CVE-2026-110870: Nodemailer before 10.0.13 Improper Input Validation via Angle-Bracket Address Comments
Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322 comments inside angle-bracket addresses. Attackers can supply recipients like a display name with a parenthesized comment in the domain, so illegal characters reach envelope.to and RCPT TO, causing rejected delivery or parser interpretation conflicts that bypass domain allow-lists.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using Nodemailer versions from 3.0.0 through versions before 10.0.13 are affected. Exposure is most relevant where an application accepts attacker-controlled recipient addresses or relies on domain allow-lists.
What does an attacker need to exploit this issue?
An attacker needs to be able to supply a recipient address to the application. They can place an RFC 5322 parenthesized comment inside the angle-bracket address, including in the domain portion.
What is the practical impact?
The malformed address content can reach envelope.to and the SMTP RCPT TO command. This can cause delivery rejection or parser interpretation conflicts that bypass domain allow-list checks.
What can be done if upgrading is not immediately possible?
Validate and normalize recipient addresses before passing them to Nodemailer, and reject addresses containing comments or other illegal characters in the address inside angle brackets. Do not rely solely on domain allow-list checks performed on unnormalized address strings.