Skip to content
CVE PROGRAM SOURCE RECORD6.9 Medium

CVE-2026-110870

Nodemailer before 10.0.13 Improper Input Validation via Angle-Bracket Address Comments

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322 comments inside angle-bracket addresses. Attackers can supply recipients like a display name with a parenthesized comment in the domain, so illegal characters reach envelope.to and RCPT TO, causing rejected delivery or parser interpretation conflicts that bypass domain allow-lists.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

nodemailer nodemailer

Default version status: unaffected

  • 3.0.0 to < 10.0.13affected
  • 10.0.13unaffected
pkg:npm/nodemailer

References