7.0.5+~7.0.1-1","7.0.6+~7.0.1-1","7.0.9+~7.0.2-1","7.0.9+~7.0.2-2","8.0.11+~8.0.1-1","8.0.2+~7.0.11-1","8.0.3+~7.0.11-1","8.0.4+~7.0.11-1","8.0.4+~7.0.11-2","9.0.0+~8.0.1-1","9.0.3+~8.0.1-1","9.0.5+~8.0.1-1","9.0.6+~8.0.1-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.0.0+~8.0.1-1","10.0.10+~8.0.1-1","10.0.10+~8.0.2-1","10.0.13+~8.0.2-1","10.0.14+~8.0.2-1","10.1.7+~8.0.2-1","6.10.0+~6.4.17-1","6.10.0+~6.4.17-1+deb13u1","7.0.10+~7.0.2-1","7.0.12+~7.0.5-1","7.0.5+~7.0.1-1","7.0.6+~7.0.1-1","7.0.9+~7.0.2-1","7.0.9+~7.0.2-2","8.0.11+~8.0.1-1","8.0.2+~7.0.11-1","8.0.3+~7.0.11-1","8.0.4+~7.0.11-1","8.0.4+~7.0.11-2","9.0.0+~8.0.1-1","9.0.3+~8.0.1-1","9.0.5+~8.0.1-1","9.0.6+~8.0.1-1"]},{"source":"osv","ecosystem":"Debian:14","package":"node-nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.0.0+~8.0.1-1","10.0.10+~8.0.1-1","10.0.10+~8.0.2-1","10.0.13+~8.0.2-1","10.0.14+~8.0.2-1","10.1.7+~8.0.2-1","6.10.0+~6.4.17-1","7.0.10+~7.0.2-1","7.0.12+~7.0.5-1","7.0.5+~7.0.1-1","7.0.6+~7.0.1-1","7.0.9+~7.0.2-1","7.0.9+~7.0.2-2","8.0.11+~8.0.1-1","8.0.2+~7.0.11-1","8.0.3+~7.0.11-1","8.0.4+~7.0.11-1","8.0.4+~7.0.11-2","9.0.0+~8.0.1-1","9.0.3+~8.0.1-1","9.0.5+~8.0.1-1","9.0.6+~8.0.1-1"]},{"source":"osv","ecosystem":"npm","package":"nodemailer","ranges":[{"type":"SEMVER","events":[{"introduced":"3.0.0"},{"fixed":"10.1.4"}]}]},{"source":"osv","ecosystem":"npm","package":"nodemailer","ranges":[{"type":"SEMVER","events":[{"introduced":"3.0.0"},{"fixed":"10.1.4"}]}]},{"source":"osv","ecosystem":"npm","package":"nodemailer","ranges":[{"type":"SEMVER","events":[{"introduced":"3.0.0"},{"fixed":"10.1.4"}]}]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.3.0-2","6.3.1-1","6.4.0-1","6.4.1-1","6.4.2-1","6.4.5-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.4.17-3","6.7.0-1","6.7.0-2","6.7.1+~6.4.4-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.9.4+~6.4.9-2","6.9.4+~6.4.9-3ubuntu1","6.9.4+~6.4.9-4"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.0.4+~7.0.11-1","8.0.4+~7.0.11-2","9.0.0+~8.0.1-1","9.0.3+~8.0.1-1","9.0.5+~8.0.1-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.0.5+~7.0.1-1","7.0.9+~7.0.2-2","7.0.10+~7.0.2-1","7.0.12+~7.0.5-1","8.0.4+~7.0.11-1"]}],"products":[{"vendor":"nodemailer","product":"nodemailer"}],"references":[{"url":"https://github.com/nodemailer/nodemailer/security/advisories/GHSA-8c8m-p3m8-cjg8","tags":["vendor-advisory","advisory","web","report"]},{"url":"https://www.vulncheck.com/advisories/nodemailer-3.0.0-before-10.1.4-address-parsing-bypass-via-nested-comments","tags":["third-party-advisory","advisory","report"]},{"url":"https://github.com/nodemailer/nodemailer/security/advisories/GHSA-85x2-q946-cp5h","tags":["web"]},{"url":"https://github.com/nodemailer/nodemailer/commit/1cd57d2b8c49dff048c21cdbafdb54439a7f07e2","tags":["web"]},{"url":"https://github.com/nodemailer/nodemailer/releases/tag/v10.1.4","tags":["web"]},{"url":"https://github.com/advisories/GHSA-85x2-q946-cp5h"},{"url":"https://github.com/nodemailer/nodemailer/commit/0a8761762ac78f2db2ba37f712f2a52a404ce011","tags":["web"]},{"url":"https://github.com/advisories/GHSA-8c8m-p3m8-cjg8"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121424","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-f6c5-wvmr-hc29"},{"url":"https://github.com/nodemailer/nodemailer/security/advisories/GHSA-m943-m63m-w62w","tags":["web"]},{"url":"https://github.com/advisories/GHSA-m943-m63m-w62w"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/121xxx/CVE-2026-121424.