CVE-2026-121425

Nodemailer versions 3.0.0 before 10.1.4 are vulnerable to a Recipient Injection flaw due to a parsing issue in the addressparser component. The vulnerability occurs because the parser incorrectly ends an RFC 5322 group at a semicolon located inside quoted display names or comments. This allows an...