DEBIAN-CVE-2026-121426: Medium severity debian/node-nodemailer vulnerability
Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that ends an angle-addr at a '>' inside a quoted local part, comment or domain literal. Attackers can submit addresses that validate as an allowed domain but are delivered to an attacker-controlled domain, bypassing recipient allow lists and disclosing message content.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using Nodemailer versions from 3.0.0 through versions before 10.1.4 are affected if they rely on addressparser output to enforce recipient-domain allow lists.
What does an attacker need to exploit it?
An attacker needs to be able to submit a crafted recipient address to an application that validates allowed recipient domains with the vulnerable parser. No authentication or user interaction is required according to the supplied vector.
What is the likely impact of a successful bypass?
A crafted address can appear to validate for an allowed domain while the message is delivered to an attacker-controlled domain. This can disclose the email's contents and may permit limited integrity impact through unintended message delivery.
What should be done if upgrading is not immediately possible?
The provided information does not specify a workaround. Avoid treating addressparser-based validation as sufficient enforcement for recipient-domain restrictions until Nodemailer is updated to 10.1.4 or later.