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-121424","tags":["advisory"]},{"url":"https://github.com/nodemailer/nodemailer","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-121424","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-121424","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-121424","title":"Nodemailer 3.0.0 before 10.1.4 Address Parsing Bypass via Nested Comments","description":"Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that allows remote attackers to redirect recipients by ending nested RFC 5322 comments at the first closing parenthesis. Attackers can submit addresses whose nested comment hides an attacker address, bypassing conformant validators and recipient allow lists to receive mail or spoof senders in mailparser.","status":"published","published":"2026-11-03T14:28:20.066Z","modified":"2026-11-03T18:30:19.723Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-20"],"updated_at":"2026-11-03T20:02:16.924578Z"}],"euvd":[{"id":"EUVD-2026-115956","description":"Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that allows remote attackers to redirect recipients by ending nested RFC 5322 comments at the first closing parenthesis. Attackers can submit addresses whose nested comment hides an attacker address, bypassing conformant validators and recipient allow lists to receive mail or spoof senders in mailparser.","status":"published","published":"2026-11-03T14:28:20Z","modified":"2026-11-03T18:30:19Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-03T20:20:09.141953Z"}],"ghsa":[{"id":"GHSA-85x2-q946-cp5h","title":"Nodemailer: A \"\u003e\" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name","description":"### Vulnerability summary\n\naddressparser ends an angle-addr at the first `\u003e` it sees, including one inside a quoted local part, a comment or a domain literal. The domain is then read off the text in front of that `\u003e`. `\u003c\"a@evil.com\u003e\"@good.com\u003e` is the mailbox `\"a@evil.com\u003e\"@good.com` under RFC 5322, and Nodemailer read it as an address at `evil.com`. The unbracketed spelling of the same value was already read correctly. Affected: 3.0.0 through 10.1.3.\n\n### Attacker capabilities\n\nThe attacker controls the text of a recipient or sender address that an application passes to Nodemailer, for example a To value entered in a contact or invite form, or the header of an inbound message parsed with mailparser. No access to the application, its configuration or its credentials is needed. The value is a syntactically valid RFC 5322 address that conformant parsers accept without defects.\n\n### Realistic exploitation scenario\n\nAn application lets users send invitations or notifications only to addresses at an allowed domain and validates the submitted value with a conformant parser or by checking its domain. The attacker submits `\u003c\"a@evil.com\u003e\"@good.com\u003e`, which validates as a `good.com` mailbox. Nodemailer then parses the same value, issues `RCPT TO:\u003c\"\\\"a\"@evil.com\u003e` and the message, with whatever content the application puts into it, is delivered to the attacker's domain. The security boundary crossed is the application's recipient allow list. In the inbound direction, mailparser reports a different address than a conformant reader of the same header, so a display or policy layer built on the two disagrees.\n\n### Proof of concept\n\n```js\nconst addressparser = require('nodemailer/lib/addressparser');\nconsole.log(addressparser(\"\u003c\\\"a@evil.com\u003e\\\"@good.com\u003e\"));\n// [ { address: '\"a@evil.com', name: '@good.com\u003e' } ]\n```\n\nPython's `email._header_value_parser.get_address_list` reads the same value as `\"a@evil.com\u003e\"@good.com`, with no defects reported.\n\nThe envelope a message gets is built from the same parse, so `sendMail({ to: \"\u003c\\\"a@evil.com\u003e\\\"@good.com\u003e\" })` issues the RCPT TO shown above.\n\n### Security impact\n\nMail that an application intends for an allowed domain is delivered to a domain chosen by the attacker, which discloses its content. It is a security vulnerability rather than a parsing bug because the misreading only occurs for values that a conformant validator approves, so validation done the right way is bypassed. Affected are applications that pass user influenced addresses to Nodemailer and consumers of the standalone parser such as mailparser.