CVE-2026-121425

Name of the Vulnerable Software and Affected Versions Nodemailer versions 3.0.0 through 10.1.3

Description A parsing flaw exists in the addressparser component. The issue occurs when an RFC 5322 group is terminated by a semicolon located within quoted display names or comments. This allows attackers to provide specially crafted group addresses that pass validation, enabling them to bypass recipient allow lists and redirect emails to unauthorized recipients.

Recommendations Update to version 10.1.4 or later.