128 matches found
Nodemailer: RFC 5322 Comment Inside An Angle-bracket Address Is Never Stripped
Summary Nodemailer's address parser has three published, patched fixes for RFC 5322 comment " ... " handling inside an addr-spec: GHSA-cc9r-2j5m-2m83 comment glued two domain atoms into one, GHSA-g57g-f23g-4646 the same glue for a quoted local part, and the related ReDoS fixes GHSA-prgh-xp8r-p3m5...
Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped
Summary Nodemailer's address parser has three published, patched fixes for RFC 5322 comment ... handling inside an addr-spec: GHSA-cc9r-2j5m-2m83 comment glued two domain atoms into one, GHSA-g57g-f23g-4646 the same glue for a quoted local part, and the related ReDoS fixes GHSA-prgh-xp8r-p3m5 /...
GHSA-G73G-HQQH-JR95 Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped
Summary Nodemailer's address parser has three published, patched fixes for RFC 5322 comment ... handling inside an addr-spec: GHSA-cc9r-2j5m-2m83 comment glued two domain atoms into one, GHSA-g57g-f23g-4646 the same glue for a quoted local part, and the related ReDoS fixes GHSA-prgh-xp8r-p3m5 /...
Interpretation Conflict
Overview org.webjars.npm:nodemailer is an Easy as cake e-mail sending from your Node.js applications Affected versions of this package are vulnerable to Interpretation Conflict via the address parser in src/addressparser/index.ts when processing email header values containing nested comments. RFC...
Interpretation Conflict
Overview nodemailer is an Easy as cake e-mail sending from your Node.js applications Affected versions of this package are vulnerable to Interpretation Conflict via the address parser in src/addressparser/index.ts when processing email header values containing nested comments. RFC 5322 §3.2.2...
Interpretation Conflict
Overview nodemailer is an Easy as cake e-mail sending from your Node.js applications Affected versions of this package are vulnerable to Interpretation Conflict via the address parser src/addressparser/index.ts when processing angle-addr and group constructs. The tokenizer tracks only a single op...
EUVD-2026-101753
Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322 comments inside angle-bracket addresses. Attackers can supply recipients like a display name with a parenthesized comment in the domain, so illegal character...
UBUNTU-CVE-2026-110870
Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322 comments inside angle-bracket addresses. Attackers can supply recipients like a display name with a parenthesized comment in the domain, so illegal character...
DEBIAN-CVE-2026-110870
Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322 comments inside angle-bracket addresses. Attackers can supply recipients like a display name with a parenthesized comment in the domain, so illegal character...
CVE-2026-110870
Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322 comments inside angle-bracket addresses. Attackers can supply recipients like a display name with a parenthesized comment in the domain, so illegal character...
CVE-2026-110870
Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322 comments inside angle-bracket addresses. Attackers can supply recipients like a display name with a parenthesized comment in the domain, so illegal character...
CVE-2026-110870
A flaw was found in Nodemailer. A remote attacker can bypass domain allow-lists or cause email delivery failures by submitting specially crafted recipient addresses. Because the address parser fails to properly strip parenthesized comments within formatted email addresses, unvalidated characters...
CVE-2026-110870 Nodemailer before 10.0.13 Improper Input Validation via Angle-Bracket Address Comments
Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322 comments inside angle-bracket addresses. Attackers can supply recipients like a display name with a parenthesized comment in the domain, so illegal character...
CVE-2026-110870
Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322 comments inside angle-bracket addresses. Attackers can supply recipients like a display name with a parenthesized comment in the domain, so illegal character...
CVE-2026-110870 Nodemailer before 10.0.13 Improper Input Validation via Angle-Bracket Address Comments
Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322 comments inside angle-bracket addresses. Attackers can supply recipients like a display name with a parenthesized comment in the domain, so illegal character...
CVE-2026-110870 Nodemailer before 10.0.13 Improper Input Validation via Angle-Bracket Address Comments
Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322 comments inside angle-bracket addresses. Attackers can supply recipients like a display name with a parenthesized comment in the domain, so illegal character...
CVE-2026-110870
The Nodemailer library (versions 3.0.0 to before 10.0.13 ) is vulnerable to an improper input validation flaw in its address parser. The vulnerability stems from a failure to strip RFC 5322 comments found inside angle-bracket addresses. An attacker can provide a recipient containing a display nam...
CVE-2026-110870
Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322 comments inside angle-bracket addresses. Attackers can supply recipients like a display name with a parenthesized comment in the domain, so illegal character...
Linux Distros Unpatched Vulnerability : CVE-2026-110870
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322 comments inside...
CVE-2026-110870: Improper Input Validation
Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322 comments inside angle-bracket addresses. Attackers can supply recipients like a display name with a parenthesized comment in the domain, so illegal character...