\n\nThe fix tracks quoted strings, comments and domain literals inside an angle-addr and reads only a `\u003e` outside them.\n\nFound in an internal review of addressparser on 2026-10-18. Verified on 3.0.0, 6.9.16 and 10.1.3.","status":"published","published":"2026-10-23T21:51:18Z","modified":"2026-10-23T21:51:19Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"medium"}],"cwes":["CWE-20","CWE-436"],"updated_at":"2026-11-02T14:41:35.723785Z"},{"id":"GHSA-8c8m-p3m8-cjg8","title":"Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient","description":"### Vulnerability summary\n\nRFC 5322 comments nest. addressparser ended a comment at the first `)`, including the one that closes a nested comment, and parsed the rest of the outer comment as header text. `Victim (x(y) \u003cevil@evil.com\u003e) \u003cv@victim.com\u003e` names `v@victim.com` with `x(y) \u003cevil@evil.com\u003e` as a comment, and Nodemailer read it as the address `evil@evil.com`. This is the same shape as the escaped parenthesis fixed in 10.1.2, reached through nesting instead of a quoted-pair. Affected: 3.0.0 through 10.1.3.\n\n### Attacker capabilities\n\nThe attacker controls the text of an address that an application passes to Nodemailer, or the From or To header of an inbound message parsed with mailparser. No access to the application, its configuration or its credentials is needed. The value is a syntactically valid RFC 5322 address that conformant parsers accept without defects.\n\n### Realistic exploitation scenario\n\nAn application validates a submitted address with a conformant parser and allows only its own domain. The attacker submits `Victim (x(y) \u003cevil@evil.com\u003e) \u003cv@victim.com\u003e`, which validates as `v@victim.com`. Nodemailer delivers to `evil@evil.com`. In the inbound direction, a DMARC or display layer built on a conformant parser and a mail client built on mailparser disagree on the author of the same message, which is the setting for sender spoofing. The boundary crossed is the application's recipient allow list, or the author check of the receiving side.\n\n### Proof of concept\n\n```js\nconst addressparser = require('nodemailer/lib/addressparser');\nconsole.log(addressparser(\"Victim (x(y) \u003cevil@evil.com\u003e) \u003cv@victim.com\u003e\"));\n// [ { address: 'evil@evil.com', name: 'Victim) v@victim.com' } ]\n```\n\nPython's `email._header_value_parser.get_address_list` reads the same value as `v@victim.com` with the display name `Victim`, with no defects reported.\n\nThe envelope a message gets is built from the same parse, so `sendMail({ to: \"Victim (x(y) \u003cevil@evil.com\u003e) \u003cv@victim.com\u003e\" })` issues the RCPT TO shown above.\n\n### Security impact\n\nMail intended for an approved recipient is delivered to an attacker chosen domain, disclosing its content, and parsers built on this module report a different author than conformant ones. The misreading only occurs on values a conformant validator approves, so correct validation is bypassed. Affected are applications that pass user influenced addresses to Nodemailer and consumers of the standalone parser such as mailparser.\n\nThe fix counts comment depth and ends a comment only at the `)` that closes the outermost one.