CVE-2026-121425Medium· 6.5▾ TwilightPoC availableNodemailer from 3.0.0 before 10.1.4 contains a parsing flaw in addressparser that ends an RFC 5322 group at a semicolon inside quoted display names or comments. Attackers can submit crafted group addresses that conformant validators appr…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 35.8 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
Nodemailer from 3.0.0 before 10.1.4 contains a parsing flaw in addressparser that ends an RFC 5322 group at a semicolon inside quoted display names or comments. Attackers can submit crafted group addresses that conformant validators approve, redirecting mail to attacker-chosen recipients and bypassing recipient allow lists.
nodemailer >= 3.0.0 < 10.1.4Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
GHSA-m943-m63m-w62wMedium· 6.5Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient
CVE-2026-110870Medium· 5.3Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322 comments inside angle-bracket addresses
CVE-2026-100699Medium· 5.3Nodemailer is a Node.js email-sending library
CVE-2026-121424Medium· 6.5Nodemailer 3.0.0 before 10.1.4 Address Parsing Bypass via Nested Comments
CVE-2026-121426Medium· 6.5Nodemailer 3.0.0 before 10.1.4 Recipient Domain Confusion via addressparser
GHSA-g73g-hqqh-jr95Medium· 5.3Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped