CVE-2026-110870

5.3 MEDIUMpublic exploit available

Published 2026-10-14 · Updated 2026-10-15

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322 comments inside angle-bracket addresses. Attackers can supply recipients like a display name with a parenthesized comment in the domain, so illegal characters reach envelope.to and RCPT TO, causing rejected delivery or parser interpretation conflicts that bypass domain allow-lists.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weaknesses

CWE-20

Public exploit & PoC references

https://github.com/nodemailer/nodemailer/security/advisories/GHSA-g73g-hqqh-jr95

All references

https://github.com/nodemailer/nodemailer/security/advisories/GHSA-g73g-hqqh-jr95
https://www.vulncheck.com/advisories/nodemailer-before-10.0.13-improper-input-validation-via-angle-bracket-address-comments

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

UNSCOREDCVE-2023-5649
MEDIUMCVE-2025-31980
MEDIUMCVE-2025-32000
CRITICALCVE-2025-71383
HIGHCVE-2026-100113
HIGHCVE-2026-100117
HIGHCVE-2026-100119
HIGHCVE-2026-100120

Related by shared AI tags and CWE weakness class. Browse the full archive.