{"id":"CVE-2026-125755","aliases":["CLSA-2026-1794329057","CLSA-2026-1794334703","CLSA-2026-1794338601","CLSA-2026-1794352735","CLSA-2026-1794389879","CLSA-2026-1794399029","EUVD-2026-121238","GHSA-3q53-mvfw-q9v8","GHSA-j5rx-43mx-fv6c"],"status":"published","title":"Nodemailer 3.0.0 before 10.4.1 Recipient Allow-List Bypass via addressparser","description":"Nodemailer 3.0.0 before 10.4.1 contains an address parsing flaw in addressparser that truncates domains at folding whitespace or comments before a dot, allowing attackers to bypass recipient domain restrictions. Attackers can submit crafted to, cc, bcc or replyTo addresses that pass RFC 5322 domain checks but deliver mail to an attacker-chosen address under the application's sender identity.","severity":{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00257,"percentile":0.17489,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-436"],"published":"2026-11-10T15:22:50Z","modified":"2026-11-11T19:30:04Z","fixes":[{"ecosystem":"TuxCare:npm","package":"nodemailer","fixed_in":["9.1.0-tuxcare.9","9.0.6-tuxcare.9"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:npm","package":"nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.1.0-tuxcare.0"},{"fixed":"9.1.0-tuxcare.9"}]}],"versions":["9.1.0","9.1.0-tuxcare.1","9.1.0-tuxcare.2","9.1.0-tuxcare.3","9.1.0-tuxcare.4","9.1.0-tuxcare.5","9.1.0-tuxcare.6","9.1.0-tuxcare.7","9.1.0-tuxcare.8"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.6-tuxcare.0"},{"fixed":"9.0.6-tuxcare.9"}]}],"versions":["9.0.6","9.0.6-tuxcare.1","9.0.6-tuxcare.2","9.0.6-tuxcare.3","9.0.6-tuxcare.4","9.0.6-tuxcare.5","9.0.6-tuxcare.6","9.0.6-tuxcare.7","9.0.6-tuxcare.8"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.5-tuxcare.0"},{"fixed":"9.0.5-tuxcare.10"}]}],"versions":["9.0.5","9.0.5-tuxcare.1","9.0.5-tuxcare.2","9.0.5-tuxcare.3","9.0.5-tuxcare.4","9.0.5-tuxcare.5","9.0.5-tuxcare.6","9.0.5-tuxcare.7","9.0.5-tuxcare.8","9.0.5-tuxcare.9"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.3-tuxcare.0"},{"fixed":"9.0.3-tuxcare.9"}]}],"versions":["9.0.3","9.0.3-tuxcare.1","9.0.3-tuxcare.2","9.0.3-tuxcare.3","9.0.3-tuxcare.4","9.0.3-tuxcare.5","9.0.3-tuxcare.6","9.0.3-tuxcare.7","9.0.3-tuxcare.8"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.2-tuxcare.0"},{"fixed":"9.0.2-tuxcare.10"}]}],"versions":["9.0.2","9.0.2-tuxcare.1","9.0.2-tuxcare.2","9.0.2-tuxcare.3","9.0.2-tuxcare.4","9.0.2-tuxcare.5","9.0.2-tuxcare.6","9.0.2-tuxcare.7","9.0.2-tuxcare.8","9.0.2-tuxcare.9"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"nodemailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.1-tuxcare.0"},{"fixed":"9.0.1-tuxcare.8"}]}],"versions":["9.0.1","9.0.1-tuxcare.1","9.0.1-tuxcare.2","9.0.1-tuxcare.3","9.0.1-tuxcare.4","9.0.1-tuxcare.5","9.0.1-tuxcare.6","9.0.1-tuxcare.7"],"bundled":2}],"products":[{"vendor":"nodemailer","product":"nodemailer"}],"references":[{"url":"https://github.com/nodemailer/nodemailer/security/advisories/GHSA-3q53-mvfw-q9v8","tags":["vendor-advisory","advisory"]},{"url":"https://github.com/nodemailer/nodemailer/commit/c2b9c41bb81b2294ebadd294ad15ff035a17d0a5","tags":["patch","fix"]},{"url":"https://github.com/nodemailer/nodemailer/releases/tag/v10.4.1","tags":["release-notes","advisory"]},{"url":"https://github.com/nodemailer/nodemailer/blob/3b5cf1eec32c81f287870c8a1c9c09640062cfd5/src/addressparser/index.ts#L330-L345","tags":["technical-description","article"]},{"url":"https://www.vulncheck.com/advisories/nodemailer-3.0.0-before-10.4.1-recipient-allow-list-bypass-via-addressparser","tags":["third-party-advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125755","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-j5rx-43mx-fv6c"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/125xxx/CVE-2026-125755.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-125755","title":"Nodemailer 3.0.0 before 10.4.1 Recipient Allow-List Bypass via addressparser","description":"Nodemailer 3.0.0 before 10.4.1 contains an address parsing flaw in addressparser that truncates domains at folding whitespace or comments before a dot, allowing attackers to bypass recipient domain restrictions. Attackers can submit crafted to, cc, bcc or replyTo addresses that pass RFC 5322 domain checks but deliver mail to an attacker-chosen address under the application's sender identity.","status":"published","published":"2026-11-10T15:22:50.055Z","modified":"2026-11-10T15:22:50.055Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-436"],"updated_at":"2026-11-10T16:39:24.347242Z"}],"euvd":[{"id":"EUVD-2026-121238","description":"Nodemailer 