CVE-2026-121425— Nodemailer 3.0.0 before 10.1.4 Recipient Injection via addressparser Group Parsing

Quick assessment

Affected

nodemailer nodemailer

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Nodemailer 3.0.0 至 10.1.4（不含 10.1.4）版本中，其地址解析器（addressparser）存在解析缺陷：当引号包裹的显示名称或注释中包含分号时，解析器会错误地终止 RFC 5322 定义的邮件组。攻击者可构造符合规范的组地址，经合规验证器通过后，将邮件重定向至攻击者指定的收件人，从而绕过收件人白名单机制。

CVSS 6.5 · Medium Updated Nov 04, 2026

Possible ATT&CK Techniques 2 AI

T1056.001 · Keylogging T1566.002 · Spearphishing Link

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Nodemailer 3.0.0 before 10.1.4 Recipient Injection via addressparser Group Parsing

Source: CVE Program / CVE List V5

Vulnerability Description

Nodemailer from 3.0.0 before 10.1.4 contains a parsing flaw in addressparser that ends an RFC 5322 group at a semicolon inside quoted display names or comments. Attackers can submit crafted group addresses that conformant validators approve, redirecting mail to attacker-chosen recipients and bypassing recipient allow lists.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

输入验证不恰当

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
nodemailer	nodemailer	3.0.0 ~ 10.1.4	-

II. Public POCs for CVE-2026-121425

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-121425

请登录查看更多情报信息。

Other References for CVE-2026-121425 (2)

https://github.com/nodemailer/nodemailer/security/advisories/GHSA-m943-m63m-w62w vendor-advisory
https://www.vulncheck.com/advisories/nodemailer-3.0.0-before-10.1.4-recipient-injection-via-addressparser-group-parsing third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-121425

Same Patch Batch · nodemailer · 2026-11-03 · 3 CVEs total

CVE-2026-121426	6.5 MEDIUM	Nodemailer 3.0.0 before 10.1.4 Recipient Domain Confusion via addressparser
CVE-2026-121424	6.5 MEDIUM	Nodemailer 3.0.0 before 10.1.4 Address Parsing Bypass via Nested Comments

IV. Related Vulnerabilities

Same product: nodemailer

Same vendor: nodemailer

Same weakness: CWE-20