CVE-2026-121426 in Nodemailer
Summary
by MITRE • 11/03/2026
Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that ends an angle-addr at a '>' inside a quoted local part, comment or domain literal. Attackers can submit addresses that validate as an allowed domain but are delivered to an attacker-controlled domain, bypassing recipient allow lists and disclosing message content.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/04/2026
The Nodemailer library, specifically versions prior to 10.1.4, contains a critical address parsing vulnerability within its internal addressparser component. This flaw stems from an incorrect implementation of the email address syntax rules defined in Internet Engineering Task Force standards such as RFC 5322 and RFC 6854 regarding angle-addr structures. In standard email formatting, an angle-addr consists of optional whitespace, a left angle bracket, display name information which may include quoted strings or comments, and finally a right angle bracket enclosing the actual mailbox address. The vulnerability arises because the parser fails to correctly handle cases where a greater-than symbol appears inside a quoted local part, within a comment enclosed in parentheses, or inside a domain literal enclosed in square brackets. Instead of treating these symbols as literal characters that are part of the display name or metadata, the parser prematurely terminates the angle-addr parsing sequence at the first encountered right angle bracket regardless of its context.
This logical error allows an attacker to craft malicious email addresses that appear syntactically valid and pass initial validation checks designed to restrict recipients to a specific allowed domain list. For instance, if an application enforces sending only to users within example.com, an attacker could submit an address formatted with a quoted local part containing a closing angle bracket followed by the actual recipient's address at a malicious external domain. Because the parser incorrectly identifies the internal greater-than symbol as the end of the display name section, it proceeds to parse the subsequent text as the mailbox destination. Consequently, while the initial validation logic might verify that the displayed name or an intermediate component belongs to the allowed domain, the actual envelope recipient address is resolved to a domain controlled by the attacker. This discrepancy between the validated identity and the delivery target constitutes a severe security bypass mechanism.
The operational impact of this vulnerability is significant for any application relying on Nodemailer for transactional emails, notifications, or password resets that implement recipient allow lists as a primary control against email spoofing or data exfiltration. By exploiting this flaw, an attacker can successfully deliver messages to external recipients despite the presence of security controls intended to restrict communication to internal parties only. This leads directly to unauthorized disclosure of sensitive message content, including personally identifiable information, financial details, or confidential corporate communications. Furthermore, if the application uses these emails for critical authentication flows such as password resets, an attacker could potentially hijack user accounts by redirecting reset links to their own infrastructure, thereby facilitating account takeover attacks and compromising overall system integrity.
From a classification perspective, this vulnerability aligns with CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component, specifically regarding the failure to properly handle special characters within structured data formats like email addresses. It also maps to MITRE ATT&CK techniques related to Email Spoofing and Phishing, as it enables an attacker to bypass organizational controls that rely on domain validation for trust establishment. The flaw represents a classic case of logic error in input parsing where the parser does not respect the nesting rules defined by RFC standards, leading to misinterpretation of user-supplied data.
To mitigate this vulnerability, organizations must immediately upgrade Nodemailer to version 10.1.4 or later, which includes patches for the addressparser module to correctly handle angle brackets within quoted strings and comments according to standard email specifications. In addition to upgrading dependencies, developers should implement defense-in-depth strategies by validating recipient addresses at multiple layers of the application stack rather than relying solely on library-level parsing. It is advisable to enforce strict domain allow lists using canonicalized forms of domains and to consider implementing DMARC policies for outbound mail if applicable, although this primarily protects against inbound spoofing. Regular security audits of email handling logic and unit testing with edge-case inputs containing special characters within quoted fields are essential practices to prevent similar parsing bypasses in the future.