CVE-2026-125755: Nodemailer 3.0.0 before 10.4.1 Recipient Allow-List Bypass via addressparser

Published Nov 10, 2026

Updated

Nodemailer 3.0.0 before 10.4.1 contains an address parsing flaw in addressparser that truncates domains at folding whitespace or comments before a dot, allowing attackers to bypass recipient domain restrictions. Attackers can submit crafted to, cc, bcc or replyTo addresses that pass RFC 5322 domain checks but deliver mail to an attacker-chosen address under the application's sender identity.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Nodemailer to a version that resolves this vulnerability.
Fixed in 10.4.1

Event History

Nov 10, 2026

CVE Published

via MITRE·03:22 PM

Data Sourced

via MITRE·03:22 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which applications are exposed to this issue?

Applications using Nodemailer versions from 3.0.0 up to, but not including, 10.4.1 are affected if they enforce recipient domain restrictions using RFC 5322 domain validation or an allow-list based on parsed recipient addresses.

What does an attacker need to exploit the bypass?

An attacker needs to be able to submit a crafted recipient value in a to, cc, bcc, or replyTo field. No authentication or user interaction is required according to the supplied vector, but exploitation requires high attack complexity.

Are applications without recipient domain restrictions affected in the same way?

The described impact is a bypass of recipient domain restrictions. Applications that do not rely on an allow-list or RFC 5322 domain checks for recipient control are not described as vulnerable to this specific bypass.

What is the remediation?

Upgrade Nodemailer to version 10.4.1 or later. The fixed release is identified as v10.4.1.

CVE-2026-125755: Nodemailer 3.0.0 before 10.4.1 Recipient Allow-List Bypass via addressparser

Remediation

Event History

Frequently Asked Questions

Which applications are exposed to this issue?

What does an attacker need to exploit the bypass?

Are applications without recipient domain restrictions affected in the same way?

What is the remediation?

Company

Resources

Contact

Frequently Asked Questions

Which applications are exposed to this issue?

What does an attacker need to exploit the bypass?

Are applications without recipient domain restrictions affected in the same way?

What is the remediation?