\n\nFound in an internal review of addressparser on 2026-10-18. Verified on 3.0.0, 6.9.16 and 10.1.3.","status":"published","published":"2026-10-23T21:53:04Z","modified":"2026-10-23T21:53:05Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"medium"}],"cwes":["CWE-20","CWE-436"],"updated_at":"2026-11-02T14:41:35.723785Z"},{"id":"GHSA-f6c5-wvmr-hc29","title":"Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser...","description":"Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that allows remote attackers to redirect recipients by ending nested RFC 5322 comments at the first closing parenthesis. Attackers can submit addresses whose nested comment hides an attacker address, bypassing conformant validators and recipient allow lists to receive mail or spoof senders in mailparser.","status":"published","published":"2026-11-03T15:32:13Z","modified":"2026-11-03T15:32:18Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-03T15:57:23.404697Z"},{"id":"GHSA-m943-m63m-w62w","title":"Nodemailer: A \";\" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient","description":"### Vulnerability summary\n\naddressparser ends an RFC 5322 group at the first `;`, including one inside a quoted display name or a comment. The text after it is parsed again as top level recipients with the quoting flipped, so text that every conformant parser reads as a display name or comment becomes a live address. `G: (a; \u003cevil@evil.com\u003e) \u003cv@victim.com\u003e;` names only `v@victim.com`, and Nodemailer read it as the single recipient `evil@evil.com`. Affected: 3.0.0 through 10.1.3.\n\n### Attacker capabilities\n\nThe attacker controls the text of an address field that an application passes to Nodemailer, or the header of an inbound message parsed with mailparser. No access to the application, its configuration or its credentials is needed. The value is a syntactically valid RFC 5322 group that conformant parsers accept without defects.\n\n### Realistic exploitation scenario\n\nAn application validates the recipients of a submitted address list with a conformant parser and only allows addresses at its own domain. The attacker submits `G: (a; \u003cevil@evil.com\u003e) \u003cv@victim.com\u003e;`. The validator sees one mailbox, `v@victim.com`, and approves it. Nodemailer delivers to `evil@evil.com` only. The same works through a quoted display name, `G: \"a;\" \"\u003cevil@evil.com\u003e\" \u003cv@victim.com\u003e;`. The boundary crossed is the application's recipient allow list.\n\n### Proof of concept\n\n```js\nconst addressparser = require('nodemailer/lib/addressparser');\nconsole.log(addressparser(\"G: (a; \u003cevil@evil.com\u003e) \u003cv@victim.com\u003e;\"));\n// [ { name: 'G', group: [ [Object] ] }, { address: 'evil@evil.com', name: ') v@victim.com' } ]\n```\n\nPython's `email._header_value_parser.get_address_list` reads the same value as the single mailbox `v@victim.com`, with no defects reported.\n\nThe envelope a message gets is built from the same parse, so `sendMail({ to: \"G: (a; \u003cevil@evil.com\u003e) \u003cv@victim.com\u003e;\" })` issues the RCPT TO shown above.\n\n### Security impact\n\nMail that an application intends for an approved recipient goes to a recipient chosen by the attacker, which discloses its content, and the intended recipient never receives it. The misreading only occurs on values a conformant validator approves, so correct validation is bypassed, which makes it a security issue rather than a parsing bug. Affected are applications that pass user influenced address lists to Nodemailer and consumers of the standalone parser such as mailparser.\n\nThe fix tracks quoted strings and comments inside a group and reads only a `;` outside them.\n\n\nFound in an internal review of addressparser on 2026-10-18. Verified on 3.0.0, 6.9.16 and 10.1.3.","status":"published","published":"2026-10-23T21:51:52Z","modified":"2026-10-23T21:51:54Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"medium"}],"cwes":["CWE-20","CWE-436"],"updated_at":"2026-11-02T14:41:35.723785Z"}],"nvd":[{"id":"CVE-2026-121424","description":"Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that allows remote attackers to redirect recipients by ending nested RFC 5322 comments at the first closing parenthesis. Attackers can submit addresses whose nested comment hides an attacker address, bypassing conformant validators and recipient allow lists to receive mail or spoof senders in