3.0.0 before 10.4.1 contains an address parsing flaw in addressparser that truncates domains at folding whitespace or comments before a dot, allowing attackers to bypass recipient domain restrictions. Attackers can submit crafted to, cc, bcc or replyTo addresses that pass RFC 5322 domain checks but deliver mail to an attacker-chosen address under the application's sender identity.","status":"published","published":"2026-11-10T15:22:50Z","modified":"2026-11-10T15:22:50Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-10T20:23:11.353031Z"}],"ghsa":[{"id":"GHSA-j5rx-43mx-fv6c","title":"Nodemailer 3.0.0 before 10.4.1 contains an address parsing flaw in addressparser that truncates...","description":"Nodemailer 3.0.0 before 10.4.1 contains an address parsing flaw in addressparser that truncates domains at folding whitespace or comments before a dot, allowing attackers to bypass recipient domain restrictions. Attackers can submit crafted to, cc, bcc or replyTo addresses that pass RFC 5322 domain checks but deliver mail to an attacker-chosen address under the application's sender identity.","status":"published","published":"2026-11-10T18:31:41Z","modified":"2026-11-10T18:31:46Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"medium"}],"cwes":["CWE-436"],"updated_at":"2026-11-10T18:56:09.133019Z"}],"nvd":[{"id":"CVE-2026-125755","description":"Nodemailer 3.0.0 before 10.4.1 contains an address parsing flaw in addressparser that truncates domains at folding whitespace or comments before a dot, allowing attackers to bypass recipient domain restrictions. Attackers can submit crafted to, cc, bcc or replyTo addresses that pass RFC 5322 domain checks but deliver mail to an attacker-chosen address under the application's sender identity.","status":"published","published":"2026-11-10T16:17:22.767Z","modified":"2026-11-10T16:17:22.767Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-436"],"updated_at":"2026-11-10T18:20:10.790002Z"}],"osv":[{"id":"CVE-2026-125755","title":"Nodemailer 3.0.0 before 10.4.1 Recipient Allow-List Bypass via addressparser","description":"Nodemailer 3.0.0 before 10.4.1 contains an address parsing flaw in addressparser that truncates domains at folding whitespace or comments before a dot, allowing attackers to bypass recipient domain restrictions. Attackers can submit crafted to, cc, bcc or replyTo addresses that pass RFC 5322 domain checks but deliver mail to an attacker-chosen address under the application's sender identity.","status":"published","published":"2026-11-10T15:22:50.055Z","modified":"2026-11-12T02:48:30.972141632Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-436"],"updated_at":"2026-11-12T03:30:55.144331Z"},{"id":"CLSA-2026-1794329057","title":"TuxCare security update for nodemailer (1 CVE)","description":"TuxCare rebuilt nodemailer to address 1 CVE. Fixed in 9.1.0-tuxcare.9.","status":"published","published":"2026-11-10T17:44:17Z","modified":"2026-11-10T19:46:06.41328706Z","updated_at":"2026-11-10T20:12:16.608797Z"},{"id":"CLSA-2026-1794334703","title":"TuxCare security update for nodemailer (1 CVE)","description":"TuxCare rebuilt nodemailer to address 1 CVE. Fixed in 9.0.6-tuxcare.9.","status":"published","published":"2026-11-10T19:18:24Z","modified":"2026-11-11T01:30:03.149218305Z","updated_at":"2026-11-11T01:47:54.277886Z"},{"id":"CLSA-2026-1794338601","title":"TuxCare security update for nodemailer (2 CVEs)","description":"TuxCare rebuilt nodemailer to address 2 CVEs. Fixed in 9.0.5-tuxcare.10.","status":"published","published":"2026-11-10T20:23:22Z","modified":"2026-11-11T13:43:28.821844839Z","updated_at":"2026-11-11T14:12:17.809288Z"},{"id":"CLSA-2026-1794352735","title":"TuxCare security update for nodemailer (2 CVEs)","description":"TuxCare rebuilt nodemailer to address 2 CVEs. Fixed in 9.0.3-tuxcare.9.","status":"published","published":"2026-11-11T00:18:56Z","modified":"2026-11-11T13:43:29.385119504Z","updated_at":"2026-11-11T14:12:17.809288Z"},{"id":"CLSA-2026-1794389879","title":"TuxCare security update for nodemailer (2 CVEs)","description":"TuxCare rebuilt nodemailer to address 2 CVEs. Fixed in 9.0.2-tuxcare.10.","status":"published","published":"2026-11-11T10:37:59Z","modified":"2026-11-11T13:30:03.767871937Z","updated_at":"2026-11-11T13:39:54.306536Z"},{"id":"CLSA-2026-1794399029","title":"TuxCare security update for nodemailer (2 CVEs)","description":"TuxCare rebuilt nodemailer to address 2 CVEs. Fixed in 9.0.1-tuxcare.8.","status":"published","published":"2026-11-11T13:10:30Z","modified":"2026-11-11T19:30:04.791230264Z","updated_at":"2026-11-11T19:50:24.684142Z"}]}}