UBUNTU-CVE-2026-121424: High severity ubuntu/node-nodemailer vulnerability

Published Nov 3, 2026

Updated

Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that allows remote attackers to redirect recipients by ending nested RFC 5322 comments at the first closing parenthesis. Attackers can submit addresses whose nested comment hides an attacker address, bypassing conformant validators and recipient allow lists to receive mail or spoof senders in mailparser.

Affected Software

5 affected components

ubuntu/node-nodemailer*

Event History

Nov 3, 2026

CVE Published

via OSV·03:17 PM

Data Sourced

via OSV·03:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Applications using Nodemailer addressparser or mailparser to process attacker-controlled RFC 5322 address strings are exposed. The practical risk is greatest where parsed addresses are checked against recipient allow lists or used to determine message recipients or sender identities.

What does an attacker need to exploit it?

An attacker needs to be able to submit a crafted email address containing nested RFC 5322 comments. No privileges or user interaction are required, but exploitation has high attack complexity.

What versions are affected?

Nodemailer versions from 3.0.0 before 10.1.4 are affected. Updating to 10.1.4 or later addresses the vulnerable parsing behavior.

What can happen if exploitation succeeds?

A crafted address can hide an attacker-controlled address behind nested comments, potentially bypassing conformant validation and recipient allow lists. This can redirect mail to an attacker or support sender spoofing in mailparser.

UBUNTU-CVE-2026-121424: High severity ubuntu/node-nodemailer vulnerability

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What versions are affected?

What can happen if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What versions are affected?

What can happen if exploitation succeeds?