CVE-2026-121425

Nodemailer versions 3.0.0 before 10.1.4 are vulnerable to a Recipient Injection flaw due to a parsing issue in the addressparser component. The vulnerability occurs because the parser incorrectly ends an RFC 5322 group at a semicolon located inside quoted display names or comments. This allows an...

CVE-2026-121425 Nodemailer 3.0.0 before 10.1.4 Recipient Injection via addressparser Group Parsing

Nodemailer from 3.0.0 before 10.1.4 contains a parsing flaw in addressparser that ends an RFC 5322 group at a semicolon inside quoted display names or comments. Attackers can submit crafted group addresses that conformant validators approve, redirecting mail to attacker-chosen recipients and...

CVE-2026-106648 Royal Elementor Addons < 1.7.1070 - Unauthenticated Arbitrary Email Recipient Injection via Form Field ID Shortcodes

The Royal Elementor Addons WordPress plugin before 1.7.1070 does not validate submitted form field values before substituting them into the recipient addresses of its form notification emails, allowing unauthenticated attackers to replace the recipient list and relay attacker-composed email from...

CVE-2026-106648 Royal Elementor Addons < 1.7.1070 - Unauthenticated Arbitrary Email Recipient Injection via Form Field ID Shortcodes

The Royal Elementor Addons WordPress plugin before 1.7.1070 does not validate submitted form field values before substituting them into the recipient addresses of its form notification emails, allowing unauthenticated attackers to replace the recipient list and relay attacker-composed email from...

WordPress Royal Elementor Addons plugin < 1.7.1070 - Unauthenticated Arbitrary Email Recipient Injection vulnerability

Unauthenticated Arbitrary Email Recipient Injection vulnerability discovered by Mohammed Abd Alrahman in WordPress Plugin Royal Elementor Addons versions 1.7.1070...

CVE-2026-106648

The Royal Elementor Addons WordPress plugin (versions prior to 1.7.1070 ) is vulnerable to Unauthenticated Arbitrary Email Recipient Injection . The root cause is the failure to validate submitted form field values before substituting them into the recipient addresses of form notification emails....

npm: Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient

npm: Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient vulnerability discovered by ? in WordPress npm nodemailer versions = 3.0.0, 10.1.4...

Interpretation Conflict

Overview org.webjars.npm:nodemailer is an Easy as cake e-mail sending from your Node.js applications Affected versions of this package are vulnerable to Interpretation Conflict via the address parser src/addressparser/index.ts when processing angle-addr and group constructs. The tokenizer tracks...

Interpretation Conflict

Overview nodemailer is an Easy as cake e-mail sending from your Node.js applications Affected versions of this package are vulnerable to Interpretation Conflict via the address parser src/addressparser/index.ts when processing angle-addr and group constructs. The tokenizer tracks only a single op...

EUVD-2026-78403

fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization...

Improper Validation of Specified Quantity in Input

Overview nodemailer is an Easy as cake e-mail sending from your Node.js applications Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input via the addressparser module's handling of quoted local-part addresses. When an address of the form...

Encoding Error

Overview fast-uri is a Dependency-free RFC 3986 URI toolbox Affected versions of this package are vulnerable to Encoding Error in the mailto parser process. An attacker can inject unauthorized recipients or manipulate the subject and body fields by crafting a URI with percent-encoded reserved fie...

CVE-2026-86818

fast-uri v4.1.3–4.1.4, a dependency-free RFC 3986 URI parser for Node.js used by Fastify and ajv , suffers from a percent-encoded field-name desynchronization in its mailto parser. At parse time, reserved field names (to, subject, body) are compared in their still-percent-encoded form and thus no...

CVE-2026-82854

Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.size parameter. When an application passes a custom envelope object with a size property containing CRLF characters to sendMail, the value is concatenated into the SMTP MAIL FROM command as SIZE=...

CVE-2026-82854 Nodemailer before 8.0.4 SMTP Command Injection via envelope.size

Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.size parameter. When an application passes a custom envelope object with a size property containing CRLF characters to sendMail, the value is concatenated into the SMTP MAIL FROM command as SIZE=...

EUVD-2026-68442

Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.size parameter. When an application passes a custom envelope object with a size property containing CRLF characters to sendMail, the value is concatenated into the SMTP MAIL FROM command as SIZE=...

Linux Distros Unpatched Vulnerability : CVE-2026-82854

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.size parameter. When an application passes a custom envelope...

osTicket < 1.14.8, 1.15.x < 1.15.4 Multiple Vulnerabilities

osTicket is prone to multiple vulnerabilities. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...