CVE-2026-121424— Nodemailer 3.0.0 before 10.1.4 Address Parsing Bypass via Nested Comments

Quick assessment

Affected

nodemailer nodemailer

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Nodemailer 在 3.0.0 至 10.1.4（不含）版本中存在一个地址解析漏洞。该漏洞位于 addressparser 组件中，允许远程攻击者通过在第一个右括号处提前终止嵌套的 RFC 5322 注释，从而重定向邮件收件人。攻击者可提交包含嵌套注释的地址，利用该注释隐藏恶意地址，进而绕过符合规范的验证器及收件人白名单，实现接收邮件或在 mailparser 中伪造发件人身份。

CVSS 6.5 · Medium Updated Nov 03, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Nodemailer 3.0.0 before 10.1.4 Address Parsing Bypass via Nested Comments

Source: CVE Program / CVE List V5

Vulnerability Description

Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that allows remote attackers to redirect recipients by ending nested RFC 5322 comments at the first closing parenthesis. Attackers can submit addresses whose nested comment hides an attacker address, bypassing conformant validators and recipient allow lists to receive mail or spoof senders in mailparser.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

输入验证不恰当

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
nodemailer	nodemailer	3.0.0 ~ 10.1.4	-

II. Public POCs for CVE-2026-121424

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-121424

请登录查看更多情报信息。

Other References for CVE-2026-121424 (2)

https://github.com/nodemailer/nodemailer/security/advisories/GHSA-8c8m-p3m8-cjg8 vendor-advisory
https://www.vulncheck.com/advisories/nodemailer-3.0.0-before-10.1.4-address-parsing-bypass-via-nested-comments third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-121424

Same Patch Batch · nodemailer · 2026-11-03 · 3 CVEs total

CVE-2026-121426	6.5 MEDIUM	Nodemailer 3.0.0 before 10.1.4 Recipient Domain Confusion via addressparser
CVE-2026-121425	6.5 MEDIUM	Nodemailer 3.0.0 before 10.1.4 Recipient Injection via addressparser Group Parsing

IV. Related Vulnerabilities

Same product: nodemailer

Same vendor: nodemailer

Same weakness: CWE-20