CVE-2026-121425 in Nodemailer
Summary
by MITRE • 11/03/2026
Nodemailer from 3.0.0 before 10.1.4 contains a parsing flaw in addressparser that ends an RFC 5322 group at a semicolon inside quoted display names or comments. Attackers can submit crafted group addresses that conformant validators approve, redirecting mail to attacker-chosen recipients and bypassing recipient allow lists.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified within Nodemailer versions prior to 10.1.4 represents a critical parsing flaw in the addressparser component, specifically affecting how RFC 5322 compliant email addresses are processed. This issue stems from an incorrect interpretation of semicolons that serve as group delimiters versus those appearing inside quoted strings or comments within display names. According to RFC 5322 standards, a semicolon is used to separate individual recipients in an address list when the context defines it as part of a named group structure. However, the flawed implementation fails to properly account for the scope of quoting and commenting rules, leading to premature termination of these groups whenever a semicolon appears within a quoted display name or inside parentheses denoting comments. This misinterpretation allows attackers to craft maliciously formatted email addresses that appear syntactically valid to standard validators but are parsed incorrectly by Nodemailer's internal logic.
From an operational perspective, this parsing discrepancy enables significant security implications related to mail redirection and access control bypasses. Attackers can exploit this flaw to inject additional recipients into the message envelope without triggering validation errors or alerting automated systems that rely on strict RFC compliance checks. By embedding a semicolon within a quoted string, such as in a display name like "User; Attacker", the parser incorrectly treats the content after the semicolon as part of the recipient list rather than ignoring it due to its position inside quotes. Consequently, emails intended for specific authorized recipients can be silently redirected to addresses controlled by malicious actors. This behavior directly undermines any application-level recipient allow lists or whitelisting mechanisms that depend on accurate parsing of the final destination addresses, effectively allowing unauthorized data exfiltration or phishing campaigns through trusted email channels.
This vulnerability aligns with CWE-20 Improper Input Validation and CWE-74 Injection in External Control of String Syntax. The root cause lies in the failure to correctly parse complex string structures according to established internet standards, resulting in an injection-like effect where attacker-controlled data alters the execution flow of address resolution. In terms of threat modeling, this technique corresponds to ATT&CK T1534 Internal Spearphishing, as it facilitates the manipulation of internal communication flows to deceive or intercept information from within a trusted network boundary. The ability to bypass recipient allow lists also touches upon CWE-284 Improper Access Control, as the system fails to restrict actions based on properly validated inputs.
To mitigate this risk, organizations must immediately upgrade Nodemailer to version 10.1.4 or later, where the addressparser logic has been corrected to strictly adhere to RFC 5322 quoting and commenting rules. Developers should also implement defense-in-depth strategies by validating email addresses at multiple layers of the application stack rather than relying solely on a single library's parsing capabilities. Additionally, logging mechanisms should be enhanced to detect unusual patterns in recipient lists, such as sudden increases in address count or unexpected domain changes, which may indicate exploitation attempts. Regular security audits and static code analysis focused on input validation routines can further reduce the likelihood of similar parsing vulnerabilities arising from other components within the email processing pipeline.