CVE-2026-121426— Nodemailer 3.0.0 before 10.1.4 Recipient Domain Confusion via addressparser

Quick assessment

Affected

nodemailer nodemailer

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Nodemailer 3.0.0 至 10.1.4 之前的版本中，其模块存在一个地址解析漏洞：当在引用的本地部分、注释或域名字面量（domain literal）内部遇到字符时，解析器会错误地终止角括号地址（angle-addr）。攻击者可利用此漏洞提交经过验证、看似属于允许域名的地址，但实际邮件却被投递到攻击者控制的域名，从而绕过接收方白名单并泄露邮件内容。

CVSS 6.5 · Medium Updated Nov 03, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Nodemailer 3.0.0 before 10.1.4 Recipient Domain Confusion via addressparser

Source: CVE Program / CVE List V5

Vulnerability Description

Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that ends an angle-addr at a '>' inside a quoted local part, comment or domain literal. Attackers can submit addresses that validate as an allowed domain but are delivered to an attacker-controlled domain, bypassing recipient allow lists and disclosing message content.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

输入验证不恰当

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
nodemailer	nodemailer	3.0.0 ~ 10.1.4	-

II. Public POCs for CVE-2026-121426

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-121426

请登录查看更多情报信息。

Other References for CVE-2026-121426 (2)

https://github.com/nodemailer/nodemailer/security/advisories/GHSA-85x2-q946-cp5h vendor-advisory
https://www.vulncheck.com/advisories/nodemailer-3.0.0-before-10.1.4-recipient-domain-confusion-via-addressparser third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-121426

Same Patch Batch · nodemailer · 2026-11-03 · 3 CVEs total

CVE-2026-121424	6.5 MEDIUM	Nodemailer 3.0.0 before 10.1.4 Address Parsing Bypass via Nested Comments
CVE-2026-121425	6.5 MEDIUM	Nodemailer 3.0.0 before 10.1.4 Recipient Injection via addressparser Group Parsing

IV. Related Vulnerabilities

Same product: nodemailer

Same vendor: nodemailer

Same weakness: CWE-20