PT-2026-136181

CVE-2026-121424

Published

2026-10-23

Updated

2026-11-03

Description by

CVSS 4.0

8.3

High

MetricsAV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Nodemailer versions 3.0.0 through 10.1.3

Description An issue exists in the addressparser component where nested RFC 5322 comments are terminated at the first closing parenthesis. This allows remote attackers to submit addresses with nested comments that hide an attacker-controlled address, enabling them to bypass conformant validators and recipient allow lists to redirect mail or spoof senders in mailparser.

Recommendations Update to version 10.1.4 or later.

Exploitability

Exploit

Fix

Impacts

Vendors

Affected products

Weakness enumeration

CWE-436: Interpretation Conflict

CWE-20: Improper Input Validation

Related identifiers

CVE-2026-121424