CVE-2026-121424 in Nodemailer
Summary
by MITRE • 11/03/2026
Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that allows remote attackers to redirect recipients by ending nested RFC 5322 comments at the first closing parenthesis. Attackers can submit addresses whose nested comment hides an attacker address, bypassing conformant validators and recipient allow lists to receive mail or spoof senders in mailparser.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 11/04/2026
The vulnerability identified within Nodemailer versions prior to 10.1.4 represents a critical flaw in the library's email address parsing logic, specifically residing in its handling of RFC 5322 compliant comment structures. This issue stems from an incorrect implementation of nested comment termination rules defined by the standard. In valid email formatting, comments enclosed within parentheses can be nested to provide additional metadata or grouping information without altering the actual mailbox address. However, the vulnerable parser fails to correctly track the depth of these nested parentheses during parsing operations. Instead of requiring a matching closing parenthesis for every opening one before considering the comment block closed, the implementation terminates the entire comment section at the very first encountered closing parenthesis character. This deviation from strict RFC 5322 compliance creates a significant ambiguity in how email addresses are interpreted by the mail transport agent and downstream processing systems.
This technical flaw enables remote attackers to perform address redirection attacks with high precision. By crafting an email recipient field that contains nested comments, an attacker can hide their actual malicious destination address within the comment structure while presenting a benign or allowed address as the primary visible component. Because the parser prematurely closes the comment block at the first closing parenthesis, it may misinterpret which part of the string constitutes the valid mailbox and which parts are ignored metadata. Consequently, the mail server processes the message based on this distorted interpretation, effectively redirecting the email to a location chosen by the attacker rather than the intended recipient listed in the visible portion of the address field. This mechanism allows for sophisticated social engineering attacks where the displayed sender or recipient appears legitimate upon casual inspection but delivers content elsewhere.
The operational impact of this vulnerability extends beyond simple message misdirection, significantly compromising the integrity of email security controls that rely on strict validation mechanisms. Many enterprise environments implement recipient allow lists to prevent data exfiltration and ensure compliance with communication policies. These systems typically validate addresses against a whitelist before transmission. The parsing flaw allows attackers to bypass these validators because the visible portion of the crafted address may match an allowed entry, while the actual delivery destination is hidden within the malformed comment structure that gets misparsed. Furthermore, this vulnerability facilitates sender spoofing in mailparser contexts, where the internal representation of the envelope sender can be manipulated by exploiting the same parsing inconsistency. This undermines trust mechanisms such as SPF and DKIM verification if the underlying address resolution is compromised before cryptographic checks are fully applied or interpreted correctly.
From a classification perspective, this issue aligns with CWE-20 Improper Input Validation, specifically regarding the failure to properly validate structured data formats against their defining standards. The vulnerability also maps to MITRE ATT&CK technique T1568.002 Dynamic Resolution, as it involves manipulating how domain or address resolution occurs through malformed input that exploits parser logic rather than network infrastructure changes. Additionally, aspects of this flaw relate to CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component, given the potential for spoofing and redirection affecting downstream mail delivery systems. The core issue is rooted in CWE-697 Incorrect Comparison, where the parser incorrectly determines the boundary between comment metadata and actual address data due to flawed logic regarding nested structures.
Mitigation strategies must prioritize immediate software updates as the primary defense vector. Organizations utilizing Nodemailer should upgrade to version 10.1.4 or later, which contains patches that correctly implement RFC 5322 nesting rules for parentheses in email addresses. For environments where an immediate update is not feasible due to dependency constraints, defensive coding practices can offer partial protection. Developers should avoid relying solely on the library's address parsing for security-critical decisions such as allow-listing recipients or verifying sender identity without additional validation layers. Implementing strict input sanitization that rejects any email addresses containing nested parentheses before they reach the Nodemailer parser can prevent exploitation of this specific flaw. Furthermore, integrating secondary verification mechanisms at the mail transfer agent level, which re-parse and validate headers independently of the application layer logic, provides a robust defense-in-depth approach against address manipulation attacks.