UBUNTU-CVE-2026-125755: Medium severity ubuntu/node-nodemailer vulnerability
Nodemailer 3.0.0 before 10.4.1 contains an address parsing flaw in addressparser that truncates domains at folding whitespace or comments before a dot, allowing attackers to bypass recipient domain restrictions. Attackers can submit crafted to, cc, bcc or replyTo addresses that pass RFC 5322 domain checks but deliver mail to an attacker-chosen address under the application's sender identity.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Nodemailerto a version that resolves this vulnerability.Fixed in 10.4.1
Event History
Frequently Asked Questions
Which applications are realistically exposed to this issue?
Applications using ubuntu/node-nodemailer with Nodemailer versions from 3.0.0 before 10.4.1 are exposed when they enforce recipient-domain restrictions using RFC 5322 domain checks before sending mail.
What does an attacker need to exploit the flaw?
An attacker needs a way to submit a crafted address through a to, cc, bcc, or replyTo field. The crafted address uses folding whitespace or comments before a dot so it passes the application's domain validation while being delivered to an attacker-chosen address.
What is the impact if exploitation succeeds?
The attacker can bypass recipient domain restrictions and cause email to be delivered to an attacker-chosen address under the application's sender identity.