CVE-2026-121424
Medium · 6.5CVSS
6.5
EPSS
0.3%
Published
Nov 3, 2026
CISA due date
—
The record
Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that allows remote attackers to redirect recipients by ending nested RFC 5322 comments at the first closing parenthesis. Attackers can submit addresses whose nested comment hides an attacker address, bypassing conformant validators and recipient allow lists to receive mail or spoof senders in mailparser.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-116654 Tanium addressed an improper input validation vulnerability in Threat Response. CWE-20
- CVE-2026-116653 Tanium addressed an improper input validation vulnerability in Threat Response. CWE-20
- CVE-2026-121240 Improper input validation in Variations in Google Chrome prior to 157.0.8103.38 allowed a… CWE-20
- CVE-2026-121242 Improper input validation in WebPackaging in Google Chrome prior to 157.0.8103.38 allowed… CWE-20
- CVE-2026-121236 Improper input validation in Network in Google Chrome prior to 157.0.8103.38 allowed a… CWE-20
- CVE-2026-121163 Improper input validation in Browser in Google Chrome prior to 157.0.8103.38 allowed a… CWE-20
- CVE-2026-121141 Improper input validation in Editing in Google Chrome prior to 157.0.8103.38 allowed a… CWE-20
- CVE-2026-121115 Improper input validation in Shopping in Google Chrome prior to 157.0.8103.38 allowed a… CWE-20