DEBIAN-CVE-2026-121425: High severity debian/node-nodemailer vulnerability
Nodemailer from 3.0.0 before 10.1.4 contains a parsing flaw in addressparser that ends an RFC 5322 group at a semicolon inside quoted display names or comments. Attackers can submit crafted group addresses that conformant validators approve, redirecting mail to attacker-chosen recipients and bypassing recipient allow lists.
Affected Software
Event History
Frequently Asked Questions
Which deployments are most exposed to this issue?
Applications using Nodemailer to parse or enforce policy on RFC 5322 group addresses are exposed, particularly where recipient allow lists or validation decisions rely on addressparser output. The affected package is Debian node-nodemailer, with vulnerable Nodemailer versions from 3.0.0 before 10.1.4.
What does an attacker need to exploit it?
An attacker needs to be able to submit a crafted group address for processing. The crafted address places a semicolon inside a quoted display name or comment, causing addressparser to terminate the group differently from conformant validators.
What is the practical impact of successful exploitation?
A crafted address can pass a conformant validator while causing Nodemailer's parser to redirect mail to attacker-chosen recipients. This can bypass recipient allow lists and expose messages intended only for approved recipients.
How can teams determine whether they are affected?
Check whether the application uses the Debian node-nodemailer package and whether its Nodemailer version is at least 3.0.0 but earlier than 10.1.4. Also identify workflows that accept externally supplied recipient addresses and apply validation or allow-list checks before sending mail.