CLEANSTART-2026-IM42663 Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322

CVE-2026-42499 affects multiple packages. Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322. See references for individual vulnerability details...

EUVD-2026-101753

Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322 comments inside angle-bracket addresses. Attackers can supply recipients like a display name with a parenthesized comment in the domain, so illegal character...

DEBIAN-CVE-2026-110870

Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322 comments inside angle-bracket addresses. Attackers can supply recipients like a display name with a parenthesized comment in the domain, so illegal character...

CVE-2026-110870 Nodemailer before 10.0.13 Improper Input Validation via Angle-Bracket Address Comments

Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322 comments inside angle-bracket addresses. Attackers can supply recipients like a display name with a parenthesized comment in the domain, so illegal character...

CVE-2026-110870 Nodemailer before 10.0.13 Improper Input Validation via Angle-Bracket Address Comments

Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322 comments inside angle-bracket addresses. Attackers can supply recipients like a display name with a parenthesized comment in the domain, so illegal character...

CVE-2026-110870

The Nodemailer library (versions 3.0.0 to before 10.0.13 ) is vulnerable to an improper input validation flaw in its address parser. The vulnerability stems from a failure to strip RFC 5322 comments found inside angle-bracket addresses. An attacker can provide a recipient containing a display nam...

Unity Linux 20.1070a Security Update: grafana (UTSA-2026-130154)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130154 advisory. Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322. Tenable has extracted the preceding description block...

PT-2026-114184

Name of the Vulnerable Software and Affected Versions Nodemailer versions 3.0.0 through 10.0.12 Description An improper input validation issue exists in the address parser that fails to strip RFC 5322 comments—non-functional notes enclosed in parentheses—within angle-bracket addresses. This allow...

CLEANSTART-2026-ZJ82882 Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322

CVE-2026-42499 affects multiple packages. Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322. See references for individual vulnerability details...

CLEANSTART-2026-OD21402 Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322

Security vulnerability affects the temporal-server package. Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322...

CLEANSTART-2026-IO94492 Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322

Security vulnerability affects the cri-tools package. Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322...

CLEANSTART-2026-QF93365 Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322

CVE-2026-42499 affects multiple packages. Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322. See references for individual vulnerability details...

CLEANSTART-2026-PI24714 Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322

Security vulnerability affects the crane package. Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322...

GHSA-PRGH-XP8R-P3M5 Nodemailer addressparser: O(n^2) on comment-joined addresses enables a remote DoS (reachable via mailparser)

Summary nodemailer/lib/addressparser parses one shape of address in On^2 time. A single 640 KB address value blocks the Node.js event loop for roughly 7 seconds. And it is reachable without auth: mailparser feeds inbound email headers straight into this parser, so one crafted email is enough to...

NPM: Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing

NPM: Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing vulnerability discovered by ? in WordPress Npm nodemailer versions = 9.1.0, 10.0.9...

GHSA-G57G-F23G-4646 Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing

Summary Nodemailer's address parser can produce an unexpected recipient address when an RFC 5322 comment follows the domain of an address whose local-part is a quoted string. For example: text "user"@example.comxevil.com is parsed as: text address: "[email protected] evil.com", name: "" The...

Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing

Summary Nodemailer's address parser can produce an unexpected recipient address when an RFC 5322 comment follows the domain of an address whose local-part is a quoted string. For example: text "user"@example.comxevil.com is parsed as: text address: "[email protected] evil.com", name: "" The...

CLEANSTART-2026-ZC37242 Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322

Security vulnerability affects the argo-workflows package. Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322...

PT-2026-108591

Security vulnerability affects the argo-workflows package. Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322...

CVE-2026-100699

Nodemailer is a Node.js email-sending library. In versions = 9.1.0 and 10.0.9, the address parser src/addressparser mishandles addresses whose local-part is a quoted string and that are followed by RFC 5322 comments, allowing trailing comment-separated domain atoms to be retained in the normalize...