mailparser.","status":"published","published":"2026-11-03T15:17:32.883Z","modified":"2026-11-03T19:18:02.8Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-20"],"updated_at":"2026-11-03T22:58:51.822037Z"}],"osv":[{"id":"CVE-2026-121424","title":"Nodemailer 3.0.0 before 10.1.4 Address Parsing Bypass via Nested Comments","description":"Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that allows remote attackers to redirect recipients by ending nested RFC 5322 comments at the first closing parenthesis. Attackers can submit addresses whose nested comment hides an attacker address, bypassing conformant validators and recipient allow lists to receive mail or spoof senders in mailparser.","status":"published","published":"2026-11-03T14:28:20.066Z","modified":"2026-11-05T03:31:09.953020598Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-05T07:12:46.161235Z"},{"id":"DEBIAN-CVE-2026-121424","description":"Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that allows remote attackers to redirect recipients by ending nested RFC 5322 comments at the first closing parenthesis. Attackers can submit addresses whose nested comment hides an attacker address, bypassing conformant validators and recipient allow lists to receive mail or spoof senders in mailparser.","status":"published","published":"2026-11-03T15:17:32.883Z","modified":"2026-11-04T10:00:45.328094491Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-04T10:05:32.187009Z"},{"id":"GHSA-85x2-q946-cp5h","title":"Nodemailer: A \"\u003e\" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name","description":"### Vulnerability summary\n\naddressparser ends an angle-addr at the first `\u003e` it sees, including one inside a quoted local part, a comment or a domain literal. The domain is then read off the text in front of that `\u003e`. `\u003c\"a@evil.com\u003e\"@good.com\u003e` is the mailbox `\"a@evil.com\u003e\"@good.com` under RFC 5322, and Nodemailer read it as an address at `evil.com`. The unbracketed spelling of the same value was already read correctly. Affected: 3.0.0 through 10.1.3.\n\n### Attacker capabilities\n\nThe attacker controls the text of a recipient or sender address that an application passes to Nodemailer, for example a To value entered in a contact or invite form, or the header of an inbound message parsed with mailparser. No access to the application, its configuration or its credentials is needed. The value is a syntactically valid RFC 5322 address that conformant parsers accept without defects.\n\n### Realistic exploitation scenario\n\nAn application lets users send invitations or notifications only to addresses at an allowed domain and validates the submitted value with a conformant parser or by checking its domain. The attacker submits `\u003c\"a@evil.com\u003e\"@good.com\u003e`, which validates as a `good.com` mailbox. Nodemailer then parses the same value, issues `RCPT TO:\u003c\"\\\"a\"@evil.com\u003e` and the message, with whatever content the application puts into it, is delivered to the attacker's domain. The security boundary crossed is the application's recipient allow list. In the inbound direction, mailparser reports a different address than a conformant reader of the same header, so a display or policy layer built on the two disagrees.\n\n### Proof of concept\n\n```js\nconst addressparser = require('nodemailer/lib/addressparser');\nconsole.log(addressparser(\"\u003c\\\"a@evil.com\u003e\\\"@good.com\u003e\"));\n// [ { address: '\"a@evil.com', name: '@good.com\u003e' } ]\n```\n\nPython's `email._header_value_parser.get_address_list` reads the same value as `\"a@evil.com\u003e\"@good.com`, with no defects reported.\n\nThe envelope a message gets is built from the same parse, so `sendMail({ to: \"\u003c\\\"a@evil.com\u003e\\\"@good.com\u003e\" })` issues the RCPT TO shown above.