Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: nodemailer 10.1.4 Clear all filters
TI-2026-84308 CVE-2026-121426 · GHSA-crhf-rr59-7pch

Nodemailer addressparser flaw delivers mail to attacker domains

Priority HIGH 69

Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that ends an angle-addr at a '>' inside a quoted local part, comment or domain literal.

CVSS 4.0HIGH 8.3 Network No auth No interaction EPSS 0.00221 Published 2026-11-03 Partial fix · 10.1.4 CWE-20
TI-2026-84307 CVE-2026-121425 · GHSA-q9mw-f56c-cmvf

Recipient injection in Nodemailer addressparser group parsing

Priority HIGH 69

Nodemailer from 3.0.0 before 10.1.4 contains a parsing flaw in addressparser that ends an RFC 5322 group at a semicolon inside quoted display names or comments.

CVSS 4.0HIGH 8.3 Network No auth No interaction EPSS 0.00322 Published 2026-11-03 Partial fix · 10.1.4 CWE-20
TI-2026-84306 CVE-2026-121424 · GHSA-f6c5-wvmr-hc29

Address parsing bypass in Nodemailer via nested comments

Priority LOW 36

Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that allows remote attackers to redirect recipients by ending nested RFC 5322 comments at the first closing parenthesis.

CVSS 4.0HIGH 8.3 Network No auth No interaction EPSS 0.00337 Published 2026-11-03 Partial fix · 10.1.4 CWE-20