900 matches found
CVE-2026-121425
A flaw was found in Nodemailer. This vulnerability allows a remote attacker to cause information disclosure by redirecting outgoing messages to attacker-chosen recipients and bypassing recipient allowlists. The issue occurs because the address parser prematurely terminates email address groups wh...
CVE-2026-121424
A flaw was found in nodemailer. A remote attacker can cause email redirection and information disclosure by supplying a specially crafted email address containing nested comments. The internal address parser prematurely ends comment processing at the first closing parenthesis, treating the...
CVE-2026-121426
A flaw was found in Nodemailer. This vulnerability allows a remote attacker to cause information disclosure by bypassing recipient address restrictions. Due to improper parsing of email addresses containing angle brackets within quoted sections, the parser misidentifies the intended destination...
CVE-2026-121426
Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that ends an angle-addr at a '' inside a quoted local part, comment or domain literal. Attackers can submit addresses that validate as an allowed domain but are delivered to an attacker-controlled domai...
CVE-2026-121425
Nodemailer from 3.0.0 before 10.1.4 contains a parsing flaw in addressparser that ends an RFC 5322 group at a semicolon inside quoted display names or comments. Attackers can submit crafted group addresses that conformant validators approve, redirecting mail to attacker-chosen recipients and...
CVE-2026-121424
Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that allows remote attackers to redirect recipients by ending nested RFC 5322 comments at the first closing parenthesis. Attackers can submit addresses whose nested comment hides an attacker address,...
CVE-2026-121426
The Nodemailer library (versions 3.0.0 to 10.1.4) contains an address parsing vulnerability within the addressparser component. The flaw occurs because the parser incorrectly ends an angle-addr at a ">> ** character found inside a quoted local part, comment, or domain literal. This allows a...
EUVD-2026-115958
Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that ends an angle-addr at a '' inside a quoted local part, comment or domain literal. Attackers can submit addresses that validate as an allowed domain but are delivered to an attacker-controlled domai...
CVE-2026-121425
Nodemailer versions 3.0.0 before 10.1.4 are vulnerable to a Recipient Injection flaw due to a parsing issue in the addressparser component. The vulnerability occurs because the parser incorrectly ends an RFC 5322 group at a semicolon located inside quoted display names or comments. This allows an...
CVE-2026-121425 Nodemailer 3.0.0 before 10.1.4 Recipient Injection via addressparser Group Parsing
Nodemailer from 3.0.0 before 10.1.4 contains a parsing flaw in addressparser that ends an RFC 5322 group at a semicolon inside quoted display names or comments. Attackers can submit crafted group addresses that conformant validators approve, redirecting mail to attacker-chosen recipients and...
CVE-2026-121425 Nodemailer 3.0.0 before 10.1.4 Recipient Injection via addressparser Group Parsing
Nodemailer from 3.0.0 before 10.1.4 contains a parsing flaw in addressparser that ends an RFC 5322 group at a semicolon inside quoted display names or comments. Attackers can submit crafted group addresses that conformant validators approve, redirecting mail to attacker-chosen recipients and...
CVE-2026-121424
The Nodemailer library (versions 3.0.0 before 10.1.4) contains an address parsing vulnerability in the addressparser component. The root cause is that the parser incorrectly handles nested RFC 5322 comments by ending them at the first closing parenthesis. This allows remote attackers to craft add...
CVE-2026-121424 Nodemailer 3.0.0 before 10.1.4 Address Parsing Bypass via Nested Comments
Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that allows remote attackers to redirect recipients by ending nested RFC 5322 comments at the first closing parenthesis. Attackers can submit addresses whose nested comment hides an attacker address,...
EUVD-2026-115956
Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that allows remote attackers to redirect recipients by ending nested RFC 5322 comments at the first closing parenthesis. Attackers can submit addresses whose nested comment hides an attacker address,...
EUVD-2026-115957
Nodemailer from 3.0.0 before 10.1.4 contains a parsing flaw in addressparser that ends an RFC 5322 group at a semicolon inside quoted display names or comments. Attackers can submit crafted group addresses that conformant validators approve, redirecting mail to attacker-chosen recipients and...
CVE-2026-121426: nodemailer: Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that ends an angle-addr…
Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that ends an angle-addr at a '' inside a quoted local part, comment or domain literal. Attackers can submit addresses that validate as an allowed domain but are delivered to an attacker-controlled domai...
CVE-2026-121424: nodemailer: Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that allows remote…
Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that allows remote attackers to redirect recipients by ending nested RFC 5322 comments at the first closing parenthesis. Attackers can submit addresses whose nested comment hides an attacker address,...
CVE-2026-121425: nodemailer: Nodemailer from 3.0.0 before 10.1.4 contains a parsing flaw in addressparser that ends an RFC 5322 group at a semicolon…
Nodemailer from 3.0.0 before 10.1.4 contains a parsing flaw in addressparser that ends an RFC 5322 group at a semicolon inside quoted display names or comments. Attackers can submit crafted group addresses that conformant validators approve, redirecting mail to attacker-chosen recipients and...