\n\n### Security impact\n\nMail that an application intends for an allowed domain is delivered to a domain chosen by the attacker, which discloses its content. It is a security vulnerability rather than a parsing bug because the misreading only occurs for values that a conformant validator approves, so validation done the right way is bypassed. Affected are applications that pass user influenced addresses to Nodemailer and consumers of the standalone parser such as mailparser.\n\nThe fix tracks quoted strings, comments and domain literals inside an angle-addr and reads only a `\u003e` outside them.\n\nFound in an internal review of addressparser on 2026-10-18. Verified on 3.0.0, 6.9.16 and 10.1.3.","status":"published","published":"2026-10-23T21:51:18Z","modified":"2026-11-04T02:56:06.991287324Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"medium"}],"cwes":["CWE-20","CWE-436"],"updated_at":"2026-11-04T03:25:28.514393Z"},{"id":"GHSA-8c8m-p3m8-cjg8","title":"Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient","description":"### Vulnerability summary\n\nRFC 5322 comments nest. addressparser ended a comment at the first `)`, including the one that closes a nested comment, and parsed the rest of the outer comment as header text. `Victim (x(y) \u003cevil@evil.com\u003e) \u003cv@victim.com\u003e` names `v@victim.com` with `x(y) \u003cevil@evil.com\u003e` as a comment, and Nodemailer read it as the address `evil@evil.com`. This is the same shape as the escaped parenthesis fixed in 10.1.2, reached through nesting instead of a quoted-pair. Affected: 3.0.0 through 10.1.3.\n\n### Attacker capabilities\n\nThe attacker controls the text of an address that an application passes to Nodemailer, or the From or To header of an inbound message parsed with mailparser. No access to the application, its configuration or its credentials is needed. The value is a syntactically valid RFC 5322 address that conformant parsers accept without defects.\n\n### Realistic exploitation scenario\n\nAn application validates a submitted address with a conformant parser and allows only its own domain. The attacker submits `Victim (x(y) \u003cevil@evil.com\u003e) \u003cv@victim.com\u003e`, which validates as `v@victim.com`. Nodemailer delivers to `evil@evil.com`. In the inbound direction, a DMARC or display layer built on a conformant parser and a mail client built on mailparser disagree on the author of the same message, which is the setting for sender spoofing. The boundary crossed is the application's recipient allow list, or the author check of the receiving side.\n\n### Proof of concept\n\n```js\nconst addressparser = require('nodemailer/lib/addressparser');\nconsole.log(addressparser(\"Victim (x(y) \u003cevil@evil.com\u003e) \u003cv@victim.com\u003e\"));\n// [ { address: 'evil@evil.com', name: 'Victim) v@victim.com' } ]\n```\n\nPython's `email._header_value_parser.get_address_list` reads the same value as `v@victim.com` with the display name `Victim`, with no defects reported.\n\nThe envelope a message gets is built from the same parse, so `sendMail({ to: \"Victim (x(y) \u003cevil@evil.com\u003e) \u003cv@victim.com\u003e\" })` issues the RCPT TO shown above.\n\n### Security impact\n\nMail intended for an approved recipient is delivered to an attacker chosen domain, disclosing its content, and parsers built on this module report a different author than conformant ones. The misreading only occurs on values a conformant validator approves, so correct validation is bypassed. Affected are applications that pass user influenced addresses to Nodemailer and consumers of the standalone parser such as mailparser.\n\nThe fix counts comment depth and ends a comment only at the `)` that closes the outermost one.