DEBIAN-CVE-2026-121424: High severity debian/node-nodemailer vulnerability
Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that allows remote attackers to redirect recipients by ending nested RFC 5322 comments at the first closing parenthesis. Attackers can submit addresses whose nested comment hides an attacker address, bypassing conformant validators and recipient allow lists to receive mail or spoof senders in mailparser.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using Nodemailer addressparser or mailparser to process attacker-controlled email addresses are exposed, particularly where recipient allow lists or address validation determine who may receive mail. The affected Nodemailer range is 3.0.0 before 10.1.4.
What does an attacker need to exploit it?
An attacker needs to submit a crafted address containing nested RFC 5322 comments. The malformed comment structure can hide an attacker-controlled address from conformant validators or recipient allow lists while Nodemailer parses it differently.
What is the practical impact?
An attacker may redirect messages to an attacker-controlled recipient by bypassing recipient restrictions. In mailparser, the issue can also be used to spoof senders.
How can we reduce risk before updating?
The provided data identifies the parsing discrepancy but does not specify a workaround. Until Nodemailer is updated to 10.1.4 or later, avoid making authorization decisions solely from addresses accepted by external or conformant validators when Nodemailer will later parse those addresses.