\n\nFound in an internal review of addressparser on 2026-10-18. Verified on 3.0.0, 6.9.16 and 10.1.3.","status":"published","published":"2026-10-23T21:53:04Z","modified":"2026-11-04T02:56:06.627218994Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"medium"}],"cwes":["CWE-20","CWE-436"],"updated_at":"2026-11-04T03:25:28.514393Z"},{"id":"GHSA-m943-m63m-w62w","title":"Nodemailer: A \";\" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient","description":"### Vulnerability summary\n\naddressparser ends an RFC 5322 group at the first `;`, including one inside a quoted display name or a comment. The text after it is parsed again as top level recipients with the quoting flipped, so text that every conformant parser reads as a display name or comment becomes a live address. `G: (a; \u003cevil@evil.com\u003e) \u003cv@victim.com\u003e;` names only `v@victim.com`, and Nodemailer read it as the single recipient `evil@evil.com`. Affected: 3.0.0 through 10.1.3.\n\n### Attacker capabilities\n\nThe attacker controls the text of an address field that an application passes to Nodemailer, or the header of an inbound message parsed with mailparser. No access to the application, its configuration or its credentials is needed. The value is a syntactically valid RFC 5322 group that conformant parsers accept without defects.\n\n### Realistic exploitation scenario\n\nAn application validates the recipients of a submitted address list with a conformant parser and only allows addresses at its own domain. The attacker submits `G: (a; \u003cevil@evil.com\u003e) \u003cv@victim.com\u003e;`. The validator sees one mailbox, `v@victim.com`, and approves it. Nodemailer delivers to `evil@evil.com` only. The same works through a quoted display name, `G: \"a;\" \"\u003cevil@evil.com\u003e\" \u003cv@victim.com\u003e;`. The boundary crossed is the application's recipient allow list.\n\n### Proof of concept\n\n```js\nconst addressparser = require('nodemailer/lib/addressparser');\nconsole.log(addressparser(\"G: (a; \u003cevil@evil.com\u003e) \u003cv@victim.com\u003e;\"));\n// [ { name: 'G', group: [ [Object] ] }, { address: 'evil@evil.com', name: ') v@victim.com' } ]\n```\n\nPython's `email._header_value_parser.get_address_list` reads the same value as the single mailbox `v@victim.com`, with no defects reported.\n\nThe envelope a message gets is built from the same parse, so `sendMail({ to: \"G: (a; \u003cevil@evil.com\u003e) \u003cv@victim.com\u003e;\" })` issues the RCPT TO shown above.\n\n### Security impact\n\nMail that an application intends for an approved recipient goes to a recipient chosen by the attacker, which discloses its content, and the intended recipient never receives it. The misreading only occurs on values a conformant validator approves, so correct validation is bypassed, which makes it a security issue rather than a parsing bug. Affected are applications that pass user influenced address lists to Nodemailer and consumers of the standalone parser such as mailparser.\n\nThe fix tracks quoted strings and comments inside a group and reads only a `;` outside them.\n\n\nFound in an internal review of addressparser on 2026-10-18. Verified on 3.0.0, 6.9.16 and 10.1.3.","status":"published","published":"2026-10-23T21:51:52Z","modified":"2026-11-04T02:56:08.716354379Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"medium"}],"cwes":["CWE-20","CWE-436"],"updated_at":"2026-11-04T03:25:28.514393Z"},{"id":"UBUNTU-CVE-2026-121424","description":"Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that allows remote attackers to redirect recipients by ending nested RFC 5322 comments at the first closing parenthesis. Attackers can submit addresses whose nested comment hides an attacker address, bypassing conformant validators and recipient allow lists to receive mail or spoof senders in mailparser.","status":"published","published":"2026-11-03T15:17:00Z","modified":"2026-11-05T11:46:31.245677826Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"medium"},{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-05T13:30:15.321876Z"},{"id":"CLSA-2026-1793102000","title":"TuxCare security update for nodemailer (2 CVEs)","description":"TuxCare rebuilt nodemailer to address 2 CVEs. Fixed in 9.0.2-tuxcare.6.","status":"published","published":"2026-10-27T11:53:20Z","modified":"2026-10-27T13:30:14.927699814Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793102100","title":"TuxCare security update for nodemailer (2 CVEs)","description":"TuxCare rebuilt nodemailer to address 2 CVEs. Fixed in 9.0.6-tuxcare.5.","status":"published","published":"2026-10-27T11:55:00Z","modified":"2026-11-07T19:00:36.839608567Z","updated_at":"2026-11-07T19:21:34.633914Z"},{"id":"CLSA-2026-1793102196","title":"TuxCare security update for nodemailer (6 CVEs)","description":"TuxCare rebuilt nodemailer to address 6 CVEs. Fixed in 9.1.0-tuxcare.7.","status":"published","published":"2026-10-27T11:56:36Z","modified":"2026-11-07T19:13:14.238934459Z","updated_at":"2026-11-07T19:21:34.633914Z"},{"id":"CLSA-2026-1793102303","title":"TuxCare security update for nodemailer (2 CVEs)","description":"TuxCare rebuilt nodemailer to address 2 CVEs. Fixed in 9.0.5-tuxcare.6.","status":"published","published":"2026-10-27T11:58:23Z","modified":"2026-10-27T13:30:12.275142272Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793102402","title":"TuxCare security update for nodemailer (3 CVEs)","description":"TuxCare rebuilt nodemailer to address 3 CVEs. Fixed in 9.0.0-tuxcare.6.","status":"published","published":"2026-10-27T12:00:02Z","modified":"2026-10-27T13:30:10.680962319Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793102503","title":"TuxCare security update for nodemailer (3 CVEs)","description":"TuxCare rebuilt nodemailer to address 3 CVEs. Fixed in 9.0.3-tuxcare.6.","status":"published","published":"2026-10-27T12:01:43Z","modified":"2026-10-27T13:30:12.32788678Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793102593","title":"TuxCare security update for nodemailer (7 CVEs)","description":"TuxCare rebuilt nodemailer to address 7 CVEs. Fixed in 9.0.1-tuxcare.5.","status":"published","published":"2026-10-27T12:03:13Z","modified":"2026-11-07T19:13:13.963417577Z","updated_at":"2026-11-07T19:21:34.633914Z"},{"id":"CLSA-2026-1793102824","title":"TuxCare security update for nodemailer (6 CVEs)","description":"TuxCare rebuilt nodemailer to address 6 CVEs. Fixed in 6.10.1-tuxcare.15.","status":"published","published":"2026-10-27T12:07:04Z","modified":"2026-11-07T19:13:15.264184713Z","updated_at":"2026-11-07T19:21:34.633914Z"},{"id":"CLSA-2026-1793109577","title":"TuxCare security update for nodemailer (1 CVE)","description":"TuxCare rebuilt nodemailer to address 1 CVE. Fixed in 9.0.5-tuxcare.7.","status":"published","published":"2026-10-27T13:59:37Z","modified":"2026-10-27T19:30:03.97115977Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793109690","title":"TuxCare security update for nodemailer (1 CVE)","description":"TuxCare rebuilt nodemailer to address 1 CVE. Fixed in 9.0.2-tuxcare.7.","status":"published","published":"2026-10-27T14:01:30Z","modified":"2026-10-27T19:30:02.39450811Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793109772","title":"TuxCare security update for nodemailer (4 CVEs)","description":"TuxCare rebuilt nodemailer to address 4 CVEs. Fixed in 9.0.6-tuxcare.6.","status":"published","published":"2026-10-27T14:02:52Z","modified":"2026-11-07T19:13:17.261802397Z","updated_at":"2026-11-07T19:21:34.633914Z"},{"id":"CLSA-2026-1793790053","title":"TuxCare security update for nodemailer (2 CVEs)","description":"TuxCare rebuilt nodemailer to address 2 CVEs. Fixed in 2.7.2-tuxcare.10.","status":"published","published":"2026-11-04T12:00:54Z","modified":"2026-11-04T14:45:07.034750795Z","updated_at":"2026-11-04T15:03:54.132276Z"},{"id":"CLSA-2026-1794409427","title":"TuxCare security update for nodemailer (7 CVEs)","description":"TuxCare rebuilt nodemailer to address 7 CVEs. Fixed in 7.0.13-tuxcare.1.","status":"published","published":"2026-11-11T16:03:48Z","modified":"2026-11-11T19:30:04.686106232Z","updated_at":"2026-11-11T19:50:24.684142Z"}]}}